Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

224 13. ATTACKING IRANIAN NUCLEAR FACILITIES: STUXNETINTRODUCTIONIn the previous two chapters, we discussed cyber-warfare considerations of industrial controlsystems (ICS) and the power grid. While incidents described in those chapters illustratedthat cyber warfare against ICS was possible, none of them are actual incidents of cyber war.For instance, the Maroochy water breach was a crime motivated by revenge, the Aurora Testwas an experiment, and the cascading power outage in Italy resulted from equipment failurerather than from malicious attack. In this chapter, we describe Stuxnet, which successfullytargeted the Iranian Natanz Uranium Fuel Enrichment Plant (FEP). Unlike the previouslymentioned incidents dealing with ICS, Stuxnet appears to have been politically motivated,which is why we consider it an act of cyber war.Interestingly, before the discovery of Stuxnet many believed a cyber-war operation againstan industrial control system would be impossible—or at least unlikely. For instance, in 2004,Marcus Ranum asserted that the sheer complexity of the power grid would make it anunlikely target of attack. 1 However, in July 2010, the discovery of a new piece of malwareby a small Belarusian firm known as VirusBlockAda 2 changed these perceptions. The malwarediscovered would later become known as Stuxnet.In the months that followed VirusBlockAda’s discovery, there was a flurry of activity in thecomputer security community—revealing that this malware was a “worm” in other words“self-propagating” and designed to target industrial control systems (ICS). Once it wasrevealed that the majority of infections were discovered in Iran, 3 along with an unexplaineddecommissioning of centrifuges at the Iranian fuel enrichment plant (FEP) at Natanz, 4 manyin the media speculated that the ultimate goal of Stuxnet was to target Iranian nuclear facilities.In November of 2010, some of these suspicions were validated when Iranian PresidentMahmoud Ahmadinejad publically acknowledged that a computer worm created problemsfor a “limited number of our [nuclear] centrifuges.” 5Reputable experts in the computer security community have labeled Stuxnet as “unprecedented,”6 an “evolutionary leap,” 7 and “the type of threat we hope to never see again.” 8 Inthis chapter, we study how this malicious software represents a fundamental advance incyber warfare—an advance that is often called a revolution of military affairs (RMA). 9 Wefirst describe the Iranian Natanz fuel enrichment facility—which is widely thought to bethe primary target of Stuxnet. Then, we describe how Stuxnet works, why it represents anadvance in the state of the art of malware design, and how it invalidated several commonassumptions about cyber security.THE ALLEGED TARGET: THE NATANZ FUEL ENRICHMENTFACILITYNatanz was Iran’s main fuel enrichment facility at the time of Stuxnet’s supposed deployment.Its existence was brought to the world’s attention in summer 2002, while it was underconstruction, which by then was underway for 2 years, and the IAEA monitored the furtherdevelopment of the site. Apparently designed to withstand airstrikes, two cascade halls withthe capacity to hold an estimated 50,000 centrifuges each, are basically thick-walled cementboxes with 8 m of soil covering the roofs (Figure 13.1). 10