Bits before bombs: How Stuxnet crippled Iran’s nuclear dreams

You’re starting on page 2 of this, click here to start at the beginning.

How it worked

Stuxnet specifically targets Windows 7 operating systems, which is, not coincidentally, the same operating system used at the Iranian nuclear power plant. The worm uses four zero-day attacks and specifically targets Siemens’ WinCC/PCS 7 SCADA software. A zero-day threat is a vulnerability that is either unknown or unannounced by the manufacturer. These are generally system-critical vulnerabilities, and once they are discovered, immediately patched. In this case, the two of the zero-day elements had been discovered and were close to having a fixes released, but two others had never been discovered by anyone. Once the worm was in the system, it then began to exploit other systems in the local network it was targeting.

As Stuxnet worked its way through the Iranian systems, it was challenged by the system’s security to present a legitimate certificate. The malware then presented two authentic certificates, one from the circuit manufacturer JMicron, and the other from computer hardware manufacturer Realtek. Both companies are located in Taiwan just blocks away from each other, and both certificates were confirmed to have been stolen. These authentic certificates are one of the reasons that the worm was able to remain undetected for so long.

The malware also had the ability to communicate via peer-to-peer sharing when an Internet connection was present, which allowed it to upgrade as necessary and report back its progress. The servers that Stuxnet communicated with were located in Denmark and Malaysia, and both were shut down once the worm was confirmed to have entered the Natanz facility.

bits before bombs how stuxnet crippled irans nuclear dreams usb thumb drive 2As Stuxnet began to spread throughout the Iranian systems, it began to target only the “frequency converters” responsible for centrifuges. Using variable-frequency drives as markers, the worm looked specifically for drives from two vendors: Vacon, which is based in Finland, and Fararo Paya, which is based in Iran. It then monitors the specified frequencies, and only attacks if a system is running between 807Hz and 1210Hz, a fairly rare frequency that explains how the worm could so specifically target Iranian nuclear plants despite spreading around the world. Stuxnet then sets about altering the output frequency, which affects the connected motors. Although at least 15 other Siemens’ systems have reported infection, none have sustained any damage from the worm.

To first reach the nuclear facility, the worm needed to be brought into the system, possibly on a USB drive. Iran uses an “air gap” security system, meaning the facility has no connection to the Internet. This might explain why the worm spread so far, as the only way for it to infect the system is was to target a wide area and act as a Trojan while waiting for an Iranian nuclear employee to receive an infected file away from the facility and physically bring it into the plant. Because of this, it will be almost impossible to know exactly where and when the infection began, as it may have been brought in by several unsuspecting employees.

But where did it come from, and who developed it?

Suspicions of where the worm originated are rampant, and the most likely single suspect is Israel. After thoroughly researching the virus, Kaspersky Labs announced that the level of attack, and the sophistication with which it was executed could only have been carried out “with nation-state support”, which rules out private hacker groups, or even larger groups that have been using hacking as a means to an end, such as the Russian Mafia, which is suspected of creating a Trojan worm responsible for stealing over $1 million from a British bank.

Israel fully admits that it considers cyberwarfare to be a pillar of its defense doctrine, and the group known as Unit 8200, an Israeli defense force considered to be the rough equivalent of the United States’ NSA, would be the most likely group responsible.

Unit 8200 is the largest division in the Israeli Defense Force, and yet the majority of its operations are unknown- even the identity of the Brigadier General in charge of the unit is classified. Among its many exploits, one report claims that during an Israeli airstrike on a suspected Syrian nuclear facility in 2007, Unit 8200 activated a secret cyber kill switch that deactivated large sections of the Syrian radar.

To further lend credence to this theory, in 2009, Israel pushed back the date of when it expects Iran to have rudimentary nuclear weaponry to 2014. This may have been a result of hearing of problems, or it could suggest that Israel knew something no one else did.

The U.S. is also a prime suspect, and in May of this year, Iran claimed to have arrested 30 people it claims were involved in helping the U.S. wage a “cyber war” against Iran. Iran has also claimed that the Bush administration funded a $400 million plan to destabilize Iran by using cyber attacks. Iran has claimed that the Obama administration has continued that same plan, and even sped up some of the projects. Critics have stated that Iran’s claims are simply an excuse to stamp out “undesirables”, and the arrests are one of many points of contentions between Iran and the U.S.

But as the virus continues to be studied and more answers emerged regarding its function, more mysteries are being raised about its origins.

According to Microsoft, the virus would have taken at least 10,000 hours of coding, and taken a team of five people or more, at least six months of dedicated work. Many are now speculating that it would require the combined efforts of several nations’ intelligence communities all working together to create the worm. While the Israelis might have the determination and the technicians, some are claiming that it would require the United States’ level of technology to code the malware. To know the exact nature of the Siemens machinery to the extent that Stuxnet did might suggest German involvement, and the Russians may have been involved in detailing the specs of the Russian machinery used. The worm was tailored to operate on frequencies that involved Finnish components, which suggests that Finland, and perhaps NATO is involved as well. But there are still more mysteries.

bits before bombs how stuxnet crippled irans nuclear dreams natanzThe worm was not detected because of its actions at the Iranian nuclear facilities, but rather as a result of the widespread infection of Stuxnet. The central processing core of the Iranian nuclear processing plant is located deep underground, and is totally cut off from the Internet. For the worm to infect the system, it must have been brought in on the computer or a flash drive of a member of the staff. All it would take is a single employee to take work home with them, then return and insert something as innocuous as a flash drive into the computer, and Stuxnet would begin its silent march to the specific machinery it wanted.

But the question then becomes: Why did the people responsible for the virus develop such an incredibly sophisticated cyberweapon, and then release it in what is arguably such a sloppy method? If the goal was to remain undetected, the release of a virus that has the ability to replicate at the speed that it has shown is sloppy. It was a matter of when, not if, the virus would be discovered.

The most likely reason is that the developers simply didn’t care. To plant the malware more carefully would have taken far more time, and the transmission of the worm into the specific systems might take much longer. If a country is looking for immediate results to halt what it might see as an impending attack, then speed might trump caution. The Iranian nuclear plant is the only infected system to report any real damage from Stuxnet, so the risk to other systems seems to be minimal.

So what next?

Siemens has released a detection and removal tool for Stuxnet, but Iran is still struggling to remove the malware completely. As recently as November 23, the Iranian facility of Natanz was forced to shut down, and further delays are expected. Eventually, the nuclear program should be back up and running.

In a separate, but possibly related story, earlier this week two Iranian scientists were killed by separate but identical bomb attacks in Tehran, Iran. At a press conference the following day, President Ahmadinejad told reporters that “Undoubtedly, the hand of the Zionist regime and Western governments is involved in the assassination.”

Earlier today, Iranian officials claimed to have made several arrests in the bombings, and although the suspects identities have not been released, Iran’s Intelligence Minister has said “The three spy agencies of Mossad, CIA and MI6 had a role in the (attacks) and, with the arrest of these people, we will find new clues to arrest other elements,”

The combination of the bombings and the damage caused by the Stuxnet virus should weigh heavily over the upcoming talks between Iran and a six-nation confederation of China, Russia, France, Great Britain, Germany, and the U.S. on December 6 and 7. The talks are meant to continue the dialogue regarding Iran’s possible nuclear ambitions.

Emerging Tech

Climeworks wants to clean the atmosphere with a fleet of truck-sized vacuums

Using machines that resemble jet engines, Climeworks wants to fight climate change by extracting CO2 from thin air. The gas can then be sold to carbonated drink and agriculture companies, or sequestered underground.
Product Review

Something's rotten in Days Gone, and it's not the zombies

Days Gone’s predictable story is littered with repetitive missions, shoddy stealth and gunplay, and needless survival mechanics. It’s riddled with performance issues, like janky animations and consistent framerate drops.

Keep your driving record squeaky clean with these top-flight radar detectors

Nobody likes getting a speeding ticket, but these gadgets can help. Check out our picks for the best radar detectors on the market, from the likes of Valentine One, Escort, and Beltronics.
Emerging Tech

The grid of the future will be powered by … giant subterranean bagpipes?

In order to transition to a more renewable-focused energy system, we need to scale up our grid storage capacity --- and our existing methods aren't going to cut it. Could compressed air be the key?

Nvidia agrees with Tesla’s take on self-driving cars, but corrects specifics

Nvidia vice president Rob Csongor agreed with broad statements by Elon Musk at Tesla's April 22 Autonomy Investor Day. Csongor then took exception to what he termed were inaccuracies about Nvidia's self-driving car chip.
Product Review

Still waiting for a new Mac Pro? Corsair’s mini PC has all the power you'll need

With a modern 12-core Intel Core i9-9920X processor, Nvidia’s RTX 2080 Ti graphics, and 32GB of RAM, the Corsair One Pro is designed to woo creatives who demand more power from Apple’s Mac Pro. Like the Mac Pro, the best part of this PC…

Amal and George Clooney want to change the world. Can Microsoft help?

Microsoft and The Clooney Foundation for Justice (CFJ) unveiled the TrialWatch app Thursday morning, a new tool in CFJ’s ongoing TrialWatch effort to shine a light on injustice in courts around the globe – which too often are simply…

Tablet or notebook? Our favorite 2-in-1 PCs give you the best of both worlds

If you can’t decide if you need a tablet or a notebook, then don’t bother. The best 2-in-1 laptops are both, and they can provide all the power you need. Check out our list for the best 2-in-1s for any user.

These are the best 13-inch laptops you can buy right now

With so much choice out there, how do you know which are the best 13-inch laptops? They should have beautiful screens, long battery life, and remain light and portable. This is a list of our favorites.

These gaming monitors will transport you to another dimension

What are the best gaming monitors you can buy right now? We select five that are all priced under $900 packing premium technologies like G-SYNC and FreeSync, high resolutions, and fast refresh rates.

Luminar Accent A.I. can now recognize faces for more natural instant edits

Want to edit faster? Skylum Luminar's latest update enhances the Accent A.I. to use machine learning for instant enhancements. The tool now recognizes faces for more natural skin tones along with other enhancements.

Intel’s 10nm desktop dreams may be dead — new road map pushes them beyond 2022

Intel may never release a competitive 10nm CPU on desktop if a new roadmap is to be believed. It suggests that Intel will rely on its 14nm process to at least 2022 and perhaps even beyond.

Turn your desk into a command center with the best ultrawide monitors

Top of the line ultrawide monitors have the deepest curves, the sharpest colors, and the biggest screens on the market. You’re going to want one, sooner or later. So why not sooner? These are the best ultrawide monitors you can buy now.

Corsair’s Ironclaw, Glaive gaming mice are tuned for performance and comfort

Corsair is adding wireless capabilities to its Ironclaw gaming mouse this year, while the Glaive RGB Pro has been updated for maximum comfort with thoughtful ergonomics. Both mice feature accurate tracking and durable buttons.
2 of 2