1. Object Oriented Programming and Software Engineering CIS016-2
Week 3: Cybersecurity Case Study – STUXNET Worm
Sue Brandreth
24/11/2018

2. 24/11/2018

3. Cyber Warfare
The STUXNET worm is computer malware which is specifically designed to target industrial control systems for equipment made by Siemens.
These systems are used in Iran for uranium enrichment
Enriched uranium is required to make a nuclear bomb
The aim of the worm was to damage or destroy controlled equipment
24/11/2018

4. What is a Worm?
Malware that can infect a computer-based system and autonomously spread to other systems without user intervention
Unlike a virus, no need for a carrier or any explicit user actions to spread the worm
24/11/2018

5. The Target of the Worm?
24/11/2018

6. The STUXNET Worm
Worm designed to affect SCADA systems and PLC controllers for uranium enrichment centrifuges
Very specific targeting – only aimed at Siemens controllers for this type of equipment
It can spread to but does not damage other control systems
24/11/2018

7. 24/11/2018

8. Worm Actions
Takes over operation of the centrifuge from the SCADA controller
Sends control signals to PLCs managing the equipment
Causes the spin speed of the centrifuges to vary wildly, very quickly, causing extreme vibrations and consequent damage
Blocks signals and alarms to control centre from local PLCs
24/11/2018

9. Stuxnet Penetration
Initially targets Windows systems used to configure the SCADA system
Uses four different vulnerabilities to affect systems
Three of these were previously unknown
So if it encounters some systems where some vulnerabilities have been fixed, it still has the potential to infect them.
Spread can’t be stopped by fixing a single vulnerability
24/11/2018

10. Stuxnet Technology
Spreads to Siemens' WinCC/PCS 7 SCADA control software and takes over configuration of the system.
Uses a vulnerability in the print system to spread from one machine to another
Uses peer-to-peer transfer – there is no need for systems to be connected to the Internet
24/11/2018

11. The Myth of the Air Gap
Centrifuge control systems were not connected to the internet
Initial infection thought to be through infected USB drives taken into plant by unwitting system operators
Beware of freebies!
24/11/2018

12. Damage Caused
It is thought that between 900 and 1000 centrifuges were destroyed by the actions of STUXNET
This is about 10% of the total so, if the intention was to destroy all centrifuges, then it was not successful
Significant slowdown in nuclear enrichment programme because of (a) damage and (b) enrichment shutdown while the worms were cleared from equipment
24/11/2018

13. Unproven Speculations
Because of the complexity of the worm, the number of possible vulnerabilities that are exploited, the access to expensive centrifuges and the very specific targeting, it has been suggested that this is an instance of cyberwar by nation states against Iran
24/11/2018

14. Unproven Speculations
24/11/2018

15. Unproven Speculations
Because STUXNET did not only affect computers in nuclear facilities but spread beyond them by transfers of infected PCs, a mistake was made in its development
There was no intention for the worm to spread beyond Iran
Other countries with serious infections include India, Indonesia and Azerbaijan
24/11/2018

16. Unproven Speculations
The STUXNET worm is a multipurpose worm and there are a range of versions with different functionality in the wild
These use the same vulnerabilities to infect systems but they behave in different ways
One called Duqu has significantly affected computers, especially in Iran. This does not damage equipment but logs keystrokes and sends confidential information to outside servers.
24/11/2018

17. Summary
STUXNET worm is an early instance of cyber warfare where SCADA controllers were targeted
Intended to disrupt Iran’s uranium enrichment capability by varying rotation speeds to damage centrifuges
Used a range of vulnerabilities to infect systems
24/11/2018