Stuxnet

The malware discovered in June 2010 and widely described as the first cyber-weapon built to cause physical destruction: it targeted Siemens SIMATIC WinCC / Step 7 and S7-300/400 PLCs and, by tampering with variable-frequency drives, damaged uranium-enrichment centrifuge rotors. This page records it as the subject of stuxnet-reconstruction and as the reason this spoke now has an ICS security node; the operational detail here stays at the level long since published in the Symantec, Kaspersky and ESET dossiers.

It matters to a defensive wiki for one structural reason above the history: Stuxnet is the case where the security boundary was not the computer. The infected Windows machines were a delivery path; the target was a programmable logic controller and the physical process behind it. Every layer this spoke is built on — hardening the host, watching the alerts, closing the flaw — assumes the thing being defended is the IT estate. Stuxnet is the standing counter-example: a fully patched, well-monitored engineering workstation was exactly the vehicle, because the consequence lived one hop downstream in equipment the SOC could not see.

The shape worth keeping

Three features recur in every serious analysis and are what a defender reasons about:

• It crossed the air gap. Propagation did not need the internet: USB, network shares and a P2P channel let it reach isolated control networks, which is why "not connected" was never a control.
• It was surgical. The worm checked for a specific software and hardware environment (WinCC/Step 7, particular S7 models) and idled otherwise. A payload that only fires on its intended target is far harder to catch by consequence, because almost nowhere shows the consequence.
• It lied to the operator. The Step 7 shim replayed normal readings while the process was being driven to destruction — the "the sensor is a program on the box" problem in its sharpest form, and the same argument in-silicon-enforcement makes for moving the monitor off the machine it watches.

Variants, so the corpus does not flatten them

There is more than one Stuxnet. The 0.5 variant attacked the valve/pressure logic; the later 1.x variants attacked rotor speed through the frequency drives. This distinction is exactly where stuxnet-reconstruction is internally inconsistent (it describes the 1.x rotor attack while bundling Symantec's dossier on the 0.5 valve variant), and it is the sort of detail a reconstruction inherits from whichever dossier its author happened to read.

Related

stuxnet-reconstruction · ics-security · mitre-attack · in-silicon-enforcement · network-traffic-analysis · defensive-security · synthesis