Friday, May 27, 2011

STUXNET COMPUTER WORM - AN IN-DEPTH LOOK!!

Dear Readers,


In my previous post, I discussed the details about the cyber attack, which was carried out by Israel against Iran. Now in this post, I will make an analysis of this cyber monster. I will also discuss some findings about this computer virus and the opinion of the experts.


Computer Worm (Def)
A 'worm' is a type of computer virus that can be reproduce by sending copies of itself to any PC that is connected to the infected machine.


Stuxnet Computer Worms
A computer virus called Stuxnet has been described as the most sophisticated 'worm' ever created and has already infected more than 45,000 networks worldwide. Internet security experts fear that Stuxnet is the first 'worm' specifically created to target real-world infrastructure such as power stations, water plants and even nuclear reactors.


Why a cyber attack instead of air/military strike
In 2009, a year before Stuxnet was discovered, Scott Borg of the United States Cyber-Consequences Unit (US-CCU) suggested that Israel might prefer to mount a cyber attack rather than a military strike.
The project's political origins can be found in the last months of the Bush administration. In January 2009, The New York Times reported that Mr. Bush authorized a covert program to undermine the electrical and computer systems around Natanz, Iran's major enrichment center. President Obama, first briefed on the program even before taking office, sped it up, according to the officials familiar with administration's Iran strategy. So did the Israelis, other officials said. Israel has long been seeking a way to cripple Iran's capability without triggering a war, that might follow an overt military strike of the kind they conducted against nuclear facilities in Iraq in 1981 and Syria in 2007.
Three years ago, When Israel still thought its only solution was a military one and approached Mr. Bush for the bunker-busting bombs and other equipment it believed it would need for an air attack, its official told the White House that such a strike would set back Iran's programs by roughly three years. Its request was turned down. 
Now, Mr. Dagan suggest that Israel believes it has gained at least that much time, without mounting the attack. So does the Obama administration.  


Experts opinion and some brief analysis 
When cyber security experts get together, usually talk about such things as the latest techniques in credit card fraud. But the big session at the Virus Bulletin conference in Vancouver. British Columbia, Canada, was about the Stuxnet Computer Worms. It was arranged by Symantec company, whose researchers have been analyzing the computer worm for several weeks.
The Symantec researchers say the Stuxnet worm was designed by a well-funded, well-organized group, perhaps affiliated with a government. They are convinced it was meant to target facilities in Iran. The worm was apparently designed to penetrate and take over the computer controlled system used in nuclear plants in Iran.
It is capable of taking control of key processes and is able to set off a sequence that could cause the entire system to self-destruct, say experts.
David Enim, a senior security researcher at Kasper sky, said what made Stuxnet different from other viruses was its targeted nature.
Though American and Israeli officials refuse to talk about what goes on at Dimona, the operations there, as well as related efforts in USA, are among the newest and strongest clues suggesting that the virus was designed as an American-Israeli project to sabotage the Iranian program.


The worm itself now appears to have included two major components. One was designed to send Iran's nuclear centrifuges spinning wildly out of control. Another seems right out the movies: The computer program also secretly recorded what normal operations at the nuclear plant looked alike, then played those readings back to their plant operators, like a pre-recorded security tape in a bank heist, so that it would appear that everything was operating normally while the centrifuges were actually tearing themselves apart.    


Findings of Mr. Langner
No one was more intrigued than Mr. Langner, a former psychologist who runs a small computer security company in a suburb of Hamburg. eager to design protective software for his clients, he had his employees focus on picking apart the code and running it on the series of Siemens controllers.
He quickly discovered that the worm only kicked into gear when it detected the presence of a specific configuration of controllers, running a set of processes that appear to exist only in a centrifuge plant. "The attackers took great care to make sure that only their designated targets were hit," he said. "Because of the complexity of the attack, the target must be of extremely high value to the attackers. It was a marksman's job."


But as Mr. Langner kept peeling back the layers, he found more --- what he calls the 'dual warhead.' One part of the program is designed to lie dormant for long periods, then speed up the machines so that the spinning rotors in the centrifuges wobble and then destroy themselves. Another part, called a 'man in the middle' in the computer world, sends out those false sensor signals to make the system believe everything is running smoothly. That prevents a safety system from kicking in, which would shut down the plant before it could self-destruct.


"Code analysis makes it clear that the Stuxnet is not about sending a message or providing a concept," Mr. Langner later wrote. "It is about destroying its targets with utmost determination in military style."





A very strange coincidence
Here I will discuss with u people, a very strange 'coincidence.' In his analysis, Mr. Langner also wrote that one small section of the code appears designed to send commands to 984 machines linked together. Curiously, when international inspectors visited Natanz in late 2009, they found that the Iranians had taken out of service a total of exactly 984 machines that had been running the previous summer!!! So, ponder upon this point my dear readers.


How Stuxnet computer worm Spreads




How Israel got blue prints of the Iranian centrifuges
"To check out the worm, you have to know the machines," said an American expert on nuclear intelligence. "The reason the worm has been effective is that the Israelis tried it out."


Dear Readers,


Now lets have a look on this important matter. I myself conduct a search about the ways and possibilities, by means of which the Israelis were capable of having the exact design of the Iranian centrifuges, because without having an exact idea about the Iranian centrifuges, a successful cyber attack was not possible . What I found, lets have a look.



In early 2008, the German company Siemens cooperated with one of the USA's premier national laboratories, in Idaho, to identify the vulnerabilities of computer controllers that company sells to operate industrial machinery around the world --- and that American intelligence agencies have identified as key equipment in Iran's enrichment facilities.
Siemens says that program was part of routine efforts to secure its products against cyber attacks. Nonetheless, it gave the Idaho National Laboratory --- which is part of the Energy Department, responsible for America's nuclear arms --- the chance to identify the well hidden holes in the Siemens systems that were exploited the next year by Stuxnet. 

Now lets discuss about the machines. In 1970s, the Dutch designed a tall, thin machine for enriching uranium. The resulting machine,was known as P-1. The P-1 is more than six feet tall. Afterwards Iran, Libya & North Korea got P-1s from the black market. Now here comes the role of USA. USA obtained a cache of P-1s after Libya gave up its Nuclear program in late 2003, and the machines were sent to the Oak Ridge National Laboratory in Tennessee, another arm of the Energy Department of USA. Now, was it difficult for the Israelis to gain these machines from here, for the Stuxnet developing & testing?? I leave the answer on my dear readers...!!!

Dear Readers,

I hope that this post will help you to make clear vision about the Natanz attack & Cyber Warfare. I tried my best to provide you people all the available info about this cyber weapon. Well, keep me informed about your comments. My next post will be about another untold and shocking story. So wait and watch....!!!!

Thanks for Caring,

Ali Murad