[LINK] Schneier on Stuxnet

[Roger Clarke]

[Thoroughly careful analysis of an intellectually challenging puzzle]

                              Stuxnet
           http://www.schneier.com/crypto-gram-1010.html#6

Computer security experts are often surprised at which stories get
picked up by the mainstream media. Sometimes it makes no sense. Why this
particular data breach, vulnerability, or worm and not others? Sometimes
it's obvious. In the case of Stuxnet, there's a great story.

As the story goes, the Stuxnet worm was designed and released by a
government--the U.S. and Israel are the most common
suspects--specifically to attack the Bushehr nuclear power plant in
Iran. How could anyone not report that? It combines computer attacks,
nuclear power, spy agencies and a country that's a pariah to much of the
world. The only problem with the story is that it's almost entirely
speculation.

Here's what we do know: Stuxnet is an Internet worm that infects Windows
computers. It primarily spreads via USB sticks, which allows it to get
into computers and networks not normally connected to the Internet. Once
inside a network, it uses a variety of mechanisms to propagate to other
machines within that network and gain privilege once it has infected
those machines. These mechanisms include both known and patched
vulnerabilities, and four "zero-day exploits": vulnerabilities that were
unknown and unpatched when the worm was released. (All the infection
vulnerabilities have since been patched.)

Stuxnet doesn't actually do anything on those infected Windows
computers, because they're not the real target. What Stuxnet looks for
is a particular model of Programmable Logic Controller (PLC) made by
Siemens (the press often refers to these as SCADA systems, which is
technically incorrect). These are small embedded industrial control
systems that run all sorts of automated processes: on factory floors, in
chemical plants, in oil refineries, at pipelines--and, yes, in nuclear
power plants. These PLCs are often controlled by computers, and Stuxnet
looks for Siemens SIMATIC WinCC/Step 7 controller software.

If it doesn't find one, it does nothing. If it does, it infects it using
yet another unknown and unpatched vulnerability, this one in the
controller software. Then it reads and changes particular bits of data
in the controlled PLCs. It's impossible to predict the effects of this
without knowing what the PLC is doing and how it is programmed, and that
programming can be unique based on the application. But the changes are
very specific, leading many to believe that Stuxnet is targeting a
specific PLC, or a specific group of PLCs, performing a specific
function in a specific location--and that Stuxnet's authors knew exactly
what they were targeting.

It's already infected more than 50,000 Windows computers, and Siemens
has reported 14 infected control systems, many in Germany. (These
numbers were certainly out of date as soon as I typed them.) We don't
know of any physical damage Stuxnet has caused, although there are
rumors that it was responsible for the failure of India's INSAT-4B
satellite in July. We believe that it did infect the Bushehr plant.

All the anti-virus programs detect and remove Stuxnet from Windows systems.

Stuxnet was first discovered in late June, although there's speculation
that it was released a year earlier. As worms go, it's very complex and
got more complex over time. In addition to the multiple vulnerabilities
that it exploits, it installs its own driver into Windows. These have to
be signed, of course, but Stuxnet used a stolen legitimate certificate.
Interestingly, the stolen certificate was revoked on July 16, and a
Stuxnet variant with a different stolen certificate was discovered on
July 17.

Over time the attackers swapped out modules that didn't work and
replaced them with new ones--perhaps as Stuxnet made its way to its
intended target. Those certificates first appeared in January.  USB
propagation, in March.

Stuxnet has two ways to update itself. It checks back to two control
servers, one in Malaysia and the other in Denmark, but also uses a
peer-to-peer update system: When two Stuxnet infections encounter each
other, they compare versions and make sure they both have the most
recent one. It also has a kill date of June 24, 2012. On that date, the
worm will stop spreading and delete itself.

We don't know who wrote Stuxnet. We don't know why. We don't know what
the target is, or if Stuxnet reached it. But you can see why there is so
much speculation that it was created by a government.

Stuxnet doesn't act like a criminal worm. It doesn't spread
indiscriminately. It doesn't steal credit card information or account
login credentials. It doesn't herd infected computers into a botnet. It
uses multiple zero-day vulnerabilities. A criminal group would be
smarter to create different worm variants and use one in each. Stuxnet
performs sabotage. It doesn't threaten sabotage, like a criminal
organization intent on extortion might.

Stuxnet was expensive to create. Estimates are that it took 8 to 10
people six months to write. There's also the lab setup--surely any
organization that goes to all this trouble would test the thing before
releasing it--and the intelligence gathering to know exactly how to
target it. Additionally, zero-day exploits are valuable. They're hard to
find, and they can only be used once. Whoever wrote Stuxnet was willing
to spend a lot of money to ensure that whatever job it was intended to
do would be done.

None of this points to the Bushehr nuclear power plant in Iran, though.
Best I can tell, this rumor was started by Ralph Langner, a security
researcher from Germany. He labeled his theory "highly speculative," and
based it primarily on the facts that Iran had an unusually high number
of infections (the rumor that it had the most infections of any country
seems not to be true), that the Bushehr nuclear plant is a juicy target,
and that some of the other countries with high infection rates--India,
Indonesia, and Pakistan--are countries where the same Russian contractor
involved in Bushehr is also involved. This rumor moved into the computer
press and then into the mainstream press, where it became the accepted
story, without any of the original caveats.

Once a theory takes hold, though, it's easy to find more evidence. The
word "myrtus" appears in the worm: an artifact that the compiler left,
possibly by accident. That's the myrtle plant. Of course, that doesn't
mean that druids wrote Stuxnet. According to the story, it refers to
Queen Esther, also known as Hadassah; she saved the Persian Jews from
genocide in the 4th century B.C. "Hadassah" means "myrtle" in Hebrew.

Stuxnet also sets a registry value of "19790509" to alert new copies of
Stuxnet that the computer has already been infected. It's rather
obviously a date, but instead of looking at the gazillion things--large
and small--that happened on that the date, the story insists it refers
to the date Persian Jew Habib Elghanain was executed in Tehran for
spying for Israel.

Sure, these markers could point to Israel as the author. On the other
hand, Stuxnet's authors were uncommonly thorough about not leaving clues
in their code; the markers could have been deliberately planted by
someone who wanted to frame Israel. Or they could have been deliberately
planted by Israel, who wanted us to think they were planted by someone
who wanted to frame Israel. Once you start walking down this road, it's
impossible to know when to stop.

Another number found in Stuxnet is 0xDEADF007. Perhaps that means "Dead
Fool" or "Dead Foot," a term that refers to an airplane engine failure.
Perhaps this means Stuxnet is trying to cause the targeted system to
fail. Or perhaps not. Still, a targeted worm designed to cause a
specific sabotage seems to be the most likely explanation.

If that's the case, why is Stuxnet so sloppily targeted? Why doesn't
Stuxnet erase itself when it realizes it's not in the targeted network?
When it infects a network via USB stick, it's supposed to only spread to
three additional computers and to erase itself after 21 days--but it
doesn't do that. A mistake in programming, or a feature in the code not
enabled? Maybe we're not supposed to reverse engineer the target. By
allowing Stuxnet to spread globally, its authors committed collateral
damage worldwide. From a foreign policy perspective, that seems dumb.
But maybe Stuxnet's authors didn't care.

My guess is that Stuxnet's authors, and its target, will forever remain
a mystery.

This essay originally appeared on Forbes.com.
http://www.forbes.com/2010/10/06/iran-nuclear-computer-technology-security-stuxnet-worm.html 

or http://tinyurl.com/29bhajd

My alternate explanations for Stuxnet were cut from the essay.  Here
they are:

1. A research project that got out of control.  Researchers have
accidentally released worms before.  But given the press, and the fact
that any researcher working on something like this would be talking to
friends, colleagues, and his advisor, I would expect someone to have
outed him by now, especially if it was done by a team.

2. A criminal worm designed to demonstrate a capability.  Sure, that's
possible.  Stuxnet could be a prelude to extortion.  But I think a
cheaper demonstration would be just as effective.  Then again, maybe not.

3. A message.  It's hard to speculate any further, because we don't know
who the message is for, or its context.  Presumably the intended
recipient would know.  Maybe it's a "look what we can do" message.  Or
an "if you don't listen to us, we'll do worse next time" message.
Again, it's a very expensive message, but maybe one of the pieces of the
message is "we have so many resources that we can burn four or five
man-years of effort and four zero-day vulnerabilities just for the fun
of it."  If that message were for me, I'd be impressed.

4. A worm released by the U.S. military to scare the government into
giving it more budget and power over cybersecurity.  Nah, that sort of
conspiracy is much more common in fiction than in real life.

Note that some of these alternate explanations overlap.

http://www.csmonitor.com/USA/2010/0921/Stuxnet-malware-is-weapon-out-to-destroy-Iran-s-Bushehr-nuclear-plant 

or http://tinyurl.com/37aqurn
reported:
http://www.computerworld.com/s/article/9185419/Siemens_Stuxnet_worm_hit_industrial_systems 

or http://tinyurl.com/32lsl8b
http://blogs.forbes.com/firewall/2010/09/29/did-the-stuxnet-worm-kill-indias-insat-4b-satellite/ 

or http://tinyurl.com/26jkaw8
http://www.wired.com/threatlevel/2010/10/stuxnet-deconstructed/
http://www.nytimes.com/2010/09/27/technology/27virus.html
http://www.symantec.com/connect/blogs/stuxnet-print-spooler-zero-day-vulnerability-not-zero-day-all 

or http://tinyurl.com/2fh7hr9
http://news.cnet.com/8301-27080_3-20018530-245.html
http://sites.google.com/site/n3td3v/latest/whatweknowaboutstuxnet
http://antivirus.about.com/b/2010/10/02/debunking-the-bunk-of-stuxnet.htm
or http://tinyurl.com/237yed9
http://frank.geekheim.de/?p=1189

Good technical info on Stuxnet:
http://www.f-secure.com/weblog/archives/00002040.html
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf 

or http://tinyurl.com/36y7jzb

Ralph Langner:
http://www.langner.com/en/


-- 
Roger Clarke                                 http://www.rogerclarke.com/

Xamax Consultancy Pty Ltd      78 Sidaway St, Chapman ACT 2611 AUSTRALIA
                    Tel: +61 2 6288 1472, and 6288 6916
mailto:Roger.Clarke at xamax.com.au                http://www.xamax.com.au/

Visiting Professor in the Cyberspace Law & Policy Centre      Uni of NSW
Visiting Professor in Computer Science    Australian National University