Stuxnet

Discovery

According to media and secondary accounts · not confirmed by official sourcesAccording to the Symantec team, the Belarusian company VirusBlokAda announced the discovery of a new sample that spread through removable drives by exploiting an unpatched vulnerability in Windows. Symantec began investigating on 13 July 2010. The earliest sample it was able to find dates from June 2009.³

The US Industrial Control Systems Cyber Emergency Response Team, ICS-CERT, warned in 2010 (in an advisory now on the CISA website) that the program ran as soon as a user viewed a USB drive in a file manager, exploiting a previously unknown flaw in the way Windows handles shortcut files, and installed a trojan that interacted with Siemens SIMATIC WinCC or STEP 7 software. Its full capabilities and intent were not yet known.²

How it worked

According to media and secondary accounts · not confirmed by official sourcesSymantec’s technical report (W32.Stuxnet Dossier, version 1.4 of February 2011) – an industry source, not an official one – describes four exploited Microsoft vulnerabilities previously unknown to the vendor: two were used for spreading and two for privilege escalation. The program’s drivers were signed with certificates of Realtek Semiconductor and JMicron Technology, which had been compromised by the attackers and were later revoked.⁴

According to media and secondary accounts · not confirmed by official sourcesAccording to the same report, the part of the program that modified PLC code targeted frequency converter drives from two manufacturers, the Finnish Vacon and the Iranian Fararo Paya, operating between 807 and 1,210 Hz. At intervals the program set the frequency to 1,410 Hz, then to 2 Hz and then to 1,064 Hz, thereby changing the speed of the motors.⁴

At a hearing of the US Senate Committee on Homeland Security and Governmental Affairs on 17 November 2010, Symantec’s Dean Turner said that Stuxnet was the first known threat to exploit four such vulnerabilities, that it reprogrammed PLCs and compromised two digital certificates, and that most infected systems were in Iran.¹

According to media and secondary accounts · not confirmed by official sourcesESET published its own analysis (Stuxnet Under the Microscope, by Alexandr Matrosov, Eugene Rodionov, David Harley and Juraj Malcho); version 1.3 appeared in December 2010.⁵

Scale and spread of infections

According to media and secondary accounts · not confirmed by official sourcesBy 29 September 2010 Symantec had counted about 100,000 infected computers, about 60% of them in Iran.⁴

Who was behind it: attribution disputed

According to media and secondary accounts · not confirmed by official sourcesThe authors of the Symantec report caution against drawing conclusions about the perpetrators and note that attackers might wish to point to someone else (see false flag).⁴

According to media and secondary accounts · not confirmed by official sourcesOn 1 June 2012 The New York Times reported, citing participants in the programme, that Stuxnet was part of an operation called ‘Olympic Games’, begun under President George W. Bush and accelerated by Barack Obama, against Iran’s uranium enrichment facilities. NPR’s report of that day records no official confirmation or denial.⁶

None of the official sources we opened names a perpetrator. How states attribute cyber attacks is explained in our article How states attribute cyber attacks.^1,2

Significance

In a peer-reviewed article in Security Studies (2013), Jon R. Lindsay treats Stuxnet as the first known network attack to cause physical damage across international borders. He uses it to challenge the ‘cyber revolution’ thesis: in his view, building such a weapon takes resources available mainly to strong states.⁷