Stuxnet Threat Goes Mainstream

(image courtesy of www.des-or-mad.net)

The online world can be a very scary place. This has been true for years now. But it hasn’t really escaped the tech publications and entered the mass consciousness, with the exception of online fraud.

This may be about to change. Within the last few days, there has been a flurry of coverage around Stuxnet, a computer worm that specifically targets in Siemens’ WinCC/PCS 7 SCADA (supervisory control and data acquisition) software. This software from Siemens controls critical infrastructure like power grids, utilities and the Iranian nuclear program.

Take talk of guided cyber missiles,  mix with power grids toppling and rumors of sabotaging Iran’s nuclear ambitions, and you’ve got the ingredients of a big story. Here’s some of the coverage to date:

• Elinor Mills of CNET tries to separate fact from hype
• Trevor Butterworth of the Daily Beast wrote a very thorough piece picked up by Silicon Alley Insider
• Gregg Keiser of Computerworld was all over the Iranian angle
• And in a sign the story is branching out, PBS’ Newshour did an interview with cyber security expert Rodney Joffe of Neustar

I reached out to an old colleague with a lot of expertise in the field, to try and add something new to the reporting. I can’t cite the source, but he shared some interesting  either not included and/or not clear in other stories.

First, the method of infection hasn’t been clearly explained, in his opinion.  The malware is never transmitted from the infected Windows machines to the Siemans SCADA software, or more precisely the PLC (progammable logic controller) within that specific piece of software. The PLC is reprogrammed, and there is no record of the change.

An analogy might help. Cars are getting more and more like rolling computers everyday. Let’s say you used a laptop to diagnose an engine problem, or download some performance software. If your computer was infected, Stuxnet would look for a very particular kind of car — let’s say (heaven forbid) a 1999 M3 manufactured in April — and program only that type of car to blow up on Halloween. And your readings would show nothing unusual until then.

The other thing my contact mentioned is focusing too much on Stuxnet, and not enough on the technique. It’s not the malware itself, it’s the highly targeted, super sophisticated approach it has demonstrated. Hordes of cyber criminals are poring over the details right now, and probably nation states as well.

All it takes is lots of money and computing expertise. And next time, the destruction may not be as precisely targeted.