RUTHFULLY YOURS

A computer worm proliferating in Iran targets automated activity in large industrial facilities. Speculation that the worm represents an effort by a national intelligence agency to attack Iranian nuclear facilities is widespread in the media. The characteristics of the complex worm do in fact suggest a national intelligence agency was involved. If so, the full story is likely to remain shrouded in mystery.

A computer virus known as a worm that has been spreading on computers primarily in Iran, India and Indonesia could be a cyberattack on Iranian nuclear facilities, according to widespread media speculation.

Creating such a program, which targets a specific Siemens software system controlling automated activity in large industrial facilities, would have required a large team with experience and actionable intelligence. If a national intelligence agency in fact targeted Iranian nuclear facilities, this would be the first deployment of a cyberweapon reported on in the media. It would also mean that the full details of the operation are not likely ever to be known.

The so-called Stuxnet worm first attracted significant attention when Microsoft announced concerns over the situation in a Sept. 13 security bulletin, though various experts in the information technology community had been analyzing it for at least a few months. The worm is very advanced, required specific intelligence on its target, exploits multiple system vulnerabilities and uses two stolen security certificates, suggesting a typical hacker did not create it.

On a technical level, Stuxnet uses four different vulnerabilities to gain access to Windows systems and USB flash drives, identified independently by antivirus software makers Symantec and Kaspersky Lab. Discovering and exploiting all four vulnerabilities, which in this case are errors in code that allow access to the system or program for unintended purposes, would have required a major effort. Three of them were “zero-day” vulnerabilities, meaning they were unknown before now. A Polish security publication, Hakin9, had discovered the fourth, but Microsoft had failed to fix it. Typically, hackers who discover zero-day vulnerabilities exploit them immediately to avoid pre-emption by software companies, which fix them as soon as they learn of them. In another advanced technique, the worm uses two stolen security certificates from Realtek Semiconductor Corp. to access parts of the Windows operating system.

Stuxnet seems to target a specific Siemens software system, the Simatic WinCC SCADA, operating a unique hardware configuration, according to industrial systems security expert Ralph Langner and Symantec, which both dissected the worm. SCADA stands for “supervisory control and data acquisition systems,” which oversee a number of programmable logic controllers (PLCs), which are used to control individual industrial processes. Stuxnet thus targets individual computers that carry out automated activity in large industrial facilities, but only will activate when it finds the right one. Siemens reported that 14 facilities using its software had already been infected, but nothing had happened. When Stuxnet finds the right configuration of industrial processes run by this software, it supposedly will execute certain files that would disrupt or destroy the system and its equipment. Unlike most sophisticated worms or viruses created by criminal or hacker groups, this worm thus does not involve winning wealth or fame for the creator, but rather aims to disrupt one particular facility, shutting down vital systems that run continuously for a few seconds at a time.

VirusBlokAda, a Minsk-based company, announced the discovery of Stuxnet June 17, 2010, on customers’ computers in Iran. Data from Symantec indicates that most of the targeted and infected computers are in Iran, Indonesia and India. Nearly 60 percent of the infected computers were in Iran. Later research found that at least one version of Stuxnet had been around since June 2009. The proliferation of the worm in Iran indicates that country was the target, but where it started and how it has spread to different countries remains unclear.

Few countries have the kind of technology and industrial base and security agencies geared toward computer security and operations required to devise such a worm, which displays a creativity that few intelligence agencies have demonstrated. This list includes, in no particular order, the United States, India, the United Kingdom, Israel, Russia, Germany, France, China and South Korea.

Media speculation has focused on the United States and Israel, both of which are seeking to disrupt the Iranian nuclear program. Though a conventional war against Iran would be difficult, clandestine attempts at disruption can function as temporarily solutions. Evidence exists of other sabotage attempts in the covert war between the United States and Israel on one side and Iran on the other over Iranian efforts to build a deliverable nuclear weapon.

U.S. President Barack Obama has launched a major diplomatic initiative to involve other countries in stopping Iran’s nuclear activities, so another country might have decided to contribute this creative solution. Whoever developed the worm had very specific intelligence on their target. Targeting a classified Iranian industrial facility would require reliable intelligence assets, likely of a human nature, able to provide the specific parameters for the target. A number of defectors could have provided this information, as could have the plants’ designers or operators. Assuming Siemens systems were actually used, the plans or data needed could have been in Germany, or elsewhere.

Evidence pinpointing who created the worm is not likely to emerge. All that is known for certain is that it targets a particular industrial system using Siemens’ programming. Whether the worm has found its target also remains unclear. It may have done so months ago, meaning now we are just seeing the remnants spread. Assuming the target was a secret facility — which would make this the first cyberweapon reported in the media — the attack might well never be publicized. The Iranians have yet to comment on the worm. They may still be investigating to see where it has spread, working to prevent further damage and trying to identify the culprit. If a government did launch the worm, like any good intelligence operation, no one is likely to take credit for the attack. But no matter who was responsible for the worm, Stuxnet is a display of serious innovation by its designer.