And the culprit is likely a nation-state

Atomic Iran Iran's quasi-official news agency released this image in an attempt to illustrate their nuclear intentions. The new Bushehr reactor is the country's first nuclear power plant. Iranian Students News Agency

The sophisticated computer worm called Stuxnet, which has been targeting industrial operations around the world, was likely designed to take out Iran’s new Bushehr nuclear reactor, cybersecurity experts say. It’s the first known cyber-super-weapon designed to destroy a real-world target, reports the Christian Science Monitor.

Researchers studying the worm say it was built by an advanced attacker with plentiful resources — possibly a nation-state. Initially, experts thought it was designed for industrial espionage, but upon examining its code, they now think it was built for sabotage.

Ralph Langner, an expert on industrial systems security, has been studying Stuxnet since it was first discovered at a Belarus-based security firm in June. In a blog post last week, he said the worm was most likely assembled by a team of experts with heavy insider knowledge: “This is not some hacker sitting in the basement of his parents’ house. To me, it seems that the resources needed to stage this attack point to a nation state,” he wrote.

He speculates that the target is Iran’s Bushehr reactor, currently under construction. To reach this conclusion, he partly relied upon a UPI picture of the reactor’s operations plant, showing Siemens PLC software.

Stuxnet has targeted Siemens-operated industrial facilities like power plants and chemical factories. It has spread via USB flash drives and through copying itself to new networks protected by weak passwords, according to a news release from Norman ASA, a network security firm.

As PCWorld explains, once Stuxnet identifies a target, it changes a specific piece of Siemens code that monitors critical operations — “things that need a response within 100 milliseconds.” By changing this crucial piece of code, Stuxnet could cause equipment to malfunction, sabotaging a refinery or factory.

So far, no one has ventured to guess which nation might have built Stuxnet. But PCWorld recalled speculation from last summer that Israeli officials were contemplating a cyber attack on Iran.

Langner wrote that whoever built the worm is going to get caught, because cyber-forensics will eventually smoke them out. They must not care about going to jail, he wrote.

If they represent a nation-state, there might be much bigger things to worry about — could Stuxnet represent an opening salvo in a cyber war?

25 Comments

I've never been able to understand why it is that crucial infrastructure isn't on a closed network. Do you really need the internet that badly? Sure, maybe you do, but not connected to crucial equipment.

@SJak actually another article I read said the main way for this worm to spread is throug an infected USB drive no network connection needed. It then infects ever USB drive plugged into the infected machine, Same thing that happened to the DoD systems a while back. I'm guessing the networked attack is just an attack of convenience until another USB gets stuck in the infected computer.

I know that at some nuke plants in the US that the computers are 286's and down...thats right no USB ports there

@ Hessbri

What SJak means, and what I agree with, is why these computers need any access to the outside world at all. You have the established keyboard/button/switch array for controlling the complex, but you arn't able to load programs in or out.

Ergo, no internet, no usb ports, nothing. Its not that hard to keep a computer network from recieveing files. I understand they made need pc's in the complex, but those should be on a seperate network tied to non-crucial systems. I repeat, it should not be that hard to prevent something like this.

What I don't get is that I've seen plenty of government computers with the USB ports sealed up.

Why would a nuclear reactor be any different?

Why would a nuclear reactor even NEED USB ports. It's not like employees need to take their work home with them at the end of the day. All computer related changes/upgrades could be handled by other means.

It could also be an attempt to put Sieman's out of buisness (or at least out of the industrial buisness). That would require Iran (and lots of other people) to refit with a new system. That refitting could reveal a great deal of info about the scope of the Iranian nuclear process and progress.

Knowing about capability is actucually much more useful than disrupting energy production (it is enrichment that is the critical step).

An unmarked missile from an unmarked boat at sea could disrupt the energy production for much longer with about the same cost of "random reprisal."

@brian144

Exactly.

Sock it to em. Sock it to em. Sock it to em.

Iran deserves everything and anything thrown at it!

Suddenly I am regretting updating my plant Siemens WinCC software using my usb drive. I mean it is on an isolated network with all extra software uninstalled. These PCs don't even have a CDROM drive they run the plant as a dedicated system. Of course I could always blame it on that guy who got bored and I caught him running solitare on his personal USB drive.

Even self contained networks need access. At some point, you usually want to get some data from the system for analysis. Not to mention the need for upgrades. Thus the USB drive or equivalent.

I'm sure that, since there's now a history of USB attacks, most places are taking steps to control access to the ports.

I did think that the statement about cyber-forensics sounded a bit grandiose. If the designers were as sophisticated as claimed, one would think that they would cover their tracks.

Iran's nuclear facilities are becoming a threat to global community. Nuclear energy is good if it is used for creating energy.

Using a Microsoft operating system for a function as crucial as operating or managing a nuclear plant is just plain irresponsible. This episode shows why.

"Langner wrote that whoever built the worm is going to get caught, because cyber-forensics will eventually smoke them out. They must not care about going to jail, he wrote."
They done goofed, now the cyber police will be backtracing this stuff to it's source. Consequences will never be the same.

Israel has more than 200 nukes, israel refuses to sign the non proliferation treaty, and israel has a history of attacking multiple countries in the middle east. In 1948 Zionists formed israel by attacking and chasing Palestinians off land.

israel attacked the unarmed USS Liberty and killed and injured a number of our sailors. israel recently attacked Gaza aid ships in international waters and investigations have determined that israelis executed several people on those boats, including a young American citizen who was shot four times in the head, including in the back if the head.

israel also rammed three times and nearly sunk a small boat in the open ocean that was carrying a former member of the US congress along with several medical doctors.

israeli Likud leaders brag about how easily they manipulate the US into doing what they want. Likud leaders pushed the US to invade Iraq, and we are still in that disastrous war.

Now israeli Likud leaders are pushing the US to attack Iran.

Is it Iran or is it israel that is a threat to world peace

Which country do you think is most likely to have planted that worm in Iran's reactor?

Iran should fear being attacked. But according to our intelligence services, Iran does not have even have one bomb.

As disgusting as it is, it's important that such sickness reveals itself for all to see. "puredemocracy" reveals his/her historical ignorance, psycopathic hatred, and willingness to deceive. To correct only one of his/her deceptions "puredemocracy" should study the objective accounts of how the state of Israel was established - how the Jews suffered to maintain their new statehood and how the Palestinians suffered due to extremely misguided, and evil leadership and their hatred of the Jews. I can think of no better example of the bitter fruit of hatred than the condition of "puredemocracy" and the Palestinian people.

Media formats of any kind, modem ports all of it, have been monitored from the beginning. Chances are the person who input this data , even if through an allegedly "secure" in put point, has already "left the building" long ago, or is willing to die for their cause and wait.

Regardless of all that, who of us knows that we are not being fed info such as "it came through a usb device" or not?

Do you really think they'd broadcast that they're "online" and can be attacked like any simple utility company?

Remember we are not supposed to be told everything.

Speculating how this got in is a waste. They already know.
The worry is that yes it's not below "them"to do this.

Will we ever know who "them" is? That's my question.

Nice one! hope it did some good to the world!

The real story is that Siemens Company wrote this worm to detect the chines remark softwares on their industrial machines and Iran uses chines remark software more than other countries.

Robert1234: No outside link? So who will sit there and write the 10,000 line codes needed weekly? There is NO WAY POSSIBLE for there to be no "outside" access to modern industrial systems. As to who did it...we know who did it, it was the U.S. again. ONLY the U.S. does stupid shit like this and doesn't care who knows it. Right now Obama has made a legal claim to the authority to have anyone anywhere executed without any oversight before or after. No leader has made that claim in over 400 years. American is clinically a paranoid schizoid!

Robert1234 Israel is the most evil nation on earth right now, of that there is no question. Remember, it's based on terrorism (blowing up English children etc. so the G.B. would seed territory for Israel. They even now admit sinking a ship load of Jewish immigrants in order to create sympathy. Right now the reflect the Nazi leadership traits they claim to despise, and yes, they do control the U.S. government who is doing the most evil things currently happening in the world.

Robert1234: I could say plenty regarding your comments, but I will simply comment on your statement that the U.S. planted this bug. While I'm sure you have multiple degrees in computer engineering, network administration, and a plethora of knowledge in other related fields such as cyber-terrorism, I feel as though you have missed a critical suspect. I believe the more likely culprit is the great Genghis Kahn. Although he has been dead for hundreds of years, his bitter hatred has manifested itself in the form of a cyber-weapon hell bent on the destruction of civilization.

Sounds retarded, doesn't it? Well, so does your unintelligible tirade against the U.S. You are about as misguided as the pilots were when they dropped a nuke off the coast of Georgia. You thought you had a good idea, but once the dust settled, it dawned on you -- that was really stupid. You are probably wondering what I am referring to about nukes and Georgia. Well, I'll let you in on a little secret: It's called history and news. I know, its shocking isn't it? Apparently you have never heard of either. If you did, you would realize that the U.S. is significantly lagging behind in cyber-terrorism. Try doing a little research on some Asiatic countries and cyber-warfare. Then rethink what you posted.

I'm not stating that the U.S. did or did not manufacture this malicious code. I'm only stating that code like this could easily have come from a multitude of countries. Since reading your [lack of] argument, I do not feel as though you are qualified to make such a definitive statement such as the U.S. planted this code.

I cannot be (mostly) P.C. any longer. You are an idiot and a tool. How can Israel be the most evil nation yet the U.S. is doing the most evil things? That makes no logical sense -- much like your entire argument. It is one thing to have an opinion, it is a completely different thing to have an opinion based off false facts and preaching such facts as truth. I hope this code attacks your computer. In the process, a holographic hand appears out of your screen and slaps you in the face while saying that you are retarded. Then the hand laughs with a deep chuckle, like that of a hyena.

The only way that they couldn't get attacked, is change the way of how today computer system works, that it usually uses what we call; binary numbers.

Think about what many hackers could control:
Operating Systems
Software
Wired/Wireless Networks
etc...

It's not so difficult for many smart brains hard trained on the U.S ;)

can it attack normal PC??

Whoever coded this little guy is a straight boss. And has some serioussss problems. Not only is it terrifying, but also really terrifying. More and more nowadays viruses are becoming much more dangerous and invasive...Brilliant, but terrifying.


140 years of Popular Science at your fingertips.



Popular Science+ For iPad

Each issue has been completely reimagined for your iPad. See our amazing new vision for magazines that goes far beyond the printed page



Download Our App

Stay up to date on the latest news of the future of science and technology from your iPhone or Android phone with full articles, images and offline viewing



Follow Us On Twitter

Featuring every article from the magazine and website, plus links from around the Web. Also see our PopSci DIY feed


February 2013: How To Build A Hero

Engineers are racing to build robots that can take the place of rescuers. That story, plus a city that storms can't break and how having fun could lead to breakthrough science.

Also! A leech detective, the solution to America's train-crash problems, the world's fastest baby carriage, and more.



Online Content Director: Suzanne LaBarre | Email
Senior Editor: Paul Adams | Email
Associate Editor: Dan Nosowitz | Email

Contributing Writers:
Clay Dillow | Email
Rebecca Boyle | Email
Colin Lecher | Email
Emily Elert | Email

Intern:
Shaunacy Ferro | Email

circ-top-header.gif
circ-cover.gif
bmxmag-ps