Frank Rieger, a computer-security researcher based in Berlin said ” A computer worm that has infected industrial computers around the world may be part of a campaign targeting nuclear installations in Iran” . Security experts first learned of the new strain of software in June, but only disclosed its ability to infect major industrial systems in recent weeks. “This is cyber sabotage,” said Roel Schouwenberg, a senior researcher for the security firm Kaspersky Labs. “Stuxnet is designed to basically bring down a plant or take down operations.”
The level of sophistication in the worm’s programming and its ability to hide itself suggest it may have been built by a government-sponsored organization in countries such as the U.S. or Israel, said Rieger, chief technology officer at GSMK, a maker of encrypted mobile phones. Rieger estimates that the worm would have required a team of as many as 10 skilled programmers working for about six months to build it, at a cost of at least $3 million.
Latest figures, from August, show 60% of computers infected by Stuxnet are located in Iran – dramatically up from July, when it accounted for less than 25% of infections, research by Symantec shows, with the graph below (from 4 August) showing the prevalence in other countries by comparison. The company estimates that the group building Stuxnet would have been well-funded, comprising between five and 10 people, and that it would have taken six months to prepare.
Stuxnet works by exploiting previously unknown security holes in Microsoft’s Windows operating system. It then seeks out a component called Simatic WinCC, manufactured by Siemens, which controls critical factory operations. The malware even uses a stolen cryptographic key belonging to the Taiwanese semiconductor manufacturer RealTek to validate itself in high-security factory systems.
The worm then takes over the computer running the factory process – which for WinCC would be “mission-critical” systems which have to keep functioning under any circumstance – and “blocks” it for up to a tenth of a second. For high-speed systems, such as the centrifuges used for nuclear fuel processing being done by Iran, that could be disastrous, experts suggested.