Research Shows Stuxnet Worm Aimed At Iran

By Josh Halliday This article was published in The Gulf Times on 19/11/2010 Two new independent examinations of the Stuxnet computer worm, thought to be the work of a national government agency, show that it was definitely built to target technology used at Iran’s Bushehr nuclear power plant. Described as one of the “most refined pieces of malware ever discovered,” Stuxnet took direct aim at industrial systems based in Iran, whose first nuclear power station recently began operations. Speaking to the Guardian in September, security experts said the attack was likely a state-sponsored case of “modern espionage”. Now new research by cyber security firm Symantec shows definitively that Stuxnet was built to target uranium enrichment equipment used to fuel Tehran’s controversial nuclear programme. Eric Chien, a researcher at Symantec, said the company had “connected a critical piece of the puzzle” with the finding. Stuxnet works by sabotaging frequency converter drives used to alter the speed of motors in factory machinery, the study shows. The worm only attacks drives that run at a higher speed - between 807 Hertz (Hz) and 1210 Hz. When Stuxnet finds drives running at those speeds, it begins changing their revolution speed dramatically - “to 1410Hz and then to 2Hz and then to 1064Hz,” Symantec says. That could make a system tear itself apart due to inertial effects, and would certainly prevent it functioning properly. “Modification of the output frequency essentially sabotages the automation system [preventing it] from operating properly,” Chien said. That Iran is the target emerges from the second part of the discovery, Symantec’s team explains: “we can now confirm that Stuxnet requires the industrial control system to have frequency converter drives from at least one of two specific vendors, one headquartered in Finland and the other in Tehran, Iran. This is in addition to the previous requirements we discussed of a S7-300 CPU and a CP-342-5 Profibus communications module.” They note that “while frequency converter drives are used in many industrial control applications, these speeds are used only in a limited number of applications.” Specifically, “efficient low-harmonic frequency converter drives that output over 600Hz are regulated for export in the United States by the Nuclear Regulatory Commission as they can be used for uranium enrichment. We would be interested in hearing what other applications use frequency converter drives at these frequencies.” The worm was identified by a Belarusian security firm working for an Iranian client earlier this year, after finding that some technology in the Tehran plant wasn’t working properly. Experts said the worm must have been well-funded and that the team which wrote it probably comprised between five and 10 people, and would have taken around six months to ready for deployment. Ivanka Barzashka, a research associate at the Federation of American Scientists, told Reuters: “If Symantec’s analysis is true, then Stuxnet likely aimed to destroy Iran’s gas centrifuges, which could produce enriched uranium for both nuclear fuel and nuclear bombs.” Another computer security firm, Langner Communications of Germany, also independently found that the worm was designed to target systems used in power plants, such as those at the Bushehr nuclear power plant. Alan Bentley, senior international vice president at security firm Lumension, said Stuxnet is “the most refined piece of malware ever discovered,” and that the worm was significant because “mischief or financial reward wasn’t its purpose, it was aimed right at the heart of a critical infrastructure.” Graham Cluley, a senior consultant with the online security firm Sophos, told the Guardian that the attack heralded the “third age” of cyber crime, where “there are political, economic and military ways in which the internet can be exploited - and malware can be used - to gain advantage by foreign states.” “I think we will see more and more attacks which will be blamed on state-sponsored cyber attacks. There have been numerous attacks in the past which could be said to have possible military, political or economic motives, but it is very difficult to prove that a hack was ordered by Mossad or instead dreamt up by a Macclesfield student.”