Stuxnet: Dawn of Digital Art of War

“Let your plans be dark and impenetrable as night, and when you move, fall like a thunderbolt.” – Sun Tzu, The Art of War

NATANZ

For many years, Iran denied they were developing nuclear weapons more profusely than Peter denied Jesus in the bible. But the Americans and their allies knew something was happening beneath the surface of the uranium enrichment facility in Natanz, Iran.

This facility covers an area of 100,000 square meters, is buried 70 feet below the desert, surrounded by thick concrete walls that are 2.5 meters thick, guarded by anti-aircraft guns and so many military guards. It was impenetrable.

AGENT STUXNET

It must have been a day in 2009, no guns, no boots on the ground and no missiles, Natanz facility was sabotaged by a secret agent more dangerous than our beloved James Bond.

The seemingly impossible task of slipping past the numerous armed guards and unleashing mayhem was performed by a computer virus code-named STUXNET.

According to Eric Chan, a computer virus expert, for the first time a computer virus crossed over from the virtual world to the real physical world. The operation was so complex, it needed to have had over 20 high-level programmers with a solid knowledge of the plant to pull off. Stuxnet had about 15,000 lines of codes and the virus was targeting a specific equipment.

PATIENT ZERO

Steven Bellovin, a cyber attack forensic specialist, believes that Stuxnet was propagated using a device like a flash drive. This must have been planted on a worker who was happy to have stumbled upon a miracle flash drive and had taken it into the facility.

Once the drive was plugged into a USB port, the virus makes a copy of itself and jumps into the computer. It identified itself as a program published by Microsoft (using a false digital signature) and thus the windows systems allowed it to execute.

Stuxnet started crawling all over the place like the (computer) worm it is, looking for a way around the system and started reproducing copies of itself in file servers, memory spaces, print spools and other systems. Even though it infected many systems quietly, it did no harm to them because it was looking for just one target the S7-315-2-PLC. The S7-315-2-PLC is a standard Siemens CPU which is common and can be easily bought online.

SABOTAGE

Once Stuxnet found the CPU, all hell was let loose. The centrifuges normally spun close to the speed of sound but the virus increased the speed to twice as fast. This wrecked havoc on the delicate, expensive equipment.

The equipment had so many fail-safe features. Once the turbines start spinning above the required speed, there are automatic shutdown procedures installed. However, the virus made the automatic fail-safe systems believe all was well and the turbines continued spinning at the unsafe speed.

There is also an emergency button which was to be tapped by the control room operation team in the event there is a potential hazard. On hearing the unusual noise coming from the centrifuge, the operators pushed the emergency button but it was too late. Stuxnet had hijacked the the button and rendered it useless. The operators could only and watch the horror from a distance as the turbines tore into pieces and debris flew all over the facility.

FALLOUT

Not a single gun shot was fired; no billion dollar fighter jet/bomber was needed; no missile and no human agent was involved. Ballistic missiles come with a return address, but cyber weapons like Stuxnet are so covert and even hard to anticipate. But there are serious problems that the deployment and success of Stuxnet created for the US and the world at large:

  1. Once you use a cyber weapon against your enemy, their programmers have the source codes of the weapon. So yes, Iran has the codes for Stuxnet and can re-engineer and re-purpose it for revenge.
  2.  Having used a weapon of such nature against Iran, it means open season for all nations with capabilities to start developing and attacking each other.

Finally, let us also consider the implications of a terrorist organization getting a hold of Stuxnet source codes and re-purposing them. The level of damage that can be done if they target subway systems, dam control units, nuclear power stations, aircraft traffic controls, hospitals, nuclear warheads and other critical infrastructure around the world.

There may be a sinister plan brewing out there and I hope to God these evil plans are exposed and stopped before they occur; but then again, it is all digital and can hardly be anticipated as they occur quietly and faster than the speed of light.

Peace  😎

Credits:

Professor John Arquilla || Professor Steve Bellovin || Eric Chan

About Chiemela 4 Articles
Chiemela is a cyber security expert wanna-be. He is currently resident in Worcester, Massachusetts. He has worked with corporate organizations like British American Tobacco (West Africa), Islamic Development Bank (Saudi Arabia), Society for Family Health (Nigeria) and Commercial Bank for Africa (Kenya) as an IT consultant. Chiemela's dream is to share the gospel of cyber security with everyday people and tell stories of cyber crime and cyber war in order to expose the often hidden dangers of the internet and how it affects them daily.

1 Comment

Leave a Reply

Your email address will not be published.


*