Page 212 Part 4: Militarization
Stuxnet, Flame, and Duqu - the DLYMPIC GAMES
Chris Morton1
Stuxnet emerged on the wořld stage in the sununer of2010 as the most sophisticated piece
of malicious software ever found. Designed to permanently damage Iranian uranium
enriclunent gas centrifuges, Stuxnet represented a quantum leap in complexity and
audaciry in cyber conflict. Not only did the malware astonish researchers with its ab~ty to
penetrate and cripple a secretive regime's sensitive nuclear enrichment prog~, 1t. ~so
\ concerned security experts due to its brash destruction of part of a nanon s cnttcal
i infrastructure.With the emergence of the Duqu and Flame computer viruses,the revelation
ofa covertAmerican cyber campaign (code-named OLYMPIC GAMES) against Iran, and
the recognition of commonality between the three pieces of malware, Stuxnet became
known as the centerpiece of a broader campaign, one that rnight hint at the future of
warfare.
171e 11ppe11m11ce ojStux11et WllS like the
11rri1111/ oj1111 F-35 illfo 11 World War I
battlefield.
Ralph Langner,2010
The target of the Stuxnet Worm was Iran's
uranium enrichment program at the Natanz
nuclear facility, or more specifically, Iran's
uranium gas centrifuge tubes. Gas centrifuge
tubes are used to enrich uranium, so that it
may be used as a fuel for nuclear reactors. If
refined highly enough, the uranium be can
used in nuclear weapons. Stuxneťs payload only targets systems that meet very detailed
specifications, those that perfectly match the gas centrifuges Iran uses at Natanz.
The malware operated for over a year at Natanz completely undetected, destroying gas
centrifuge tubes, masking the damage it was causing, and sending data back to the pl~nt
operatorsand digital failsafe systems that the tubes were working perfectly.While sabotagmg
the enrichment process, Stuxnet was able to replicate itself throughout the system and
evolve through updates pushed to it by servers located in two different countries.2
In November 2010, four months after the news of Stuxnet went public, the lranian
goverrnnent acknowledged that a cyber attack damaged its uranium enrichment program
at Natanz. In a press conference, Iranian President Mahmoud Alunadinejad said that,"They
A 201 1 gr.iduatc from Gcorgctown's Public Policy Institute, C hris Morton has spent thc past twclvc ycars in public H<
scrvacc. Hu cxpcncncc ranges from sanall group leadcrsbip 10 inffucncmg polacy ar the strarcgac l~elsC.o~goverru~~ th<
holeb a Masrer< dcgrcc in Policy Mana!l"mcm and a Dachclor of&aencc degree in Chcrrusrry an La c .ctencn..
Uniicd Statcs Military Ac•dcmy al Wcs1 Point. Chris is originally from Muskogcc. O klahoma. _The assertton.s, opm•:·~,
„. „,..„,Hnnt-;,..,..." "v"''"'><c:o.A m rhic wnrJ.. 'lh" cf\lt•lv thO(ť' of tlw :mthor :md do OOt rcffcct the t'10Slt10 n ofany tnStltUtlO
A Fierce Domain: Conflict in Cyberspace, 1986 to 2012
Page 213
succeeded in creating problems for a lirnited number ofour centrifuges with the software
they had installed in electronic parts."3
The Iranian government seemed to downplay the
impact Stuxnet had on their systems, but a public adrnission of interference was ouc of
character for a government known for playing their nuclear program cards close to their
chest.
Ultimately,Stuxnet rendered nearly 1,000 ofthe 9,000 IR-1 type gas centrifuges unusable
at the Natanz uranium enrichment facility.While the computer virus <lid not cripple Iran's
ability to enrich uranium, it is unclear how close Iran would be to producing a nuclear
weapon without the Stuxnet infection.4
Geopolitical Context
On the international stage, Iran was perceived as a destabilizing force,accused ofsponsoring
terrorist organizations and developing nuclear weapons. Iranian President Mahmoud
Afunadinejad often stoked the fire ofconftict,calling for the destruction ofIsrael,and even
suggesting that eradication ofthe Jewish state was the solution to the Middle East Crisis.5
Iran flaunted its nuclear technological advancements, clainting they were peaceful in
nature, all the while shunning the lnternational Atornic Energy Agency's (IAEA) attempts
to inspect its facilities.6
As Iran sought to develop its nuclear technology,the United States and Israel were quite vocal
in opposition to a nuclear Iran. In the face ofthis opposition,the United States was engaged in
two counterinsurgency conflicts, draining resources and effort that rnight otherwise be used
to curtail Iran's nuclear ambitions. Israel had strong motivarion to oppose the development of
the nuclear progran1 in Iran, especially because Iran could use ballistic ntissile technology to
strikeTelAviv.But conventional military strikes,such as lsrael'sstrike on Iraq's Osirak nuclear
facility in 1981,
7
were not politically palatable to the United States. On a practical level,
Israel would need approval from the United States to traverse Iraqi airspace, and they would
require advanced weapons technology to damage the underground facilities.
Iran and NuclearWeapons
lran's pursuit ofnuclear technology is not a recent development. In fact,it was the United
States that gave Iran its first low-enriched uranium (LEU) for use as a research tool
under the Atoms for Peace program during the Eisenhower adntinistration. Through this
program,the US Atomic Energy Conmtission leased Iran up to 13.2 pounds ofuranium.In
Clayton."Stuxncr: Ahmadincjad Admits Cybcrwcapon Hi1 Iran Nuclcar Proi,'Tam."
4 Albrigh1 and Drann:m."IAEA Iran s.r,..,,„..,j,"
Page 214 Part 4: Militarization
exchange, Iran agreed co sign che Nuclear Non- ProliferationTreaty (NPT) and established
che Tehran Nuclear R esearch Center.~
The United States fclt chat such a program would open Iranian doors co American
conunerce and entrepreneurs, while prevencing Iran from undergoing its own domestic
uranium enrichment research. By che l 970's, France and Germany joined che United
States in partnership wich che lranian nuclear power program. Fears of impending energy
shorcages, combined with Iran's knowledge chat their oil supply was limited, encouraged
che Shah of Iran,M ohammed R eza Pahlavi,co seek nuclear power as an alternative co fossil
fuels. Soon, Germany and France both signed agreements with Iran to assist in building
nuclear power plants and co provide che enriched uranium chat che plants required.
9
Iran
was on its way co becoming a nuclear-powered scate.
A 1974 Special National Incelligence Estimate on Nuclear Proliferation indicaced chat if
Iran was able co create a fully sustainable nuclear power program, che Shah could easily
decide to procure nuclear weapons. lt stated in p;irticular chat, if India were to continue
with weapons development, Iran would likely follow suit. "' ln May 1974, India detonated
its first nuclear weapon.
Concerns about che future of nuclear weapons development led co Germany and France
abandoning their plans co assist Iran in building its nuclear power plants. ln March 1979,
West Germany lefc che Bushchr nuclear reactor 85 percent complece. Following che lslanůc
Revolution and che sevcring of diplomacie ties becwee11 che United States and Iran,
American lcaders grew sour on che idea of supporting a nuclear program in Iran.
Throughout the 1980's and 1990's, the United States concinued their opposition to lranian
nuclear ambitions. Iran Jater contracced with Russia to assist in completing the Bushehr
nuclear power plane,a project which the United States objected to unci! 2004. US diplornats
changed the focus of their concerns from its nuclear power plants to its enrichment
facilities, requesting chat Iran answer to che United Nations Security Council.
11
In 2009, Iran developed che capability to obtain
high-enriched uranium (HEU) through the g,1s
centrifuge enrichment process at che Natanz
facility. HEU is considered weapons-grade
uranium, which is enriched to a point where
it consists of 80 percent of che U-235 isotope.
Commercial nuclear power reactors only requirc
8 IJrunu.„lrdn\ Nu(ll-.1r Pn~r.u11 „
Ple11se p11y .111e11tio11 11111/ 11111iem1111d t/1111
tlie people 4 Jr.111 .rre /m111c c11ot(~f1 rlt.11
!fit m111ts to b11ild 11 bo111b ir 111ill c/e,rrly
11111101mre it 111111/mild it 1111d 11M be .ifr11id
cify1m.
Irauian President Ahmadinejad
A Fierce Domain: Conflict in Cyberspacc. 1986 to 2012 Page 215
LEU, which is enriched to only 20 percenc of U-235. W hile che IAEA attempted to
conduct its inspections as authorizcd under che N PT, che lranian government was less than
transparent. Pcrhaps even more disturbing is chat Iran developed a 40-megawatt research
reactor capable of producing plutonium, a much more efficient fissionable material.12
:1::~1~::~~0~:1~::~ :::~011:: ;:~;;;;;:s::~:c~:~i;~~~::;~i:~: ~~u~~ic~d3~~~:~::!~=~~ ipublic statements rebuking lranian nuclear ambitions.
The United States and Iran
The poor relationship between che United States and Iran grew from general discord after
che overthrow of che Shah, Iran's monarch and pro-American dictator, into a rage during
che hostage crisis of 1979. US PresidentJinuny Carter agreed to allow the Shah, who was
hiding in Mexico following his ouster, to come to New York City for medical treatment
ofhis lymphatic cancer.The Ayatullah Khomeiru spurred on anti-American sentiment and
called che embassy in Tehran a " nest of spies."13
Soon thereafter, demonstrations tumed
into a hostage crisis, with the self-labeled "Scudencs ofKhomeini" holding 52 Americans
captive, demanding chat che United States return che Shah to Iran.T he hostage crisis lasted
over a year. 14
Over the nexe two decades, tensions continued to mount. T he United States backed
Iraq during che eight-year Iran - Iraq war in che 1980's, when an lraqi victory became
doubtful. Iran responded with its support of radicaJ lslanuc terror organizations, such as
Hamas and Hezbollah, further increasing tensions. Nation-state support of international
terrorism took front scage following the terrorist attacks on che WorldTrade Center on 11
September 2011.
ln his Scate of che Union Address in 2002, President George W Bush declared Iran part
of an "axis of evil," citing lran's desires to pursue weapons of mass destruction and co
export terror.i; Part of che new,so-called Bush Doctrine was to not only go after terrorist
organizations that posed a threat to che United States, but to also use force against che
nations chat harbored terror groups. T he United States demonstrated its willingness co
impose this doctrine through the invasion ofAfghanistan and the deposition of itsTaliban
leadership.T he subsequent 2003 invasion oflraq left Iran with a sizable American nůlicary
presence co ics easc and its west, leaving chem isolated in che Middle East. In 2003, che
Director ofNational lntelligence, Michael McConnell, said chat there was "overwhelnung
evidence" that Iran was supporting insurgents in Iraq and "compelling" evidence chat they
Page 216 Part 4: Militarization
were doing the same in Afghanistan.16
Israel and Iran
As with the United States, outward Iranian clislike of Israel is in-part a byproduct of the
overthrow ofthe Shah. In fact, Iran stayed out ofthe three Arab-Israeli wars that occurred
during the time of the Shah. During the 1970'sArab oil embargo, Iran continued to supply
Israel with oil. Iran enjoyed a partnership with Israel against the Sunni-MuslimArab states.
At the same time, Israel benefited from a partnership with Iran, along with the Christian
portions of Lebanon and the more secular Turkey.17
The past thirty years have seen a
dramatic change in this relationship.
C urrent Iranian President Ahmaclinejad has made hard-line conunents toward the state of
Israel, saying that Israel will soon "clisappear off ofthe geographical scene" and should be
"wiped off the map."18
Coincicling with his statements, Iran developed advanced ballistic
missile technology capable of reaching Israel. In September 2009, President Obama cited
these new capabilities in reference to a European protective missile shield.19
These new
Iranian missiles, combined with their overtly aggressive statements against Israel, seem to
position the two nations for a potential head-to-head conflict.
I\ Israeli concerns about the Iranian nuclear program seemed to reach a crescendo in 2008.
I
At the beginning of the year, Israel requested high-tech bunker-busting bombs from the
United States, the sort that might destroy underground nuclear facilities. In adclition, they
sought refueling equipment that would allow their aircraft to reach the Iranian nuclear
facilities.They then requested permission to traverse Iraqi airspace. A Pentagon analysis of
an Israeli Air Force operation over the Mecliterranean Sea in June of2008 noted that the
mission range matched the distance between Israel and the Natanz uranium enrichment
Ifacility.2<l Washington rebuffed all of the Israeli requests, while covert operations that the
lfUnited States were pursuing seemed to satisfy the Jewish state.
Contextually, the Iranian pursuit of nuclear weapons, combined with their involvement
in a proxy war against the United States in Afghanistan and Iraq, prepped the grounds
for action. Iran's sharp anti-Semitic sentiment stoked Israeli fears that the Persian nation
might move from simple financial support of groups like Hamas and Hezbollah to an
outright nuclear attack. It seemed to be in the best interest of both the United States
and Israel to slow or stop Iran's nuclear weapons ambitions. Conventional attack seemed
politically risky, even though the IAEA and the United Nations condemned Iran's efforts
16 McConncll,"M,Conndl Cit<'S 'Ovcrwhclmmg Evidence' oflrAn's Support for lraqi ln>urg<·nts."
17 Wciss."lsracl and lran:Thc Bonds thatTic Pcrsiam andjcws."
A Fierce Domain: Conflict in Cyberspace, 1986 to 2012 Page 217
to keep their nuclear ambitions under wraps.The best answer m.ight have rested in the dark
recesses ofcyber sabotage.
The Incident
Stuxnet was designed to destroy Iran's IR-1 centrifuges, rendering them useless for
enriching uranium by speeding them up and slowing them down quickly, causing
permanent vibrational damage. Damaging these tubes would notjt1st delay che enrichment/
of uranium; it would also sew interna! doubt as
to the competence of the Iranian scientists. To
accomplish its goal, Stuxnec employed the most
sophisticated cyber attack methods seen at the
time. lt accacked sever.i! points of entry to the
Natanz nuclear enrichment facility, employed a
"dual-warhead" design to deliver its malicious
software, and updated itself through peer-topeer
updates to evolve in changing conditions.
The Timeline
S111x11er bc/1.1wd like" /<1b r<1r tll<lf did11 '1
like 1•ur d1l'<'.<c. Ir s11!f/i'd, bm did11 '1 "''""
to e11r. Afrer ll'ť l'Xperi111e111ed witli d!fli•r('llf
.fi.1v1>rs <ifd1eese, I m1/ized 1/i,u tliis ""-' ,,
directed <1tt.1ck.
Ralph Langner
A Belarusian information technology company called VirusBlokAda cliscovered Stuxnet on
17June 2010.21
While troubleshooting a clienťs computer, employees discovered not just an I
encrypted virus using a zero-day vulnerability, but one which boasted a legitimate digital
certificate. VirusBlokAda could not ignore the sophistication of the malware. The use of a
zero-day vulner,ibility would permit the virus to gain access to the computer, and a digital
certificate would convince the computer that the malware was a trusted piece of software.
Therefore, during the first two weeks in July, the small IT company made public what ic
found.12
By 19 July 201O, the computer company Symantec reported chat they were investigating
malware that infected Siemens SCADA systems. lt named the malware W32.Stuxnet,
"Stuxnet" being an anagram created from the code of the software.:?.' O ver the nexy'
two months, Symantec conducted an extensive evaluation of the worm, attempting to
understand its origin, methodology, and remaining threats. Not until 30 September did
Symantec release a comprehensive analysis of the virus.24
During the year prior to the release of the Symantec report, problems with gas centrifuge
tubes at the Natanz fuel enrichrnent facility were giving lranian scientists fits. Until
21 Gm".''SttL\lll't W llrlll A Ikd,1rau on of{:yht.·r-W.tr··
Page 218 Part 4: Militarization
I
November 2009, tlúngs were going smoothly. Then, the facility began having problems.
While the detailed actions taken by Iranian scientists at the facility are unknown, by
February 201O, Iran removed nearly 1,000 centrifuge tubes from its facility.25
The number
was 984, to be exact--a number frequently found in Stuxnet code.26
This marked the end
Iofthe first version ofStuxnet, and of the first wave ofthe attack.
On 1 March 2010, the command and control domains pushed an updated version of its
code to Stuxnet, creating the second wave ofthe attack. Only a month and a halflater, on
14 April, a third wave was launched. Iran has revealed little evidence ofthe effects of the
second and third waves of attacks.27
Ostensibly, they were designed to overcome patches
, and defensive measures that Iranian scientists were able to employ to defeat the virus.They
could also be modifications to change the direction ofthe attack.
One known late change in Stuxnet was its digital signature, that it used to mask its
presence. When Symantec found that the malware was using a Realtek digital signature,
it notified Realtek, who then revoked the signature.The command and control servers
simply pushed a new authentic digital signature, tlús time held by JMicron, to the virus.
This allowed the virus to avoid detection for a time, but by 14 July, when the new digital
signature was issued, industry insiders became widely aware of the new threat. Symantec
was able to identify this digital signature fairly quickly, andJMicron revoked its signature.A
third signature was never sent. On 15July, a distributed denial ofservice (DDoS) attack was
launched against the websites that contained the mailing lists for two ofthe top newsletters
for industrial control systems security. One of the sites was able to overcome the attack,
but the ether was shut down, preventing it from responding to requests for information
on the new threat.28
, InAugust 2010,the Iranians blocked all outbound traffic from infected sites to the command
and control servers.29
By November, the lranians temporarily halted all enrichment
activities at Natanz, perhaps to purge Stuxnet from all of its computer systems.30
This is
the same month thatAhmadinejad admitted that a computer virus infected Iranian nuclear
fuel enrichment facilities.31
While Stuxnet seems to have only had disabling effects on gas centrifuge tubes at Natanz, it
spread worldwide.As ofSeptember 2010, it infected over 100,000 hosts in 155 countries.32
While this infection seemed to spread worldwide, its impact remained isolated in Iran. Iran
25 Markhotf."Malwarc Aimcd at Iran Hit Fivc Sites. Report Says."
26 Langner,"Ralph Langner:Cracking Stuxnct. a 21st-Century Cybcr Wcapon."
27 Fa.llicrc, ct al.."Thc Stuxnct Worm."
28 Gross."Stuxnct Worm.A Dcclarauon of Cybcr-War."
29 Fa.lloerc. et al.."Thc Stuxnct Worm."
A Fierce Domain:Confiict in Cyberspace, 1986 to 2012 Page 219
eventually claimed to have purged its system ofthe computer virus. By September 2012,
two years Jater, Stuxnet ceased to operate, either by its automatic encoded kill switch, or
due to identification and removal tools provided by Symantec.33 After the shroud was ,
pulled back on Stuxnet in the fall of 2010, little was heard about the complex cyber
weapon.Then, two seemingly related pieces ofmalware emerged-Duqu and Flame.These
viruses, combined with the revelations of Stuxnet and of the US OLYMPIC GAMES
cyber operation, suggested a multi-phased cyber campaign.
InJune 2012, the NewYork Times reported that President Obama ordered the continuation
of a complex Bush administration cyber operation against Iran, collectively known as
OLYMPIC GAMES.34
The Times citied as its sources current and former American,
European, and Israeli officials involved with the program, as well as a number of subject
matter experts.35
OLYMPIC GAMES was a multi-pronged effort to sabotage Iran's
nuclear enrichment program at Natanz. Reportedly, it was conceived collaboratively by
a team established by then Vice Chairman of the Joint C hiefs of Staff General James
Cartwright and the National Security Agency (NSA).According to the Times, an initial
virus was dropped into the facility to provide a detailed schematic ofthe Natanz facilities.
lt then beamed that information back to the NSA, providing the needed intelligence to
damage the facility.36
The initial virus was likely the Flame or Duqu infection, or some
combination of the two. Like a blind man describing an elepham, as more parts of the
operation are found, Stuxneťs purpose in the context of that operation becomes more
clear.
Discovered in October 2011, Duqu is a Remote AccessTrojan (RAT), specifically designed
to gather intelligence on industrial infrastructure and to acquire design documents, which
rnight enable a future cyber attack against the systems. The RAT gleans its intelligence
through executable files that gather system information and by recording computer
keystrokes. Once Duqu steals data, it packages it into small files and exfiltrates the data
out of the system. ln addition, it seems that Duqu has the ability to hide small computer
files from the system and disable a computer's security tools, such as antivirus software.37
Duqu does not propagate as widely as Stuxnet, and it destroys itself after thirty days of
functioning.38
Despite the apparently different functions of Duqu and Stuxnet, two
major attributes associate them: they share much of the same computer language in their
programming, and they seem to target the Iranian nuclear program.
33 "Sicmem Industry Online Support": andJack>on."Stuxner Shut Down by its O wn Kill Switch."
34 Sangcr."Obama Ordcr Spcd Up."
35 Ibid.
...
Page 220 Part 4: Militarization
Flame, announced to the world by Kaspersky Lib in May 2012, also serves to gather
intelligence, but on a much grander cale. Twenty times larger than Stuxnet and more
diverse than Duqu, Flame steals documents, takes screen shots frolll computers, records
audio, and even accesses remote Bluetooth devices connected to computers to send and
receive information.-''J Recording keystrokes as Duqu did is one thing, but turning on and
off microphones, computer cameras, and even extracting a geolocation from an image
was off the charts at the time in tenns of sophiscication. Furthermore, Flame operated
undiscovered for more than two years before it was found and revealed in the spring of
2012.4
" It too shared lines of code with Stuxnet, making them brothers, or at least first
cousins. Duqu and Flame could gather intelligence and disable security settings, enabling
Stuxnet to do its damage.
The Anatomy ofthe Attack
Stuxneťs attack was simply a quantum leap in terms of the sophistication of its design and
effects. Until 201O, most malware focused on other computers-either by overloading
networks with DDOS attacks, such as occurred in Estonia during 2007, orby stealing data,
such as the operation revealed in 2010 against the Defense Department, which began at
the United States Centra! Command.41
Stuxnet was diffcrent- it da111<1ged info1structure
not dircctly connected to the Internet. ln an interview in 2011 , <111 official from the
D epartment ofHomeland Security lauded Stuxneťs elegance. H e highlighted the malware's
f complexity and its ability to perform multiple phases of an attack- infiltration, assumption
ofcontrol,surveillance, and finally the extraction or dcstruction ofinformation,all without
independent human control or conunands.42 / /
~ „
Upon analysis, researchers found thac Scuxnec targecs induscrial control sysccms, rewntmg
the computer code o~ic c~troll~(PLCs),or more specifically,S.iemens
Supervisory and Concrol and Data Acquisitions (SCADA) syscems. After changmg the
LC software to direct industrial systems to operace in a manner chat Stuxnet desires, it
hides these changes from the operators of the industnal systems.~·' Stuxnet employed an
I
unprecedented four Microsoft Windows vulnerabilitics to gain control of the PLCs chat
dictatc che spced at which IR- l gas centrifuges spin. Once it gained authority over the
tubes, Stuxnet sped thcm up and slowcd them down, causing irreversible vibration damage.
Ir also opened and closed valves between groups ofcencrifuge tubes, called cascades, either
to confuse operators or to cause further damage. Once the ccntrifuges are dalllaged,
A Ficrce Domain: Contlict in Cyberspace, 1986 to 2012
Page 221
they become unusable and must be replaced in order for them to enrich uraniu 44
m.
Sin~ultaneously, the malware overrode automated system health indicator monitoring,
g1vmg operators indications of norma! functioning tubes.4;
Stuxnet employed <I sophisticatcd dropper software package to deploy its payload. After the
initial infection of a computer, Stuxnet went in search of Field Peripheral Gateways (PC).
Field PGs are specialized computers that are gcnerally used to control and configure PLCs.
The virus would find the Field PGs through one of four methods: a. through a LAN, b.
by way of a Windows zero-day vulncrability or a two- year-old unpatched vulnerability,
c. through Step 7 projects, or d. through removable drives. Step 7 is che Siemens software
that is used to program and configure that company's industrial control systems hardware.46
Using Step 7 as a vector was especially important for Stuxnet, as the PLCs at Natanz used
Siemens software. ln addition, because Stuxnet inserted itself into Step 7 projects, cleaned
computers would be reinfected wirh the malware rhrough the hidden software in these
project folders.47
Stuxnet employed two methods to control the targeted computers and to hide irs
presence. First, it used a rootkit dropper, which essentially lets the virus act as if it is che
<tdm.inistrator of the sysrem-giving Stuxnet persistent, unfertered access to its host.48
Second, it employed an authentic digital signature to hide its heavily encrypted software,
once it found its way to a host. H ackers have used fake digital signatures for some time, but
Stuxnet used an actual signature stolen from R ealtek, adding to its veracity.49
lnfection through removable drives likely served as both the initial infection method and as
a last hop to the Field PG computer. Normally, Field PGs are not connected to untrusted
networks due to security concerns. Propagation through LANs served as intermediate
steps, either from a computer that connected to a LAN containing systems with Step
7 projects, or to the Field PGs if they were ever connected to a network that Stuxnet
managed to find.
5
" R egardless of the method, che maJware was constructed with multiple
vectors in núnd, all of which allowed it to find its way to computers that are normally not
part ofa network.
Once Stuxnet found its way to a Field PC computer, it then examined che PLCs chat che
Field PC controlled. lt sought a PLC that controlled IR-1 type gas centrifuges, which
were spinning at a specific rate. If Stuxnet was unable to find PLCs connected to the1
H B.1rnl''·"My'h.'ry Surmu11J, Cyhc.:r M1"1k Th.tt CnpplcJ lr.m'" Nurlf,.',irWl·;ipons Amhu1llll' ··
.f~ F.1lhl'fl'. l't .11.."'Thl· Stuxlll'I Worm:·
39 K.1,prr,J...\ L.1h."K.1'Pl'T'l) L1h .mJ ITU Rl''l·.1rch Rl'\:l'.tf, N1.'\\ Advauu.·d C:ylx·rThrt.·.1c_··
..Jf' N.1l .1,IH1;1,t. t.'t .11 ."U.S. 1...r.11..-l l)..., ·dopt.•<l Fl.111lt.' C:cunpmaVuu' ft) Slt1\\ lr.am.in Nulk.1r Etfi)n.... <ltfin.1), S.->~"
"''• Kl'IZl'r. "Stux1h:1 \\onu ~.in n·-mft.•t:t ,l'ruhhL'li pc,:·
~--- .J7 F,1Jltl"Tl'. t.'t .11.. „Tht.• Stuxnl't Worm."
--
Page 222 Part 4:Militarization
Field PG that were running centrifuges with the appropriate configuration,it did nothing,
laying dormant as a useless and harmless piece ofhidden software.51
Ifit found what it was
looking for, it contacted home-base.
IStuxnet did not operate completely independently. It con1:nunicat~d with two ~ommand
and control servers located in Malaysia and Denmark.5
- Stuxnet sent certam b1ts of
information regarding the PLC configuration back to these cornrnand and control servers.
These servers could then direct the virus to upload whatever code the server controllers
wished. lt also allowed for updates to Stuxnet, if configurations were changed to combat
the infection. More uniquely, Stuxnet could update itself through peer-to-peer updates.
If one version of Stuxnet came in contact with another, older version of the virus on
another system, it would simply update the older version.53
Stuxneťs ability to update
remotely is the likely cause of its propagation beyond Natanz. US administration officials
claimed that an overzealous Israeli update to the virus placed an error in the code, allowing
Stuxnet to sneak onto an engineer's laptop when it was connected to the centrifuges.
\
When that laptop was Jater connected to the Internet, Stuxnet broke free, spilling into
an open, unsecure environment.54
While posing little threat outside of Natanz, its veil of
secrecy was gone.
PLCs do not useWindows as an operating system like the Field PGs, so the virus must use
the configuring powers of the Field PGs to alter the software residing in the PLCs. The
software that it uses to alter the PLCs is the payload ofthe malware. Ralph Langner, in a
presentation at the Technology, Entertainment, and Design (TED) Conference in March
of2011 comrnented,"Ifyou have heard that the dropper in Stuxnet is complex and hightech,
let me tell you this, the payload is rocket science."55
The payload would write itself
into the software of the PLCs that were controlling the gas centrifuges.
, The payload itself consisted of a dual-warhead design. The first, smaller warhead was
specifically designed to speed up and slow down individua) gas centrifuges within a
I cascade.A cascade is a grouping oftubes, in the case oflran's IR-1tubes, 164 in number.
The number 164 appears frequently in the code ofthe first warhead.The second warhead
served to open and close valves connecting Natanz's six centrifuge cascades. Six cascades of
164 tubes totals 984 tubes, a number also frequently found within the code ofStuxnet.56
While the rnalware is speeding up and slowing down centrifuge tubes, it creates realityblocking
software for the operators ofthe fuel enrichment plant. Much like in Hollywood
51 Gross."StuxnctWorm.A D<clarauon ofCyber-War."
52 /biti.
53 Jackson."Stuxnet Shut Down";and Fallicrc. ct al.."Thc Stuxnet Worm."
A Fierce Domain: Conflict in Cyberspace, 1986 co 2012
Page 223
movies, it pre-records norma! operating signals, then replays those signals while it is
conducting its attack. T his gives the operators no indication of any malfunction within
che system. Furthermore, it overcomes the digita1 safety systems employed by the plant.
Normally, when anomalies are detected, these automated systems react to prevem damage
resulting from system malfunctions. Stuxnet feeds these systems false data, triggering no
automatic response.;7
Adversaries
The Stuxnet attack bears the marks of state involvement. First, the target of the assault J
seems to have been limited to the uranium enrichment facilities of Iran. While there
are groups with motivation to undermine the proliferation of nuclear weapons, simply
targeting Iranian gas centrifuge tubes would be a dramatic technologicaljump for activists,
and it would not generace the same sort ofpublicity that other attacks or methods would
bring.As activists rely on graphic images or acts that make a splash in the media, and do
not favor subtle, complicated incursions, these attack methods seem not to be the work of
activist perpetrators.
In addition, the Stuxnet Worm was specifically designed to attack Siemens-run PLCs, the I}
sort that Iran uses in its enrichment facility. Knowledge of che industrial software that
Siemens uses to control its logic controllers is something that would be difficult for the
average non-state actor to obtain. Either industrial or nation-state sponsored espionage
combined with higbly technical engineering would be required to exploit this type of
system. Not ortly is the worm huge, suggesting that it required several man-months of
work, it is also highly sophisticated. Only governments wield the resources to produce
such malware.;x
Iran
As of 29 September 2010, Stuxnet infected approximately 100,000 hosts worldwide; of
that number, nearly 60 percent were identified to be in Iran.;9 In response, Iran pointed
the blame for the attack on theWest, and more specifically, at Israel.1'"
Whatever precautions Iran had in place did litt1e to stop the spread ofthe malware. Stuxnet
primarily targeted facilities that would give it the best access to get at its final target.
Security firms indicated that there were initially up to five different strains of the virus.
These specifically looked for ways to infect systems that were not connected to the
57 11„.i.
Page 224
Part 4: Militarization
Internet. The virus did this chrough USB keys.61
The scenario would be chat contractors
working at one of a number of infected facilities would transfer the malware from their
computers co their USB sticks. Stuxnet would then wait for one of the contractors to plug
a removable drive into a computer chat is a part of the detached system which Stuxnet
targeted.While Iran certainly had basic computer cyber defenses at the Natanz facility, its
detachment from the Internet was its best defense. Stuxnet specifically targeted this
attribute and had little trouble finding its target, despite Iranian cyber defenses.
In che end, Iran's weak information technology
practices at its nuclear facilities and its lack of a
stringent cyber defensive structure within its
nuclear facility computer network contributed
to the attack's success. Iran blamed the attack on
Jra11's sta11ce hll.5 always been clear011
this 11gly phe11omeno11 {Israel).ffi l1ave
repeatedly said tlrat this ca11rero11s tumor oj
astate s/1011/d be removed.from tlre regio11.
Ayatollah Ali K.hameneiJ Israel and che United States, mostly due to its
political mistrust of the two countries rather than
because of hard evidence. The private company
Symantec conducted the most comprehensive study on the malware.
62
lt has avoided
·putright attribution, but German security expert Ralph Langner revealed at the Long
\BeachTechnology, Entertainment, and Design (TED) Conference chat he believes that the
tlsraeli Intelligence Agency Mossad and the U nited States together are behind the worm.
63
The New York Times later specifically attributed the malware to the US and Israel, and
AMES b
. 64
claimed this was a part of the OLYMPIC G cy er operauon.
Israel and the United States ofAmerica
Israel and the United States not only had the motivation to prevent Iran from obtaining
highly enriched uranium; they also articulated their intent to prevent Iran from obtaining
nuclear weapons. InJanuary 2007, Nicholas Burns, cheAmerican U nder-Secretary ofState,
indicated that,"Iran is seeking a nuclear weapon.There's no doubt about it." He further
said chat,"the policy ofthe United States is that we cannot allow Iran to become a nuclear
scate." Burns later commented that,"We are conunitted to our alliance with Israel.We are
comrnitted to being Israel's strongest security partner. I can't remember a time when the
relationship between our two countries was stronger than it is today."
65
Mr. Burns made.it
clear that the United States sought to deny Iran nuclear weapons and that its partnership
with Israel was of the ut111ost importance.
61 Fildl-s,"Stuxnct varus targcts and sprcaJ revcakd."
62 Fallic\c· et_aL"!he StuxnctWorm."
~~----------·~
A Fierce Domain: Conflict in Cyberspace, 1986 to 2012
Page 225
ln June 2009, the New York Times revealed that the United States had hung its hope
of preventing the further development of a nuclear Iran on a covert program. After
concluding that the sanctions had failed to prevent Iran from enriching uranium,the Bush
administration struggled to find another method to intervene. Overt military action, such
as the pian that Israel suggested,might ignite a regional conflict,and this was something that
Washington desperately wanted to avoid, especially while fighting two wars in the Middle
East.The covert operation was an experimental effort to underrnine Iran's computers and
networks, on wlúch Iran relies to enrich uranium. Some disrnissed the efforts as "science
experiments," but others said that che covert operations were needed to dissuade Israel
from bombing the facility. Secretary of Defense Robert Gates criticized the National
lntelligence Estimate (NIE) released in 2007 for under-emphasizing the importance of
Iranian enrichment activities.66
This article reads like a blueprint for the decision to release
I
a covert cyber attack against che Natanz nuclear facility. It was released in January 2009, a
full eighteen months before che public or the media knew about Stuxnet. I
While both the U1úted States and Israel had the motivation to prevent nuclear advances
in Iran, neither nation could accomplish such a feat alone.They would need each other.
Richard Clarke, in his book Cyber War, asserts that Israeli cyber capabilities were placed
on display during a September 2007 attack on secret Syrian nuclear facilities.The Israeli
Air Force was able to strike the facility, despite Syria's significant investment ofbillions of
dollars on a new air defense system. lnstead ofSyrian radar screens lighting up when sorties
of F-16 Falcons and F-15 Eagles streaked across the night sky, they remained completely •
dark. Syrian air defenders were completely blind to the incidem.67 I
Although Israel brought cyber expertise to the table, their most valuable asset was more
likely their intelligence agency, Mossad.The US and Israel probably needed such an asset, /
not just to gather intelligence on Iranian facilities and officials, but to plant the virus into
adoseď computer system not connected to the Internet. Some evidence points to Mossad
involvement. In early 2011, retiring Mossad ChiefMeir Dagan told the Israeli Knesset that 1
Iran had run into technical difficulties that would delay their construction ofa bomb untilJ
2015.68
Dagan cited "measures that have been deployed against them" when discussingl
their technical difficulties.69
Previous estimates oflranian bomb construction time-frames
estimated a date doser to March 2011. Finally, during the retirement of lsraeli Defense
Forces (IDF) ChiefLieutenant General Gabi Ashkenazi, a commemorative video seemed
to allude to the Stuxnet attack while applauding his leadership.70
66 Sanger,"U.S. Rejccted Aid for lsr•di Ra1d on lr.uuan Nuclear Sitc."
67 Clarke and Knakc. Cvlwr w„ ;
Page 226
Part 4: Militarization
Israel and the United States both had the ability to test a destructive tool like Stuxnet. ln
the l 970's, a Pakistani metallurgist, A.Q . Khan, stole the design for the P- 1 uranium gas
enrichlllent centrifuge tube from the Durch (IR- 1 centrifuges are the name given to the
Iranian version of the same tube). After giving the plans to thc Pakistani government,
allowing them to go nuclear, he sold the designs on che black market to Libya, North
Korea, and Iran. Many nuclear experts believe the secretive Israeli nuclear facility at
Dimona houses P- 1 gas centrifuges.
71
l tlii11k 011 tlie <?fťcwirlť' .<ide, rlic U S.
.~011cr11111e111 i11w111cd ir[cybcr ll'1lť}. 171cy
11ťť prob.1bly t/1e bc.<I i111/1e 1/lorld.
Richard Clarke
While it is assumed that !sr.tel possesses P- 1
centrifuges, it is known that the United States does.
In 2003, Libya abandoned its nuclear program,
giving its nuclear enrichment cquipmcnt,including
P- 1 centrifuges, to the United States. They were
sent to the Oak Ridge National Laboratory in
Tennessee.72
In 2008, Siemens teamed up with the Idaho National Laboratory to study the Step-7
software on its programmable logic controllers.T hc goal of thc study was to idcntify cyber
security flaws that 111ight be exploitt~d in a future attack on systems in the United States.
7
·
1
The software is che samc chat Iran uses to control its nuclear enrichmem gas centrifuge
tubes - Siemens Step-7 software.
There are other pieces of circumstantial evidence pointing to US and Israeli involvemcnt.
O ne string of code in Stuxnet refers to 24 September 2007, the date that lranian President
Ahmadinejad questioned whether the holocaust actually happened.
74
There is also the
presence of the file code Myrtus. Myrtus is sometimes an allusion to the biblical book of
Esther, in which the Jews preempted a Persian plot to destroy them.
7
;
Failsafe mechanisms in the virus, such as its customization to only target software designed
to control centrifuge tubes and a "kil! switch" that deactivates the virus in June 2012,
seem to indicate a Western nation's involvement. R egarding the first of these mechanisms,
the virus limits its own ability to spread. Each infected <levice may only spread Stuxnet
to three other systems.T his mechanism allows a moderate rate of infection, but does noc
permit the sort of uncontrolled propagation indicative of other worms. Stuxneťs spillage
outside of lranian systems seems to have been accidental, and due to an error in the code
created during an update to the virus.7
'' ln addicion, Stuxnet did not infect computers at
A Fierce Domain: Couflict in Cyberspace. 1986 to 2012 Page 227
random. lt on.ly atfecced Siemens SCADA PLC software that matched a complex set of
parameters. 1t would also 01tly infect Windows computers that it believed were connected
to these specific PLCs. lfthese parameters were not found,Stuxnet simply became an inert
piece of software.77
Finally, on 24 June 2012, all copies of the virus ceased to function,
due to a command embedded deep in Stuxneťs code. Such efforts to m.inimize collateral
damage and rates of infection indicated a more Western approach to the attack, because
of the bureaucratic process chat might be involved for approving the assault. In reference
to Stuxnet, Richard Clarke commented chat,"lt just says lawyers all over it."7
M Few placcs
have as many lawyers as the United States goverrunent.
In June 2012, the New York Ti111cs revealed that President O bama had issued an order for
O LYMPIC GAMES to be sped up, in an attempt to thwart Jranian nuclear ambitions.79
Another asscrtion in the New York Ti111es, apparently leaked to them by a high ranking
administration official, was that Israel and the National Security Agency (NSA) codeveloped
che complex virus, which required the expertise of both nations, as well as the
sensitive intelligence gathered by Israel's Mossad. Ostensibly, O LYMPIC GAMES would
delay Jr,111's enrichment of uranium, thereby precluding Israel's desire to conduct a
conventional strike. The operation was seemingly successful, but the New Ycirk Times
claimed that an Israeli update to the malware caused it to spill outside of Natanz, and thus
reveal itself to the world.
Considering their adversarial stance against
Iran, and their motives and capabilities
to launch such a sophisticated attack, the
United States and Israel are likely candidates
as participants in the Stuxnet incident. In
an interview in 2011, William Marshall, I
the Managing Director of the Chertoff
Group, which is a global security consulting
company, noted that non-state actors would
not have the ability to bring together all of
the elements required to produce Stuxnet- 1
access to Microsoft source code, access to
Siemens technology, nuclear engineering
expertise, and critical intelligence about the
Natanz enrichment facility.""
Dcspitc St11x11ct'.< .<0pl1isticatio11, Jmu
appear.< to luwe take11 t1 simple .<tep
tlwr mt1y luwe red11ccd tl1e impacr ojt1
.<uÚ.<eq11ent atfllck, cl<sw11ing Im11 ltt1d 1101
yet di.<Cl)IJCTCň thc~11<1/Ul(/TC O/I it.< CO/lff()l/ers.
Ir stoppcd rite ce111rif11ges i11 cle11c11 casct1des
i11 111od11/e A26, tltc 111od11/e thclf Wtl' likely
most <!ffecred by St11x11et.
Update of !SIS December 2010
R eport
71 Bro.ul. l..'t .li.."hrat.:h 1t:~r on Worm <:.1lk·d Cruu;tl m Ir.in Ntu.:l"·,,r I >cl.ty."
72 "'"'7;. ff>i,f.
_ __..__ 77 F.llhl·n:. l 't .11 .„Thl· Stuxnl·t Wurm.„
/J (:,...,„„ " \.t 01 ,-n . •t\\'/„„, n A l)„,.J .•.„..••• .•i' 1 •. .L. ·- ,„, -··
Page 228 Part 4: Militarization
Finally, the Jack of significant cyber defenses in the Iranian nuclear facility and the
'I. overwhelming strength ofAmerican and Israeli cyber offensive tools made Iran a fairly
J easy target for cyber sabotage. If this imbalance did not exist, the attack might not have
been a suitable alternative to an overt kinetic strike.
Response
The government response from Iran occurred both in the technical and political arenas.
The immediate response ofattempting to identify, control, and eradicate Stuxnet occupied
Iranian scientists~r some time. Due to the secretive nature of the country, little is known
about its inner workings. Politically, Iran has reacted toward the suspected authors of
Stuxnet with the usual zeal that emanates from the isolated nation.
Through late summer and early fall, operations at Natanz seemed to be going as planned.
The enrichment of uranium fuel and the installation of IR-1 centrifuges had constantly
been increasing since the start of the program in 2007. In fact, by September of 2009,
nearly 9,000 centrifuge tubes had been installed, and 4,000 of those had been fed with
uranium hexafluoride gas. Then something happened.The number of tubes that Iran was
installing leveled off, and by February 2010, they had removed nearly 1,000 centrifuge
tubes.The number of tubes enriching uranium also stopped rising and leveled off.While
Iran managed to install enough tubes to replace the damaged ones, significant growth in
capacity did not occur.81
Based on these timelines, it seems that between the infections of the lranian computers
in the late summer of2009 and November 2009, the Iranians were oblivious to what was
happening to them and were not reacting. Sometime between November and February
h o10, when it was confirmed that Iran removed the 1000 tubes, the country realized that
something was causing these gas centrifuge tubes to break. It is unclear whether Iranian
scientists thought this was due to the naturally high rate offailure ofthese types oftubes,
or whether something else was causing the problems.At a minimum, Stuxnet was causing ·
I the Iranians to question their own competence.
With a rampant computer worm destroying their tubes, and their limited ability to
acquire more due to the embargo, replacing these tubes with new ones would have been
inadvisable. Between February 2010 andJuly 2010, when Symantec discovered the virus,
it is unknown whether lranian computer experts understood the problem. That they
apparently did not is suggested by the fact that new centrifuge installation as well as
utilization remained constant.82
Likely, they were unwilling to move too quickly until they
understood the full nature of their problem.Actual uranium enrichment did still seem to
A Fierce Domain: Conflicr in Cyberspace, 1986 to 2012
Page 229
increase, probably because ofincreased production in their active tubes.
ft is also unknown whether the lranian govermuem understood Stuxnet before the private
sector. More likely than not, they spent the bulk of201Otrying to eliminate Stuxnet from
their system. lt was not until August 2010 that they finally cut their outbound connections
to the command and control servers.x:'While Iran may have eventually stifled the damaging I
effects ofStuxnet on their nuclear enrichment program, the Flame and Duqu viruses gave
the Iranians plenty more to deal with, at least though the summer and fall of 2012.
Iran ernphatically blamed Israel and the United States for Stuxnet. President Ahmadinejaďs
rernarks failed to mention any particular country by name, but his anti-Israeli/ US rhetoric
pointed to those two countries. Ahmadinejad also see1ned to downplay the effect of the
cyber attack, noting that Iran had the situation under controJ.MWith the revelation of
Flame, Iran continued to point to Israel, highlighting Flame's similarities to other computer
attacks that come from the Jewish State."5
Iran also publicly ann9tmced the expansion of its militia to include new cyber warriors.
The group would be part ofBasij, a volunteer military group that is organized within the
Iranian R evolutionary Guards. Iranian news specifically mentioned that the unit was being
set up to counter-attack those that launched cyber attacks at Iran.8'•
In March 2011, lranian national news reported that their new cyber warriors in Basij had
started operations. General Ali Fazli was quoted as saying, "[a]s there are cyber attacks on
us, so is our cyber army of the Basij, which includes university instructors and students as
well as clerics, attacking websites of the enemy.""7
Clearly, Iran wamed to flaunt its new
capabilities, which are assuredly more complex and capable than what was revealed in
public.
Eleven days after this announcement, Comodo, an Internet security group, accused Iran
of launching attacks against Google, Microsoft, Yahoo, Mozilla, and Skype."" Comodo
claimed that they had sold nine digital authentication certificates to fake websites. Their
incident report indicated that the Iranian government rnight have used the certificates
to redirect legitimate users of services such as Gmail to a fake site. T his would allow the
lra1úan government to steal usernames and passwords, or install malware to monitor online
activities."'' This sort of activity might have also come from Iran's new cyber police, the
creation ofwhich Iran had announced in January 2011.That cyber police force was tasked
8J Fallit..•rl\ <..'t .11.."Thl' Stux111.·t Won11."
8
4 T{mr.„AhmadinL:iaJ Sar lr.111\ Nw„·k·ar F.1cíht11..·~ WL•rt.· Htt hy Stt1XllL't Worm."
85 Erdhrmk. "Jr.111 Co11fir111' Att.ick hy Viru> That Colkcb Jnfon n:mon."
86 :ogarty."km RL·spomh to StuxnL't hy Cyht..•rwar Milit1a."
f
Page 230 Part 4: Militarization A Fierce Domain: Conflict in Cyberspace, 1986 to 2012
~~~~~~~~~~~~~~~~~~~~~~~~~~
Page 231
with monitoring so-called "foreign-inspired political dissent."90
, Secretary of State Hillary Clinton and the Israeli Ministry of Defense have noted that
\
Iran's ability to procure nuclear weapons was delayed. Israel indicated that Iran might not
become a nuclear-armed state before 2015.91
Other studies suggest that Stuxneťs effect
\on Ira~'s ability to enrich uranium, while problematic, was not catastrophic. The Institute
1for Science and Internattonal Security reported that, although the Iranians were rattled
by this attack, their actions in removing the damaged tubes and slowing production likely
~tigated further damage. The report also says that since Iran possesses 9000 tubes, the
tremoval of 1000 of them, while damaging, was not ruinous.A larger issue for Iran is that
ht has a finite amount ofmaterial to make more centrifuges, which will eventually limit is
I
".ability to expand its program much beyond its 2011 capacity.92
Implications93
r- Stuxnet had short-tenn political effects on both the Iranian government and the potential
authors of the malware, which has led to a new state-of-affairs in nation-state conflicts.
Stuxnet could prove to be a great equalizer between world powers. Ifa country can deploy
a few lines of computer code and have kinetic effect, countries might choose to stopLc maintaining their resource-heavy armed forces. 85
Iranian confidence was certainly shaken. Stuxnet revealed that they were terribly
vulnerable to offensive cyber weapons, and that their secrets were not so secret. Some of
the techniques employed by the virus required detailed understanding and knowledge of
the inner workings of Natanz.This understanding was apparently obtained both through
traditional spycraft by Mossad and the CIA, and by modern intelligence operations such as
1
those exemplified by the Flame and Duqu computer viruses. One can imagine the initial
paranoia that Iranian government officials experienced when they discovered that their
enrichment program was not working properly for unknown reasons. The Iranians most
certainly questioned their own ability to maintain an independent nuclear program.
Ifthe destruction ofthe fuel enrichment plant had been complete, Iran would look different
today. Instead, the country took steps that at least limited the damage. N ow that Iran has
been inoculated with one of the most innovative and capable pieces of malware of our
time, they will be on the lookout for the next attack. ln this sense, Stuxnet might not have
been worth the cost for Israel and the United States.While fuel enrichment was set back,it
still continued. Iran publicly acknowledged that it needed stronger cyber defenses, created
90 ~~um.
0
Ir~n's ?~~vcl.lian Cyb...'r-Policc Targct Disscnt."
a militia to conduct cyber operations, and obviously became sensitive to the possibility of
further attacks. f-.1
Although it is not known with complete certainty that the United States and Israel were
behind the attack, it matters not, as most experts agree it was them.The leak by unnamed
US administration ofticials to the New York Tímes about the OLYMPIC GAMES cyber
operation was not terribly helpful for an administration trying to maintain at least a shred
of attribution ambiguity with respect to Stuxnet. The US and Israel have both revealed
what a nation-state created cyber weapon looks like. ln addition, they have signaled to
~the rest ofthe world what the norms can now be expected to be in this arena, by causing
physical damage to another nation's critical infrastructure with a computer attack when r
faced with a perceived security threat.The toothpaste is out of the tube.William Marshalf
believes that this rnight be a blueprint ofwhat is to come-malware intended to influence
politics and advance agendas by controlling the cornerstone elements of an industrial
civilization. These elements would include critical infrastructure, such as electricity and
water distribution systems, financial markets, and transportation networks.94
Despite
Stuxneťs quiet death by self-eradication inJune 2012, a message has been sent.
(
That message might not be all that bad.At the end ofWorldWar II, when the United States ])
dropped two atomic weapons on Japan, it sought to end the war and prevent hundreds ofe
thousands of casualties which a land invasion would certainly have caused.The decimation ~
ofHiroshima and Nagasaki also gave the world an in-color,3D view ofAmerican military<""
might. Stuxnet, especially when viewed in the context of the OLYMPIC GAMES cyber ·
operation, could have the same effect. Many in the press have touted the Jack of cyber
defensive capability and accompanying vulnerability ofUS critical infrastructure to attack.
The message to potential adversaries seeking to exploit this capability could be, "Think
twice before you attack us.This is a sample ofwhat we can do.We will do it again."
The most wide reaching implication of the Stuxnet attack stems not from the display
of its dazzling engineering, but rather from the potential for reverse engineering. Ralph l ,
Langner warned at theTED Conference in 2011 that the problem with the malware is that
it is generic.95
It can be modified to attack any industrial control system. Stuxnet serves
as a draft to create a cyber weapon with the capability to attack electrical power grids, oil
refineries, nuclear power plants, or hazardous chemical plants. One can only imagine the
widespread damages that might be caused by this tool ifit fell into the hands ofthose not
so concerned with collateral damage or targeted warfare. Ralph Langer called Stuxnet the
first cyber weapon of mass destruction. If Stuxnet is only the beginning of what Albert
Einstein predicted concerning World War III, we should start to gather those sticks and
stones.
,