Stuxnet made big news about a year ago in summer 2010 when
it was discovered to be installed on many Windows systems that were controlling
Siemens SCADA systems. Stuxnet made news because it was the most sophisticated
malware seen to date. The intent of Stuxnet seems to have been industrial
espionage, and due to the complexity of its code, it is thought to have been
written by an organization with the resources to design and test such complex
code. Some noteworthy aspects of Stuxnet:
- It exploited 4 different "0-day" Windows vulnerabilities. This is unheard of due to the difficulty of finding even 1 exploitable vulnerability in Windows. This suggests that the organization that sponsored Stuxnet development had a lot of resources.
- Stuxnet exploited Siemens software and centrifuges used for Uranium purification. As with any software development effort, resources must be allocated to testing. In this case, testing would involve using the code to run the centrifuges. This requires a lot of money.
- Pure code complexity-Stuxnet's code was relatively large compared to the codes of other malware that exists. Additionally, Stuxnet was a Windows rootkit (kernel mode malware). Unlike userland malware, kernel mode malware requires special skill to write, because kernel programming is usually more difficult than userland programming, as it is very easy to crash the system, and requires an intricate knowledge of Operating Systems internals (Windows kernel in this specific case).
A sample of Stuxnet comes as 3 files:
 |
| Stuxnet files |
The shortcut file is interesting. When opened in a
Hex editor, one can see the following text:
S.T.O.R.A.G.E.#.V.o.l.u.m.e.#._.?.?._.U.S.B.S.T.O.R.#.D.i.s.k.&.V.e.n._.K.i.n.g.s.t.o.n.&.P.r.o.d._.D.a.t.a.T.r.a.v.e.l.e.r
This implies that the exploit takes advantage of
the specific device name that is registered with windows when it is
mounted(Kingston Data Traveler). Due to its complexity and the estimated
resources that its development required, it is hypothesized that a Nation's
Government was behind the development of Stuxnet. Stuxnet is known as the
turning point in the world of cyberwarfare as the one of the first malcodes of
this complexity to attack another nation's infrastructure. According to
multiple sources on the internet, it is supposed that Stuxnet has set Iran's
nuclear program back by about 2 years, approximately as effective as a physical
military attack.
