Stuxnet: The Father Of Cyberkinetic Weapons

As we approach the 10th anniversary of when Stuxnet was likely deployed, it is worthwhile to examine the effect it still has on our world. As the world’s first-ever cyber-weapon, it opened Pandora’s box. 
 
It was the first true cyberkinetic weapon, and it changed military history and is changing world history, as well. Its impact on the future cannot be overstated.
 
Stuxnet’s beginnings
Stuxnet is believed to have been conceived jointly by the US and Israel in 2005 or 2006 to cripple Iran’s nuclear weapon development without Iran even realizing that it had been attacked. An early version appears to have been deployed in 2007, but it didn’t reach its target. Perhaps that version’s goal was merely to gather intelligence.
 
Its sophisticated platform was readily adaptable to espionage purposes and several related pieces of malware were primarily designed for that purpose.
 
The intelligence that its developers eventually obtained about Iranian operations enabled them to get Stuxnet inside Iran’s air-gapped (not connected to the internet) Natanz facility in 2009. They did this by infecting five Iranian companies that installed equipment in Natanz. When technicians at these companies connected their laptops to Natanz equipment, they unwittingly caused Stuxnet to download and spread throughout the facility. Through this indirect connection, Stuxnet’s developers were able to upload and command the malware through 2010, even though they did not have a direct connection with it.
 
How it worked
Stuxnet is considered the largest and most expensive malware development effort in history, a project too big for anyone but a nation-state to produce. It was also far too precisely targeted to damage anything other than equipment used only in Iranian uranium enrichment facilities. Stuxnet contained valid security certificates, stolen from legitimate software companies, and multiple zero-day exploits to infect the technicians’ PCs. This combination enabled Stuxnet to easily compromise the PCs once the infected thumb drives were plugged into USB ports.
 
These three approaches, however, underscore the extraordinary resources Stuxnet’s developers had. Valid security certificates are well protected. Zero-day exploits (vulnerabilities that are unknown to the software manufacturer whose software is exploited) are very difficult to find. A single zero-day exploit is rare to find in malware. Dedicating multiple ones to a single piece of malware was unheard of at the time. 
 
Finally, by having the attack depend on getting a physical thumb drive into the possession of technicians protected by tight security requires extraordinary skill.
 
Once on the Natanz network, Stuxnet looked for Siemens PLCs that possessed two specific blocks of code used to control Iranian uranium enrichment centrifuges. Stuxnet also used rootkit functions that made it hard to discover or remove.
The attack damaged centrifuge rotors through two different routines.
 
The first involved dramatically, but briefly, speeding centrifuges above their maximum safe speed, then briefly slowing them dramatically below their minimum safe speed. The malware would then wait weeks before repeating the cycle, to reduce the chances of detection.
 
The second, more complex routine involved over-pressurizing centrifuges to increase rotor stress over time. Thus, Stuxnet exerted years of wear on the centrifuges in mere months, causing them to fail faster than the Iranians could replace them. Experts believe that Stuxnet disabled one-fifth of Natanz centrifuges in a year.
 
A chilling discovery
When Stuxnet was discovered in the wild, security experts were baffled with this complex malware that contained both IT and Industrial Control System (ICS) components. Experts in each discipline had little experience in the other. Working together, they unraveled Stuxnet’s purpose: It was the world’s first true cyber-weapon, designed to cause physical damage through infected computer systems.
 
Natanz ultimately was identified as the target, because of an unexpectedly high replacement rate of centrifuges that international inspectors had noticed there. It fulfilled cybersecurity experts’ warnings of the threat of such cyberattacks as IT and industrial control systems converged.
 
Stuxnet successfully targeted each of the three layers of a cyber-physical system. 
 
1) It used the cyber layer to distribute the malware and identify its targets. 
2) It used the control system layer (in this case, PLCs) to control physical processes. 
3) Finally, it affected the physical layer, causing physical damage. 
 
Stuxnet thus was 1) a cyberattack 2) that created kinetic impacts 3) that resulted in physical destruction. Moreover, it demonstrated how it is possible to:
 
• Infect an air-gapped system
• Target precise cyber-physical systems for infection
• Introduce subtle, almost undetectable flaws into physical processes that could be just as damaging, if not more, than crashing a system, while much harder to detect.
 
Consider the implications of such a subtle attack. Defects built into cars or airplanes could cause the finished product to malfunction only after they are being used. In the same way, weaknesses could be built into power grids, making them prone to failure when the original attacker triggers a condition under which the grid was designed to fail. 
 
What about food or water processing? What if toxic additions were made in which the danger is not in a single dose, but cumulatively, over time? All such scenarios could inflict devastating damage without the target even realizing it was under attack.
 
A continuing threat
Stuxnet itself is gone. Experts believe it stopped functioning in 2012. But what it did continues to affect us.
Despite developer efforts to keep Stuxnet confined to the Natanz facility, it reached the wild and was discovered there. The innovative techniques that cost millions of dollars and thousands of hours of time to create now are available to other malware developers to adapt to new cyber-weapons.
 
By revealing the vulnerability of cyber-physical systems, Stuxnet made them an inviting target. Although lack of knowledge of each other’s fields that kept antivirus experts and CPS security experts from unravelling Stuxnet independently is not as extreme as it was then, defending against cyber-kinetic attacks still requires skill in both.
 
When Stuxnet’s developers launched this cyber-kinetic attack on their enemies, it legitimized cyber-weapons. Just as use of nuclear weapons on Japan in World War II spurred a nuclear arms race, today’s nations are believed to be pursuing a similar cyber-weapons race.
 
North Korea’s alleged connection to the 2017 WannaCry ransomware attacks is a prime example. While those attacks affected information systems more than cyber-physical ones, physical hospital equipment was compromised in some locations, forcing delays or cancellations of medical procedures. In addition, five Iranian nationals have been charged with cyberattacks against US targets, including failed cyber-kinetic attacks against the Bowman Avenue Dam in Rye Brook, New York.
 
Takeaways 
While Stuxnet is gone, it forever changed our world. It showed how to inflict damage by targeting cyber-physical systems. It made advanced techniques for breaching secure systems available to cybercriminals and terrorists, and opened the doors to the threat of cyberwarfare.
 
The world now knows what can be accomplished through cyberkinetic attacks. Developing Stuxnet required deep pockets and the talents of some of the world’s best minds. Dare we put anything less toward securing the cyber-physical systems that Stuxnet exposed?
 
CSO Online
 
You Might Also Read:
 
Stuxnet, Secrecy & The New Era of Cyber War:
 
Son Of Stuxnet: Irongate Malware:
 
Cyberwar: The Smart Person's Guide:
 
 
« Army Chief Urges UK To Increase Cyber Defence & Attack Capabilities
What Is Fog Computing? »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Cyber Security Associates (CSA)

Cyber Security Associates (CSA)

Cyber Security Associates provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat.

Magnet Forensics

Magnet Forensics

Magnet Forensics' family of digital forensics products are used globally by thousands of law enforcement, military, government and corporate customers.

Arete

Arete

Arete is a global cyber risk company whose mission is to transform the way organizations prepare for, respond to, and prevent cybercrime.

ISARA Corp

ISARA Corp

ISARA Corporation is a security solutions company specializing in creating class-defining quantum-safe cryptography for today's computing ecosystems.

2Keys

2Keys

2Keys designs, deploys and operates Digital Identity Platforms and Cyber Security Platforms through Managed Service and Professional Service engagements.

European Cyber Security Conference

European Cyber Security Conference

EU Cyber Security Conference will debate what Europe’s response to evolving threats in a dynamic global risk landscape should look like and what the next steps for all actors of the ecosystem.

IQ4 - Cybersecurity Workforce Alliance (CWA)

IQ4 - Cybersecurity Workforce Alliance (CWA)

Cybersecurity Workforce Alliance, a division of iQ4, is an organization comprised of a diverse range of professionals dedicated to the development of the cybersecurity workforce.

Brookcourt Solutions

Brookcourt Solutions

Brookcourt Solutions delivers cyber security, network monitoring technologies and managed security services to help secure and protect your organisation’s critical infrastructure.

Deft

Deft

Deft (formerly ServerCentral Turing Group) is a trusted provider of colocation, cloud, and disaster recovery services.

NVISIONx

NVISIONx

NVISIONx data risk governance platform enables companies to gain control of their enterprise data to reduce data risks, compliance scopes and storage costs.

Alias

Alias

Alias (formerly Alias Forensics) provide penetration testing, vulnerability assessments, incident response and security consulting services.

Astrill VPN

Astrill VPN

Astrill VPN is a Seychelles based Virtual Private Network(VPN) Company.

Chainguard

Chainguard

Founded by the industry's leading experts on open source software, security and cloud native development, Chainguard are on a mission to make the software supply chain secure by default.

Bit Sentinel

Bit Sentinel

Bit Sentinel is an information security company. We help companies like yours discover, prioritize, and effectively remediate potential cybersecurity risks.

AppSentinels

AppSentinels

Appsentinels are a group of security and technology experts with a mission to fix gaps in application security.

Blue Mantis

Blue Mantis

Blue Mantis is a security-first, IT solutions and services provider with a 30+ year history of successfully helping clients achieve business modernization.