Cyber Threats & Personal Safety

In December of 2012, a virus named Stuxnet crippled Iranian nuclear facilities. In development since at least 2005, this virus was discovered in 2010 and is a prime example of a virus whose threat extends far beyond the digital space. What is Stuxnet? Stuxnet is a very powerful computer worm that first appeared in 2010 and which also happens to be the biggest and most expensive of this type of malware. It is known to have exploited previously unknown Windows zero-day vulnerabilities to infect a target system and spread to other such systems. Stuxnet primarily attacked the centrifuges of Iran’s uranium enrichment facilities. Since then, it has been modified by cyber attackers, and this mutation has allowed it to spread to other energy-producing and industrial facilities. The original Stuxnet attack was aimed at programmable logic controllers (PLCs) that are used to automate machine processes. Although no country has officially owned up to creating Stuxnet, it is largely believed to have been created by the US and Israel in a joint effort. Stuxnet garnered a lot of media attention after its discovery, as it is the first virus known to cripple hardware and cause physical destruction of devices that have been infected with it. Iran’s nuclear programme was greatly crippled by Stuxnet, and owing to its aggressive nature, this virus accidentally spread beyond Iran’s nuclear facilities. However, it did not do much damage to external devices outside of the actual target locations. How Does Stuxnet Work? Stuxnet is a very complex and intrusive piece of malware. It has been designed to only affect targets that have certain configurations and cause minimal damage to other systems and devices. The targeted nuclear facilities in Iran were isolated and air-gapped from the global network, and so Stuxnet was probably transmitted through USB sticks that were carried into these facilities by agents. Stuxnet has code for a man-in-the-middle attack that can fake sensor signals and prevent a target system from shutting down due to unusual behaviour. Stuxnet is also abnormally large and written in multiple programming languages, and spreads fast. Three systemic layers are targeted by Stuxnet: Windows OS, Siemens PCS 7, WinCC, and STEP7 industrial software apps Siemens S7 PLC Windows systems were infiltrated by Stuxnet by exploiting several zero-day vulnerabilities like remote code execution. It utilised enabled printer sharing or LNK/PIF vulnerability executing the file when it was viewed in Windows Explorer. This malware can gain access at the user level as well as the kernel level. The device drivers in Stuxnet are signed by two public certificates, which enables it to access kernel drivers without the knowledge of the user. Because of this, Stuxnet could remain undiscovered for a long time. Once it has infiltrated Windows systems, Stuxnet proceeds to infect files that belong to Siemens industrial software applications and interrupts their communications. It modifies the code on PLC devices too. Stuxnet instals malware blocks in PLC monitors and repeatedly changes the frequency of the system. It alters the operation of motors by changing the rotational speed. Stuxnet also has a rootkit that helps the worm hide from monitoring systems. What Did Stuxnet Do? Stuxnet is reported to have destroyed several centrifuges in Iran’s Natanz uranium enrichment facility by making them burn out. Since then, Stuxnet has been modified by other malicious groups to make it capable of targeting facilities such as water treatment plants, gas lines, and power plants. Stuxnet is a multi-part worm that is believed to have travelled on USB drives and spread through systems running Windows. This virus scanned every infected computer for signs of Siemens Step 7 software. Siemens Step 7 software is used by industrial computers used as PLCs that automate and monitor electro-mechanical equipment. Once a PLC computer was found, Stuxnet updated its code over the Internet and started sending damaging instructions to the electro-mechanical equipment controlled by the affected system. Simultaneously, it also sent false feedback to the main controller so that anyone monitoring the equipment would not have any idea of an attack being underway until the equipment began to destroy itself. Stuxnet’s History Though it had been in development since 2005, Stuxnet was first identified and reported in 2010. The first known version of Stuxnet is Stuxnet 0.5 [McD13]. In January 2010, the inspectors who visited the Natanz uranium enrichment plant noted that its centrifuges were failing at an unusual rate. They were unable to detect the cause of this failure at the time. Another five months passed and researchers found malicious files in one of the systems. The worm started spreading around March 2010, but its first variant was found in 2009. On July 15, 2010, the worm became widely known because of a DDoS attack on an industrial systems security mailing list. This attack has interrupted a necessary source of information for power plants and factories. Stuxnet spread in two waves. The second wave was more visible and less targeted than the first. It was during the second wave that Stuxnet came to be known to the public, as it was more aggressive and widespread. This worm managed to infiltrate and infect more than 20,000 devices in 14 Iranian nuclear facilities and destroyed around 900 centrifuges. Although Stuxnet didn’t cause a lot of damage outside its target area, it provides an example for later malware that targets various infrastructures. Modified versions of Stuxnet target non-nuclear facilities as well. The Offsprings of Stuxnet Stuxnet had a massive influence on the development of future malware. While the creators of Stuxnet reportedly designed it to expire in June 2012, the legacy of Stuxnet survives in other malware based on the original code. The “offsprings” of Stuxnet are as follows: Duqu is a group of computer malware that also exploits zer0-day vulnerabilities in Windows. Based on the Stuxnet code, it was created to log keystrokes and collect data from industrial facilities, possibly to launch an attack later. It is very similar to Stuxnet and also targets Iranian nuclear entities. Like its predecessor Stuxnet, Flame also travelled via