1. Propagation, behavior, and countermeasures
The Stuxnet worm
Propagation, behavior, and countermeasures
By Arsh Tavi

2. What does it do?
Nothing, if you are an ordinary computer infected by it.
But if you are a computer in a nuclear facility, it will cause some serious harm.
It will slow down and speed up centrifuges to the point that uranium enriched by them is either in poor quality or the centrifuges explode, all while preventing emergency shutdown.

3. What's the big deal then?
Stuxnet used four zero-day exploits and acts as a rootkit with remote control capabilities
Task Scheduler (Vista)
Printer Spool
Keyboard Layout (XP)
Removable drive .lnk

4. Infected SCADA (Supervisory control and data acquisition) PLC’s (Programmable Logic Controller)
Infects/reinfects attached computers
Uses an exploit with a hard-coded database password in Siemens SCADA machines

5. Why didn’t anyone notice this initially?
2 stolen digital certificates (RealTek and JMicron)
Loads into Kernel memory using certificate through drivers
Allocates memory in Windows/Anti-malware process and injects itself in it
Only harmed centrifuges every 27 days for minute intervals

6. Field Test Network off Win Defender off Firewall off
(courtesy of Symantec)
(files archived by tuts4you)
Network off
Win Defender off
Firewall off
Did not run on Windows 10

7. So what can be done to prevent this worm?
Isolate inner networks and shut off Internet access in nuclear facilities
Patch operating systems
Disable autoplay for removable drives
Use anti-malware software and keep it updated

8. Fun fact: The worm is made to self-destruct on June 24 - 2012
Conclusion
This super-worm was probably made by a state-sponsored group targeting Iran’s nuclear facility, Natanz.
It serves as a pinnacle in the development of modern cyber weapons due to its complexity, nature, and the amount of zero-day exploits utilized.
Fun fact: The worm is made to self-destruct on June