Stuxnet, the world’s first known “cyber missile,” was designed to sabotage special power supplies used almost exclusively in nuclear fuel-refining centrifuge systems, researchers studying its code have revealed. The discovery is another puzzle piece experts say points to Iran’s nuclear centrifuge plants as the likely target.
While the discovery may seem just another bit of circumstantial evidence, it is a critical one that appears to all but answer a central mystery surrounding Stuxnet: What was its target?
Stuxnet was discovered in June by a Belarus antivirus company, and its unique ability to control industrial processes was uncovered by US researchers in July. But its true role as the world’s first publicly known cyber super weapon – designed to cross the digital divide and destroy a very specific target in the real world – was only revealed in September.
Even then, the target was mostly an informed guess. Was Iran’s Bushehr nuclear power plant or its nuclear centrifuge fuel-refining plant at Natanz the target, as some suggested? Or was it something quite different, like the big Indian-made satellite that failed dramatically in July?
It now appears that a smoking gun within Stuxnet’s software code targets power supplies almost certainly used inside any Iranian nuclear fuel refining plant, researchers say. Working separately, researchers at California computer security firm Symantec arrived at the same conclusion as researchers in Germany late last week: Nuclear-fuel centrifuges were the target.
The researchers followed a complex trail. After cleverly gaining access to computer systems using an array of devious “exploits,” Stuxnet searches for and infects only a specific Siemens-made programmable logic controller (PLC) performing specific functions, the researchers found. Then – and this is the part just unearthed – it hunts for identification numbers unique to a special kind of “frequency converter drive” made by just two firms in the world: one headquartered in Finland, the other in Tehran.
Frequency converter drives are a kind of power supply that can change the frequency of its output to control the speed of a motor. The drive responds to a PLC’s computer commands and is used for industrial control in factory settings worldwide. Stuxnet hunts for specific drives set at specific speeds – the very high speeds a centrifuge must achieve to physically separate and concentrate uranium isotopes for use as nuclear fuel. Such fuel can then be used in a reactor or, if refined to far higher concentrations, a nuclear weapon. [Editor’s note: The original version misconstrued the nature of frequency converter drives.]
Symantec researchers were aided by a Dutch industrial control systems expert who revealed the connection with Tehran and Finland firms. It turns out that the special drives Stuxnet targets are built to operate “at very high speeds … speeds used only in a limited number of applications,” Symantec stated in a report update Nov. 12. Such drives are “regulated for export in the US by the Nuclear Regulatory Commission,” because one of their main uses is for uranium enrichment, it noted.
Once Stuxnet has locked its sights on the target, it alternately brings the centrifuge process to either a grinding slowdown or an explosive surge – by sabotaging the centrifuge refining process. It tells the commandeered PLC to force the frequency converter drive to do something it’s not ever supposed to do: Switch back and forth from high speed to low speed at intervals punctuated by long period of normal operation. It also occasionally pushes the centrifuge to far exceed its maximum speed.
“Stuxnet changes the output frequencies and thus the speed of the motors for short intervals over periods of months,” Symantec researcher Eric Chien reported Nov. 12 on his blog. “Interfering with the speed of the motors sabotages the normal operation of the industrial control process.”
Normal operating frequency of the special drive is supposed to be between 807 and 1210 Hz – the higher the hertz, the higher the speed. One hertz means that a cycle is repeated once per second.
Stuxnet “sabotages the system by slowing down or speeding up the motor to different rates at different times,” including sending it up to 1410 Hz, well beyond its intended maximum speed. Such wide swings would probably destroy the centrifuge – or at least wreck its ability to produce refined uranium fuel, others researchers say.
“One reasonable goal for the attack could be to destroy the centrifuge rotor by vibration, which causes the centrifuge to explode” as well as simply degrading the output subtly over time, Ralph Langner, the German researcher who first revealed Stuxnet’s function as a weapon in mid-September, wrote on his blog last week.
All of the circumstantial evidence points in the same direction: Natanz.
The Natanz nuclear centrifuge fuel-refining plant may have been hit first by Stuxnet in mid-2009, said Frank Rieger, a German researcher with Berlin encryption firm GSMK. The International Atomic Energy Agency found a sudden drop in the number of working centrifuges at the Natanz site, he noted in an interview in September.
“It seems like the parts of Stuxnet dealing with PLCs have been designed to work on multiple nodes at once – which makes it fit well with a centrifuge plant like Natanz,” Mr. Rieger says. By contrast, Bushehr is a big central facility with many disparate PLCs performing many different functions. Stuxnet seems focused on replicating its intrusion across a lot of identical units in a single plant, he said.
That and Symantec’s new findings also dovetail nicely with Mr. Langner’s detailed findings in his ongoing dissection of Stuxnet. Parts of the code show Stuxnet causing problems for short periods, then resuming undisturbed operation, Symantec’s findings show. As a result, Langner writes, “the victim, having no clue of being under a cyber attack, will replace broken centrifuges by new ones – until ending in frustration. It’s like a Chinese water torture.”
Ultimately, the Stuxnet cyber attack “is as good as using explosives,” Langner notes. Actually, it’s even better, he writes. Iran is believed to have other hidden centrifuge plants and “with a well designed attack plan, you even hit the unknown facilities.”
We’re not backing down in the face of Trump’s threats.
As Donald Trump is inaugurated a second time, independent media organizations are faced with urgent mandates: Tell the truth more loudly than ever before. Do that work even as our standard modes of distribution (such as social media platforms) are being manipulated and curtailed by forces of fascist repression and ruthless capitalism. Do that work even as journalism and journalists face targeted attacks, including from the government itself. And do that work in community, never forgetting that we’re not shouting into a faceless void – we’re reaching out to real people amid a life-threatening political climate.
Our task is formidable, and it requires us to ground ourselves in our principles, remind ourselves of our utility, dig in and commit.
As a dizzying number of corporate news organizations – either through need or greed – rush to implement new ways to further monetize their content, and others acquiesce to Trump’s wishes, now is a time for movement media-makers to double down on community-first models.
At Truthout, we are reaffirming our commitments on this front: We won’t run ads or have a paywall because we believe that everyone should have access to information, and that access should exist without barriers and free of distractions from craven corporate interests. We recognize the implications for democracy when information-seekers click a link only to find the article trapped behind a paywall or buried on a page with dozens of invasive ads. The laws of capitalism dictate an unending increase in monetization, and much of the media simply follows those laws. Truthout and many of our peers are dedicating ourselves to following other paths – a commitment which feels vital in a moment when corporations are evermore overtly embedded in government.
Over 80 percent of Truthout‘s funding comes from small individual donations from our community of readers, and the remaining 20 percent comes from a handful of social justice-oriented foundations. Over a third of our total budget is supported by recurring monthly donors, many of whom give because they want to help us keep Truthout barrier-free for everyone.
You can help by giving today. Whether you can make a small monthly donation or a larger gift, Truthout only works with your support.