# Was the Stuxnet malware designed to destroy Iran's Bushehr nuclear power plant? **URL:** \ **Category:** Factual Questions\ **Created:** [September 25, 2010, 5:19am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976 "2010-09-25T05:19:25Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Todderbob](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@Todderbob](https://boards.straightdope.com/u/Todderbob)\ **Post date:** [September 26, 2010, 12:24am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/21 "2010-09-26T00:24:04Z")
> [@Simplicio](#): > > > [@Todderbob](#): > > > > It exploited a patched vulnerability in a system that, if run properly, never would’ve mattered anyway. > > OK, but if Iran can run their system incorrectly at a facility where they are presumably pretty aware of the possibility of sabatoge, it certainly seems possible that some neglected system in another country could have the same vulnerability. It’s possible, but more likely they had someone on the inside who was able to plant the virus, or plant the virus in a software update via the Russian group helping the Iranians with their program. Even if it was, the program was very, very sophisticated (apparently) and only activated with the right software/hardware configuration. ---
**Author:** ![Simplicio](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@Simplicio](https://boards.straightdope.com/u/Simplicio)\ **Post date:** [September 26, 2010, 12:39am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/22 "2010-09-26T00:39:02Z")
> [@Fubaya](#): > > > [@Simplicio](#): > > > > OK, but if Iran can run their system incorrectly at a facility where they are presumably pretty aware of the possibility of sabatoge, it certainly seems possible that some neglected system in another country could have the same vulnerability. > > It checks that it is on the correct system before doing the bad stuff and is supposedly pretty specific about what it looks for. While the writers obviously know enough to attack other places if they wanted, so far it seems to benign to other sites it infects. I’ve seen different things on how specifically the virus was targeted. Some articles make it sound like it would work on one targeted location and no where else, others make it sound like it was very specifically tailored to the one model of controller, but that anyone with that model of controller is vulnerable. I can’t really find anything that says explicitly that it won’t effect other systems though. ---
**Author:** ![Todderbob](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@Todderbob](https://boards.straightdope.com/u/Todderbob)\ **Post date:** [September 26, 2010, 1:55am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/23 "2010-09-26T01:55:54Z")
Keep in mind, they can now release the off button, since presumably they were smart enough to design one… _Just in case…_ ---
**Author:** ![Fubaya](https://avatars.discourse-cdn.com/v4/letter/f/c2a13f/32.png) [@Fubaya](https://boards.straightdope.com/u/Fubaya)\ **Post date:** [September 26, 2010, 5:45am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/24 "2010-09-26T05:45:12Z")
> [@Simplicio](#): > > I’ve seen different things on how specifically the virus was targeted. Some articles make it sound like it would work on one targeted location and no where else, others make it sound like it was very specifically tailored to the one model of controller, but that anyone with that model of controller is vulnerable. I can’t really find anything that says explicitly that it won’t effect other systems though. From what I understand, while anyone could be using the fairly specific computer configurations stuxnet looks for, the actual data that it looks for and modifies would be unique to the target site and the result of custom written software for controlling… whatever. [Siemens](http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&lang=en&objid=43876783&caller=view) says: > [@](#): > > # The behavioral pattern of Stuxnet suggests that the virus is apparently only activated in plants with a specific configuration. It deliberately searches for a certain technical constellation with certain modules and certain program patterns which apply to a specific production process. This pattern can, for example, be localized by one specific data block and two code blocks. > > # This means that Stuxnet is obviously targeting a specific process or a plant and not a particular brand or process technology and not the majority of industrial applications. ---
**Author:** ![GiantRat](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@GiantRat](https://boards.straightdope.com/u/GiantRat)\ **Post date:** [September 26, 2010, 10:20am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/25 "2010-09-26T10:20:48Z")
> [@coremelt](#): > > > [@GiantRat](#): > > > > Building an attack mechanism for a single target is inefficient (and hackers/crackers are often lazy in that respect, while busting their asses in other regards). > > You obviously didn’t read the original article quoted above. Stuxnet has been written for a specific target, it carefully checks for fingerprints of a specific hardware system and only delivers its payload on that system. It also looks like it spread from a USB key that was planted inside a specific facility using an inside agent. And you, obviously, don’t know a thing about how this works or how it was deployed. India and Indonesia were similarly affected by stux. It’s probably safe to guess that some NATO countries were hit, as well, but are not disclosing it because of the SCADA implications. We’re talking about print spooler compromise - a commonly overlooked attack vector. ---
**Author:** ![Alessan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/alessan/32/465_2.png) [@Alessan](https://boards.straightdope.com/u/Alessan)\ **Post date:** [September 26, 2010, 10:31am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/26 "2010-09-26T10:31:34Z")
They were infected - but did it do any actual damage? ---
**Author:** ![Todderbob](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@Todderbob](https://boards.straightdope.com/u/Todderbob)\ **Post date:** [September 26, 2010, 2:01pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/27 "2010-09-26T14:01:03Z")
> [@Alessan](#): > > They were infected - but did it do any actual damage? The wired article pretty heavily suggested it was, and Iran confirmed yesterday that they were effected (edit: no they didn’t? I cant find the article, I mustve misunderstood. ---
**Author:** ![Alessan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/alessan/32/465_2.png) [@Alessan](https://boards.straightdope.com/u/Alessan)\ **Post date:** [September 26, 2010, 2:30pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/28 "2010-09-26T14:30:51Z")
I mean, did it cause any damage \*outside \*of Iran? ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [September 26, 2010, 3:50pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/29 "2010-09-26T15:50:29Z")
This all seems overblown now that the existence of the malware is known. ---
**Author:** ![Gukumatz](https://avatars.discourse-cdn.com/v4/letter/g/74df32/32.png) [@Gukumatz](https://boards.straightdope.com/u/Gukumatz)\ **Post date:** [September 26, 2010, 3:51pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/30 "2010-09-26T15:51:15Z")
It looks like it spread via a contractor’s equipment. The secondary hits (outside Iran) have mostly been in locations where that contractor also worked after their work in Iran was done. > [@TriPolar](#): > > This all seems overblown now that the existence of the malware is known. Malware for a PC is old hat. Malware for a nuclear plant? That’s just scary. You can bet your sweet ass that somewhere in Washington, an IT Director is facing the gauntlet. ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [September 26, 2010, 4:05pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/31 "2010-09-26T16:05:43Z")
> [@Gukumatz](#): > > > [@TriPolar](#): > > > > This all seems overblown now that the existence of the malware is known. > > Malware for a PC is old hat. Malware for a nuclear plant? That’s just scary. You can bet your sweet ass that somewhere in Washington, an IT Director is facing the gauntlet. Yes, somebody didn’t do their job well. What’s overblown is the fear of disaster now that the problem is known. This is one of the reasons I am wary of the proliferation of nuclear power plants. You can’t rely on people maintaining the standards called for in the allegedly safe designs. But once the malware is detected, removing it shouldn’t be that difficult. It wouldn’t surprise me if Iran is operating above their level of competence, and I’d be happy to see their power plants self-destruct. But once detected, removal of malware should not be a serious problem. It is just software. If you can’t deal with deliberately planted malware, you are just as vulnerable to any accidental glitch in the system. ---
**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\ **Post date:** [September 26, 2010, 4:16pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/32 "2010-09-26T16:16:35Z")
> [@TriPolar](#): > > It is just software. If you can’t deal with deliberately planted malware, you are just as vulnerable to any accidental glitch in the system. It’s not just software. The software re-programs the firmware in dedicated processor chips. ---
**Author:** ![pippo1](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@pippo1](https://boards.straightdope.com/u/pippo1)\ **Post date:** [September 26, 2010, 11:03pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/33 "2010-09-26T23:03:36Z")
> [@GiantRat](#): > > If Iran is saying that they had some measure of compromise because of **stux** , I would … > [@GiantRat](#): > > And you, obviously, don’t know a thing about how this works or how it was deployed. India and Indonesia were similarly affected by **stux**. Just to be accurate with names, **STUX** is an honest Linux Operative System totally unrelated with STUX **NET** malware. ---
**Author:** ![GiantRat](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@GiantRat](https://boards.straightdope.com/u/GiantRat)\ **Post date:** [September 27, 2010, 11:13am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/34 "2010-09-27T11:13:30Z")
> [@Fubaya](#): > > It had four 0-day exploits, stolen certificates, targeted a specific type of computer running specific software that it knew was still vulnerable to a bug that was patched in 2008.. (Quote snipped) Strictly speaking, these weren’t 0-day exploits. They were acknowledged almost a year ago (January, if I recall correctly). I’m amazed at how whiz-bang people are considering this thing; it’s a shotgun blast of mediocre exploits that caught some folks with their pants down. ---
**Author:** ![GiantRat](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@GiantRat](https://boards.straightdope.com/u/GiantRat)\ **Post date:** [September 27, 2010, 11:21am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/35 "2010-09-27T11:21:52Z")
> [@pippo1](#): > > > [@GiantRat](#): > > > > If Iran is saying that they had some measure of compromise because of **stux** , I would … > > > [@GiantRat](#): > > > > And you, obviously, don’t know a thing about how this works or how it was deployed. India and Indonesia were similarly affected by **stux**. > > Just to be accurate with names, **STUX** is an honest Linux Operative System totally unrelated with STUX **NET** malware. Good catch. You caught me being a lazy truncator. :smack: ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [September 27, 2010, 2:59pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/36 "2010-09-27T14:59:05Z")
> [@GiantRat](#): > > > [@coremelt](#): > > > > You obviously didn’t read the original article quoted above. Stuxnet has been written for a specific target, it carefully checks for fingerprints of a specific hardware system and only delivers its payload on that system. It also looks like it spread from a USB key that was planted inside a specific facility using an inside agent. > > And you, obviously, don’t know a thing about how this works or how it was deployed. India and Indonesia were similarly affected by stux. It’s probably safe to guess that some NATO countries were hit, as well, but are not disclosing it because of the SCADA implications. We’re talking about print spooler compromise - a commonly overlooked attack vector. I don’t think I’m following your logic on this one. The vulnerabilities that were exploited required patches from Microsoft and Siemens, what do you think they could have done with respect to “system hardening” to prevent this? ---
**Author:** ![HorseloverFat](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@HorseloverFat](https://boards.straightdope.com/u/HorseloverFat)\ **Post date:** [September 27, 2010, 3:00pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/37 "2010-09-27T15:00:39Z")
> [@](#): > > Strictly speaking, these weren’t 0-day exploits. The two privileged escalations were not previously published anywhere. Note the dates on the advisories: Sept 14th. I know the shortcut link exploit was used and that was recently patched, but this worm predates the patch for this, so when this worm was in the wild it was zero-day. Its coincidental that someone reported the shortcut flaw to MS. I’m not sure about the fourth exploit. [http://www.microsoft.com/technet/security/bulletin/ms10-061.mspx](http://www.microsoft.com/technet/security/bulletin/ms10-061.mspx) [http://www.microsoft.com/technet/security/bulletin/ms10-062.mspx](http://www.microsoft.com/technet/security/bulletin/ms10-062.mspx) ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [September 27, 2010, 3:08pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/38 "2010-09-27T15:08:57Z")
> [@yoyodyne](#): > > > [@TriPolar](#): > > > > It is just software. If you can’t deal with deliberately planted malware, you are just as vulnerable to any accidental glitch in the system. > > It’s not just software. The software re-programs the firmware in dedicated processor chips. Firmware is just software recorded in chips. If it can be changed, it can be unchanged. Numerous reports of malware have turned out be bugs, or corrupted software. Just as with actual viruses, worms, and other creative names for software you don’t want, any critical system should be restorable to a known state. ---
**Author:** ![dzeiger](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@dzeiger](https://boards.straightdope.com/u/dzeiger)\ **Post date:** [September 27, 2010, 3:25pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/39 "2010-09-27T15:25:22Z")
> [@TriPolar](#): > > > [@yoyodyne](#): > > > > It’s not just software. The software re-programs the firmware in dedicated processor chips. > > Firmware is just software recorded in chips. If it can be changed, it can be unchanged. Numerous reports of malware have turned out be bugs, or corrupted software. Just as with actual viruses, worms, and other creative names for software you don’t want, any critical system should be restorable to a known state. Sure. Of course, if the malware is designed to do something like “When the operator requests an increase in coolant flow, actually decrease the flow and suppress the alarms,” restoring the software to a known state may not help as much as you’d like. ---
**Author:** ![Projammer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/projammer/32/559_2.png) [@Projammer](https://boards.straightdope.com/u/Projammer)\ **Post date:** [September 27, 2010, 3:36pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/40 "2010-09-27T15:36:46Z")
A couple of posts suggest an inside person with a flash drive. I’d be more likely to believe a social engineering vector. I can’t find it, but about two years ago I read an article where, as a demonstration, an IT security firm scattered some cheap USB drives around the parking lot and public areas of a company they were working with. On the drives were some pictures and a file named slideshow.exe. The program just reported back to a central location where and when it was ran, but of course the payload could have been far more malicious. Before the end of the week, something like two thirds of the drives had been used on computers inside the company. The earliest software based attack that I know of was in 1982. The [Siberian pipeline sabotage](http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage) refers to the alleged 1982 sabotage of the Soviet Urengoy - Surgut - Chelyabinsk natural gas pipeline by the CIA as a part of a policy to counter Soviet theft of American technology. [Previous page](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976.md?page=1) [Next page](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976.md?page=3)