
The first cyber smart bomb has been delivered, and researchers are still trying to figure out who did it, and even what the target was. Stuxnet may be getting lots of attention in the news over the last week, but what is most interesting about this cyber smart bomb is that the payload expected to finish the job by January 2010 - meaning whatever got hit was hit months ago.
I rarely get the opportunity to discuss cyber security on the blog - contractually I must get approval to blog such discussions. In most cases I simply ignore the topic and let someone else do it better than I anyway, but in the case of Stuxnet we cannot ignore what has happened on ID.
For technical professionals I encourage you to
monitor Symantec for updates and revelations regarding Stuxnet. I personally hope that
Liam O'Murchu publishes his paper on the worm for public consumption while responsibly withholding certain details. Stuxnet is a game changer for cyber warfare for many reasons, but one reason we must not ignore is that Stuxnet represents the first seriously dangerous piece of malware to be openly disseminated and discussed in the context of a state level cyber smart bomb.
For those who want to be caught up to speed,
here is a brief recap.
The Stuxnet worm is a "groundbreaking" piece of malware so devious in its use of unpatched vulnerabilities, so sophisticated in its multipronged approach, that the security researchers who tore it apart believe it may be the work of state-backed professionals.
"It's amazing, really, the resources that went into this worm," said Liam O Murchu, manager of operations with Symantec's security response team.
"I'd call it groundbreaking," said Roel Schouwenberg, a senior antivirus researcher at Kaspersky Lab. In comparison, other notable attacks, like the one dubbed Aurora that hacked Google's network and those of dozens of other major companies, were child's play.
As the
New Scientist notes, Stuxnet is unlike anything seen before.
Computer viruses, worms and trojans have until now mainly infected PCs or the servers that keep e-businesses running. They may delete key system files or documents, or perhaps prevent website access, but they do not threaten life and limb.
The Stuxnet worm is different. It is the first piece of malware so far able to break into the types of computer that control machinery at the heart of industry, allowing an attacker to assume control of critical systems like pumps, motors, alarms and valves in an industrial plant.
In the worst case scenarios, safety systems could be switched off at a nuclear power plant; fresh water contaminated with effluent at a sewage treatment plant, or the valves in an oil pipeline opened, contaminating the land or sea.
"Giving an attacker control of industrial systems like a dam, a sewage plant or a power station is extremely unusual and makes this a serious threat with huge real world implications," says Patrick Fitzgerald, senior threat intelligence officer with Symantec. "It has changed everything."
Stuxnet was written with a specific target in mind, but it is still unclear what that target was. As recently as Wednesday night
Forbes began to speculate that the target was India's INSAT 4B satellite which apparently went offline due to a system glitch on July 7, 2010. Forbes speculates that the virus could have been written by the Chinese to disable the satellite to force SunDirect to order its servicemen "to redirect customer satellite dishes to point to ASIASAT-5, a Chinese satellite owned and operated by Asia Satellite Telecommunications Co., Ltd (AsiaSat)."
That follows speculation from an article in the
Christian Science Monitor (and to some degree
the German newspaper FAZ) that the target was the Iranian Bushehr reactor, which leads to the natural suggestion that the Israeli's developed the malware. The bottom line on Stuxnet is we have a serious cyber warfare capability that was unleashed on a target that needs to be examined.
Professional Grade War 2.0As Symantec notes, there are
no less than 4 zero day Microsoft Windows vulnerabilities that Stuxnet is able to seamlessly exploit, although apparently one of the vulnerabilities had
been known about since 2009, even though Microsoft failed to provide
a patch until a few weeks ago. A zero day vulnerability packaged within malicious malware is a serious problem, but four never heard of, demonstrated, or identified vulnerabilities in a single package? It is unprecidented.
Stuxnet also introduces something that will no doubt have Siemens stockholders a bit nervous -
a rootkit for Industrial control. Symantec explains the danger:
Previously, we reported that Stuxnet can steal code and design projects and also hide itself using a classic Windows rootkit, but unfortunately it can also do much more. Stuxnet has the ability to take advantage of the programming software to also upload its own code to the PLC in an industrial control system that is typically monitored by SCADA systems. In addition, Stuxnet then hides these code blocks, so when a programmer using an infected machine tries to view all of the code blocks on a PLC, they will not see the code injected by Stuxnet. Thus, Stuxnet isn’t just a rootkit that hides itself on Windows, but is the first publicly known rootkit that is able to hide injected code located on a PLC.
In particular, Stuxnet hooks the programming software, which means that when someone uses the software to view code blocks on the PLC, the injected blocks are nowhere to be found. This is done by hooking enumeration, read, and write functions so that you can’t accidentally overwrite the hidden blocks as well.
Stuxnet contains 70 encrypted code blocks that appear to replace some “foundation routines” that take care of simple yet very common tasks, such as comparing file times and others that are custom code and data blocks. Before some of these blocks are uploaded to the PLC, they are customized depending on the PLC.
By writing code to the PLC, Stuxnet can potentially control or alter how the system operates. A previous historic example includes a reported case of stolen code that impacted a pipeline. Code was secretly “Trojanized” to function properly and only some time after installation instruct the host system to increase the pipeline's pressure beyond its capacity. This resulted in a three kiloton explosion, about 1/5 the size of the Hiroshima bomb.
For those who are getting lost in the technical jargon, lets ponder a few non-technical observations.
I have a hard time believing a single person could identify the 4 zero day vulnerabilities - which is what suggests this was a team of researchers working collaboratively in developing working exploitations. The skill sets involved in the zero day windows vulnerabilities are completely different than the skill sets involved in developing a rootkit for industrial hardware devices - which means not only is this team highly trained, but is additionally broadly diverse in skill sets. It has been suggested there is
a Siemens association that cannot be ignored, and while probably true,
as the New York Times reports Stuxnet also "masked their attack with the aid of sensitive intellectual property stolen from two hardware companies, Realtek and JMicron, which are located in the same office park in Taiwan."
It is clear Stuxnet underwent considerable Quality Assurance during testing to develop code that can not only meticulously exploit 4 zero day vulnerabilities in multiple Windows operating systems without being noticed, but also in order to develop a rootkit for industrial hardware - one is going to require a fairly significant testing environment that consists of the kind of industrial hardware you will not easily store in some hackers basement. That means there is a multi-million dollar industrial site somewhere on the planet that was used to develop this code.
When you factor in that Stuxnet executes in a way that nothing crashes, offers no outward signs of infection, and the final payload is specific parameter and code manipulation for specific SPS computer within an expected environment - making Stuxnet a target specific attack - it is hard to look anywhere else except at the government level for such a meticulous and well funded development.
Speculating the WhoDoneItOf all the analysis I have seen, this one makes the most sense to me - and for those who want to know more,
this link is a fantastic read that could form the basis for the Stuxnet movie one day:
But there is another theory that fits the available date much better: stuxnet may have been targeted at the centrifuges at the uranium enrichment plant in Natanz. The chain of published indications supporting the theory starts with stuxnet itself. According to people working on the stuxnet-analysis, it was meant to stop spreading in January 2009. Given the multi-stage nature of stuxnet, the attacker must have assumed that it has reached its target by then, ready to strike.
On July 17, 2024 WikiLeaks posted a cryptic notice:
Two weeks ago, a source associated with Iran’s nuclear program confidentially told WikiLeaks of a serious, recent, nuclear accident at Natanz. Natanz is the primary location of Iran’s nuclear enrichment program. WikiLeaks had reason to believe the source was credible however contact with this source was lost. WikiLeaks would not normally mention such an incident without additional confirmation, however according to Iranian media and the BBC, today the head of Iran’s Atomic Energy Organization, Gholam Reza Aghazadeh, has resigned under mysterious circumstances. According to these reports, the resignation was tendered around 20 days ago.
A cross-check with the official Iran Students News Agency archives confirmed the resignation of the head of Iran’s Atomic Energy Organization.
According to official IAEA data, the number of actually operating centrifuges in Natanz shrank around the time of the accident Wikileaks wrote about was reduced substantially.
On 07. July 2009 the Israeli news-site ynet-news.com posted a lengthy piece on possibly cyberwar against the Iran nuclear program. Intriguingly, even contaminated USB-Sticks were mentioned. In retrospect, the piece sounds like an indirect announcement of a covert victory to allies and enemies.
That there are serious anti-proliferation efforts by all available means undertaken by western intelligence is not in doubt. .
There is further indication in the way stuxnet is actually working on the SPS-level. The current state of analysis seems to support the assumption, that the attack was meant to work synchronized and spread over many identical nodes. In a nuclear power plant, there are not many identical SPS-nodes, as there is a wide variety of subsystems of different kind. Compared to this, an enrichment centrifuge plant consists of thousands of identical units, arranged in serial patterns called cascades. Each of them is by necessity the same, as enrichment centrifuges are massively scaled by numbers. stuxnet would have infected each and every one, then triggering subtle of massive failures, depending on the choice of the attacker. To get an impression how the Natanz facility looks from the inside, Iranian President Ahamadinendjad has visited the place in April 2008.
So in summary, my guess is that stuxnet has been targeted at Natanz and that it achieved success in reducing the operational enrichment capability successfully.
Best theory I have seen so far, although one hopes there is some identification within stuxnet that will eventually reveal the target for sure. Given the malware is a 600kb package that is masterfully put together, there are probably clues within that will send researchers on multiple wild goose chases the wrong direction. I can't imagine that the malware was masterfully put together only to forget to leave plenty of misdirections within the code to insure the original authors are never identified.
Ramifications for the US NavyStuxnet is six hundred kilobytes of War 2.0 engineered to a weapons grade level of capability with no observable side effects and a massively destructive payload intended for a specific target. It is also a publicly available powerful piece of code that will be reverse engineered by the cyber community of the world - the ramifications of which can only be speculated.
Navy warships and aircraft depend on the type of industrial machinery at the heart of the Stuxnet payload - thus Stuxnet represents exactly the kind of cyber capabilities that could potentially be developed to target and disable naval vessels at sea during wartime. The US Navy has begun developing open architecture standards to steamline technologies in all aspects of technical specifications, and it is at these points in the standard architecture system that must be protected as the points of attack by malware like Stuxnet.
Special consideration must be integrated into the security of terminals that monitor the hardware of ships systems, particularly as the fleet becomes more reliant on specific engineered systems like the GE LM2500 turbines, or any of the various engineering and information systems that run ships. While AEGIS no doubt already has security considerations built-in, smart cyber payloads against naval vessels will most likely target engineering and power systems to exploit multiple points of failure within the infrastructure of a warship where security is harder to centralize rather than directly attacking the highly secured and protected computer systems. If French naval aircraft can be
grounded by the "Conflicker" virus, then what happens when the enemy develops malware that specifically targets the temperature gauges of the Joint Strike Fighter? Things can go bad real fast if the engine is overheating in mid-flight and the pilot doesn't know it during a war sortie.
Welcome to the future of warfare, where simply planting doubt in the reliability of a system due to a cyberwarfare based malware payload infection is enough to achieve a mission kill against an enemy system.