Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

232 13. ATTACKING IRANIAN NUCLEAR FACILITIES: STUXNETIn regard to the physical deployment of Stuxnet, there is the possibility that Stuxnet wasinstalled at Natanz by a saboteur using a memory stick. 52 In such an event, the designers of theworm would greatly increase their probability of success, as opposed to passively waiting forthe software to propagate to the facility. In October 2010, Iran’s intelligence minister, HeydarMoslehi, announced that an unspecified number of “nuclear spies” were arrested in connectionwith Stuxnet. 53 While the details and nature of the arrests are unknown, this illustrates atthe very least that Iran recognizes the various methods by which the worm could havespread—as well as the seriousness of its impact on their operations.Despite the Iranian claims in late 2010 that the Stuxnet worm had minimal impact on theirnuclear operations, security expert Ralph Langner asserts that the malware set Iran’s nuclearprogram back two years. 54 The reasons for this are bifold. First, as stated earlier, damagecaused by Stuxnet is more subtle—although most likely effective. Hence, equipment failurecaused by the software is difficult to attribute. Second, due to the prolific nature of Stuxnet, itis very difficult to clean the malware of all computing devices involved in the enrichmentprocess. These concerns may explain why Iran temporarily halted all enrichment operationsat Natanz in November 2010 (for unstated reasons). 55Was Natanz the Sole Target of Stuxnet?A naturally arising question is “what other countries were affected by Stuxnet?” Althoughthere were reports of the worm on SCADA equipment in Germany, 56 Finland, 57 and China, 58none of these infections resulted in damage to industrial systems. This could be due to the specificconfiguration of the PLC, as Stuxnet only launches the attacks on certain setups. Siemensstates that users of only 15 systems running their software reported infections. Of these 15systems, none of them incurred any damage. 59 Iran most likely did not report infections toSiemens. Although they acquired S7-315 and S7-417 controller cards between 2002 and 2003,the IAEA established that Iran most likely diverted such hardware to its nuclear program—which caused Siemens to halt sales. 60 However, after this time, they did obtain the SiemensmanufacturedS7-417 through a Russian firm known as Power Machines Corp., who installedit as part of their Teleperm system at the Bushehr facility. 61 It may be possible that Bushehr wasalso a Stuxnet target. However, there is less evidence indicating this to be the case as opposed toNatanz. The data structures present in Stuxnet are indicative of the latter and not the former.The specific targeting of the Natanz Fuel Enrichment Plant, as evidenced by Stuxnet’s specifictargeting of the hardware and configuration of the centrifuges present at that facility,indicate that the authors of the malware had significant intelligence on their target gathereda priori. Though it is possible that the intelligence was gathered using more conventionalmeans—such as human or signals intelligence—some believe that this intelligence was collectedthrough a cyber operation as well. One theory is that the Duqu malware (describedin Chapter 8) was designed for this purpose.STUXNET IS A SIGNIFICANT ADVANCEMENT IN MALWAREAs with other pieces of malicious software, Stuxnet takes advantage of previouslyunidentified security holes in system software known as “zero-day” vulnerabilities. It is the