Propagation, behavior, and countermeasures The Stuxnet worm Propagation, behavior, and countermeasures By Arsh Tavi

What does it do? Nothing, if you are an ordinary computer infected by it. But if you are a computer in a nuclear facility, it will cause some serious harm. It will slow down and speed up centrifuges to the point that uranium enriched by them is either in poor quality or the centrifuges explode, all while preventing emergency shutdown.

What's the big deal then? Stuxnet used four zero-day exploits and acts as a rootkit with remote control capabilities Task Scheduler (Vista) Printer Spool Keyboard Layout (XP) Removable drive .lnk

Infected SCADA (Supervisory control and data acquisition) PLC’s (Programmable Logic Controller) Infects/reinfects attached computers Uses an exploit with a hard-coded database password in Siemens SCADA machines

Why didn’t anyone notice this initially? 2 stolen digital certificates (RealTek and JMicron) Loads into Kernel memory using certificate through drivers Allocates memory in Windows/Anti-malware process and injects itself in it Only harmed centrifuges every 27 days for 15-50 minute intervals

Field Test Network off Win Defender off Firewall off (courtesy of Symantec) (files archived by tuts4you) Network off Win Defender off Firewall off Did not run on Windows 10

So what can be done to prevent this worm? Isolate inner networks and shut off Internet access in nuclear facilities Patch operating systems Disable autoplay for removable drives Use anti-malware software and keep it updated

Fun fact: The worm is made to self-destruct on June 24 - 2012 Conclusion This super-worm was probably made by a state-sponsored group targeting Iran’s nuclear facility, Natanz. It serves as a pinnacle in the development of modern cyber weapons due to its complexity, nature, and the amount of zero-day exploits utilized. Fun fact: The worm is made to self-destruct on June 24 - 2012