Skip to main content

10 years after Stuxnet, the most powerful cyberweapon is now social media

A decade ago, the landscape of war changed forever.

On July 15, 2010, researchers discovered a massive malware worm installed in the industrial control systems of Iran’s nuclear development sites, where uranium was being enriched. The worm, more complex than any malware seen before, came to be known as Stuxnet.

Related Videos

But the prohibitive cost and manpower of developing dangerous targeted malware like Stuxnet means that many nation-states have started leaning on a new cyberweapon of choice: Social media.

A complex and dangerous tool

At the time, Stuxnet was revolutionary. It bridged the gap between the digital and physical worlds in a way that hadn’t been done up to that point, said Ryan Olson, vice president of threat intelligence at Palo Alto Networks. “This was a significant event,” he said.

Kim Zetter, a journalist and one of the foremost experts on the Stuxnet virus, said that it wasn’t just the virus’s complexity or sophistication that was impressive, it was what virus targeted and how. “It targeted systems that weren’t connected to the internet,” she told Digital Trends. “And it introduced to the security community, and the world, vulnerabilities that exist in critical infrastructure systems.”

Stuxnet was a totally new paradigm in terms of what could now be accomplished,” said Axel Wirth, chief security strategist at MedCrypt, a cybersecurity company specializing in medical devices. “The methodology used to penetrate its target environment was much better planned than any other piece of malware used before.”

It’s thought that the virus found its way into Iran nuclear facilities via a thumb drive. From there, the virus was able to make a copy of itself and hide in an encrypted folder. It then lay dormant, Wirth told Digital Trends. The worm would activate when a specific configuration of systems only found in Iran was turned on. Ultimately, experts believed the virus caused significant damage to the Natanz nuclear enrichment site in Iran.

Strong evidence points to Stuxnet’s development being a joint effort between the U.S. and Israel, according to the Washington Post, although neither country has ever claimed responsibility.

Cyberweapons, however, always have an unintended side effect when they’re discovered.

Zero Days - Official Trailer

“The difference between an offensive cyberweapon and, say, the Manhattan Project, is that a nuclear bomb doesn’t leave defensive schematics scattered all over the landscape,” said Chris Kennedy, former director of cyberdefense at both the Department of Defense and the U.S. Treasury. “Cyberweapons do.”

In other words, once Stuxnet was discovered, it was hard to contain. Experts and hackers could look at the code, dissect the worm, and take out parts of it to use for themselves. Many cyberweapons found since Stuxnet have had parts of the Stuxnet code in them, although these new tools aren’t nearly as sophisticated, Kennedy said.

“Billions of dollars went into creating Stuxnet and became publicly consumable information,” said Kennedy, who is currently the chief information security officer at cybersecurity firm AttackIQ. “That kind of screws with the value of the investment.”

A better return on investment

Social media manipulation can also be effective at destabilizing or attacking foes — and is much cheaper.

“Social media is a lower form of attack,” said Kennedy, “but it’s easier to do. You just get a bunch of not-as-smart people to pump false information into Facebook and the analytics take it away. Now, attacks like Stuxnet will be reserved for specialized goals because they’re so expensive and challenging to create.”

Kennedy said that whatever buzzword could be used to talk about the Russian influence in the 2016 elections, “that’s the new Stuxnet.”

“Rather than attacks on systems or on individual computers, these are attacks on societies and economies.”

“It’s easier, cheaper, and has a much more brand effect,” he said.

Wirth told Digital Trends that cyberattacks are now “broader” in scope.

“Rather than attacks on systems or on individual computers, these are attacks on societies and economies,” he said. “Traditional tools have been augmented by social media attacks and misinformation campaigns.”

“The future is combined,” said Kennedy, in terms of what cyber warfare could look like. “You use a social media campaign for propaganda and influence to shape local populations, then you use cyberweapons to affect specific targets. And if that doesn’t work, then we bring in the troops and start blowing stuff up.”

Editors' Recommendations

Personal data of 69 million Neopets users is now up for sale after a data breach
Person typing on a computer keyboard.

Neopets, an aged website that lets users keep virtual pets and take care of them, just suffered a major data breach. Aside from the personal data of over 69 million users, the hacker was able to obtain the website's source code.

This isn't the first time Neopets has faced a massive leak, but this time around, user data is currently being sold for crypto -- and the leak includes more than just usernames and passwords.

Read more
Hackers can now take over your computer through Microsoft Word
A dark mystery hand typing on a laptop computer at night.

A new zero-day vulnerability in Microsoft Office could potentially allow hackers to take control of your computer. The vulnerability can be exploited even if you don't actually open an infected file.

Although we're still waiting for an official fix, Microsoft has released a workaround for this exploit, so if you frequently use MS Office, be sure to check it out.

Read more
Social media scammers stole a huge amount of money in 2021
A person using a smartphone.

Scammers are increasingly turning to social media platforms, with fraud via popular services such as Instagram, Facebook, TikTok, and Twitter netting criminals at least $770 million in 2021, according to data from the Federal Trade Commission (FTC).

But as few people tend to report such frauds due to feelings of embarrassment or shame, the 95,000 victims in the commission's research are estimated to represent only a "small fraction" of the total number of such cases, the FTC said.

Read more