Stuxnet made big news about a year ago in summer 2010 when it was discovered to be installed on many Windows systems that were controlling Siemens SCADA systems. Stuxnet made news because it was the most sophisticated malware seen to date. The intent of Stuxnet seems to have been industrial espionage, and due to the complexity of its code, it is thought to have been written by an organization with the resources to design and test such complex code. Some noteworthy aspects of Stuxnet:
- It exploited 4 different “0-day” Windows vulnerabilities. This is unheard of due to the difficulty of finding even 1 exploitable vulnerability in Windows. This suggests that the organization that sponsored Stuxnet development had a lot of resources.
- Stuxnet exploited Siemens software and centrifuges used for Uranium purification. As with any software development effort, resources must be allocated to testing. In this case, testing would involve using the code to run the centrifuges. This requires a lot of money.
- Pure code complexity-Stuxnet’s code was relatively large compared to the codes of other malware that exists. Additionally, Stuxnet was a Windows rootkit (kernel mode malware). Unlike userland malware, kernel mode malware requires special skill to write, because kernel programming is usually more difficult than userland programming, as it is very easy to crash the system, and requires an intricate knowledge of Operating Systems internals (Windows kernel in this specific case).
A sample of Stuxnet comes as 3 files:
The shortcut file is interesting. When opened in a Hex editor, one can see the following text:
S.T.O.R.A.G.E.#.V.o.l.u.m.e.#._.?.?._.U.S.B.S.T.O.R.#.D.i.s.k.&.V.e.n._.K.i.n.g.s.t.o.n.&.P.r.o.d._.D.a.t.a.T.r.a.v.e.l.e.r
This implies that the exploit takes advantage of the specific device name that is registered with windows when it is mounted(Kingston Data Traveler). Due to its complexity and the estimated resources that its development required, it is hypothesized that a Nation’s Government was behind the development of Stuxnet. Stuxnet is known as the turning point in the world of cyberwarfare as the one of the first malcodes of this complexity to attack another nation’s infrastructure. According to multiple sources on the internet, it is supposed that Stuxnet has set Iran’s nuclear program back by about 2 years, approximately as effective as a physical military attack.
By: Neil Sikka