# Was the Stuxnet malware designed to destroy Iran's Bushehr nuclear power plant? **URL:** \ **Category:** Factual Questions\ **Created:** [September 25, 2010, 5:19am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976 "2010-09-25T05:19:25Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![Kevbo](https://avatars.discourse-cdn.com/v4/letter/k/e47774/32.png) [@Kevbo](https://boards.straightdope.com/u/Kevbo)\ **Post date:** [September 27, 2010, 3:49pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/41 "2010-09-27T15:49:41Z")
Following this with interest, as I work in the field of industrial controllers. One of the strong selling points of PLCs vs. general purpose computers is that they have never been the target of malware…until now. In the last decade or so Windows has become reliable enough to use as a human-machine interface (HMI) to these systems. Most still don’t trust it with the actual control, but providing the operators with a spiffy looking graphical interface has been deemed worth the risk, especially if the process can keep running while the HMI is rebooted. It sounds like this was targeted at SCADA computers which are typically yet another layer removed from the actual control system, often only used in monitoring capacity. And yes, you could really do some serious physical damage from the control system. Not all that uncommon for something to get broken during test/debug phase of commissioning a control system…Typically have someone with their finger on the E-stop and still shit happens. ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [September 27, 2010, 4:36pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/42 "2010-09-27T16:36:28Z")
> [@dzeiger](#): > > > [@TriPolar](#): > > > > Firmware is just software recorded in chips. If it can be changed, it can be unchanged. Numerous reports of malware have turned out be bugs, or corrupted software. Just as with actual viruses, worms, and other creative names for software you don’t want, any critical system should be restorable to a known state. > > Sure. Of course, if the malware is designed to do something like “When the operator requests an increase in coolant flow, actually decrease the flow and suppress the alarms,” restoring the software to a known state may not help as much as you’d like. No critical system should be installed without a means of restoring to a proper working state. I don’t contend that this simple method of protection against malware is employed everywhere it should be, but it is very simple. It’s just code. Any system where this can’t be done is as susceptible to bugs and glitchs as it is to malware. ---
**Author:** ![Mr.Excellent](https://avatars.discourse-cdn.com/v4/letter/m/f19dbf/32.png) [@Mr.Excellent](https://boards.straightdope.com/u/Mr.Excellent)\ **Post date:** [September 27, 2010, 5:23pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/43 "2010-09-27T17:23:43Z")
> [@Todderbob](#): > > Possibly some combination of them, the USA and Israel have close enough ties that imagining they worked together on what is probably the single coolest weapon ever invented isn’t beyond the realm of possibility to me. There’s a certain strategic logic to this, as well: the US really, really doesn’t want Israel bombing Bushehr, but Israel is (understandably) very nervous about the prospect of a nuclear Iran. “Hold off on the air raid, and we’ll help you do this the sneaky way,” might not have been a bad option for the US. ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [September 27, 2010, 5:31pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/44 "2010-09-27T17:31:15Z")
> [@Mr.Excellent](#): > > There’s a certain strategic logic to this, as well: the US really, really doesn’t want Israel bombing Bushehr, but Israel is (understandably) very nervous about the prospect of a nuclear Iran. “Hold off on the air raid, and we’ll help you do this the sneaky way,” might not have been a bad option for the US. The problem with this strategy is starting a cyber-war. And we are the most vulnerable to the attacks. It doesn’t take enormous resources to create cyber weapons, which will exceed simple software vandalism. ---
**Author:** ![dzeiger](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@dzeiger](https://boards.straightdope.com/u/dzeiger)\ **Post date:** [September 27, 2010, 8:15pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/45 "2010-09-27T20:15:27Z")
> [@TriPolar](#): > > No critical system should be installed without a means of restoring to a proper working state. I don’t contend that this simple method of protection against malware is employed everywhere it should be, but it is very simple. It’s just code. Any system where this can’t be done is as susceptible to bugs and glitchs as it is to malware. I’m not sure if we’re talking past each other somehow or if I’m not being clear here. If I’m writing malware to target your nuclear reactor, and it’s written in such a way that it interacts with critical reactor systems that causes you to suffer a nuclear meltdown before you realize that you’re infected, I really don’t care that you can restore the control software from backup later–your reactor is a pile of glowing slag. ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [September 27, 2010, 8:24pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/46 "2010-09-27T20:24:54Z")
> [@TriPolar](#): > > This all seems overblown now that the existence of the malware is known. > [@dzeiger](#): > > > [@TriPolar](#): > > > > No critical system should be installed without a means of restoring to a proper working state. I don’t contend that this simple method of protection against malware is employed everywhere it should be, but it is very simple. It’s just code. Any system where this can’t be done is as susceptible to bugs and glitchs as it is to malware. > > I’m not sure if we’re talking past each other somehow or if I’m not being clear here. If I’m writing malware to target your nuclear reactor, and it’s written in such a way that it interacts with critical reactor systems that causes you to suffer a nuclear meltdown before you realize that you’re infected, I really don’t care that you can restore the control software from backup later–your reactor is a pile of glowing slag. Yes, I see, you were only commenting on my last post which was based on the first post above which assumed the malware had been detected, prior to significant damage. Obviously, detection after the horses have left the barn and eaten your children is of little use (unless you have more children). ---
**Author:** ![SmithCommaJohn](https://avatars.discourse-cdn.com/v4/letter/s/ecd19e/32.png) [@SmithCommaJohn](https://boards.straightdope.com/u/SmithCommaJohn)\ **Post date:** [September 27, 2010, 11:30pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/47 "2010-09-27T23:30:39Z")
“The wars of the future will not be fought on the battlefield or at sea. They will be fought in space, or possibly on top of a very tall mountain. In either case, most of the actual fighting will be done by small robots. And as you go forth today remember always your duty is clear: To build and maintain those robots.” It’s happening! ---
**Author:** ![GiantRat](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@GiantRat](https://boards.straightdope.com/u/GiantRat)\ **Post date:** [September 28, 2010, 2:46am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/48 "2010-09-28T02:46:41Z")
> [@RaftPeople](#): > > > [@GiantRat](#): > > > > And you, obviously, don’t know a thing about how this works or how it was deployed. India and Indonesia were similarly affected by stux. It’s probably safe to guess that some NATO countries were hit, as well, but are not disclosing it because of the SCADA implications. We’re talking about print spooler compromise - a commonly overlooked attack vector. > > I don’t think I’m following your logic on this one. The vulnerabilities that were exploited required patches from Microsoft and Siemens, what do you think they could have done with respect to “system hardening” to prevent this? Protecting against known vulnerabilities would be a first step. This wasn’t an attack that came “from the sky.” We knew about it for half a year. Patches can present vulnerabilities, too. ---
**Author:** ![GiantRat](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@GiantRat](https://boards.straightdope.com/u/GiantRat)\ **Post date:** [September 28, 2010, 2:49am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/49 "2010-09-28T02:49:33Z")
> [@HorseloverFat](#): > > > [@](#): > > > > Strictly speaking, these weren’t 0-day exploits. > > The two privileged escalations were not previously published anywhere. Note the dates on the advisories: Sept 14th. I know the shortcut link exploit was used and that was recently patched, but this worm predates the patch for this, so when this worm was in the wild it was zero-day. Its coincidental that someone reported the shortcut flaw to MS. I’m not sure about the fourth exploit. > > [http://www.microsoft.com/technet/security/bulletin/ms10-061.mspx](http://www.microsoft.com/technet/security/bulletin/ms10-061.mspx) > [http://www.microsoft.com/technet/security/bulletin/ms10-062.mspx](http://www.microsoft.com/technet/security/bulletin/ms10-062.mspx) The LNK vuln was disclosed in the June/July period. ---
**Author:** ![Fubaya](https://avatars.discourse-cdn.com/v4/letter/f/c2a13f/32.png) [@Fubaya](https://boards.straightdope.com/u/Fubaya)\ **Post date:** [September 28, 2010, 3:34am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/50 "2010-09-28T03:34:52Z")
> [@GiantRat](#): > > The LNK vuln was disclosed in the June/July period. And the worm was in the wild by then. [Wikipedia](http://en.wikipedia.org/wiki/Stuxnet) has a page up with footnotes to what is probably all the info available so far. They say stuxnet was first reported mid-June but one part contains a build time stamp from February, so it’s likely they were working on it for a while. It also says it was 4 zero day exploits, but who knows if that will hold up. Not sure why it’s important, a single 0-day is pretty boring, using any more than one for nothing but delivery just shows that some pretty slick guys were working on it. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [September 28, 2010, 3:39am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/51 "2010-09-28T03:39:56Z")
> [@GiantRat](#): > > > [@RaftPeople](#): > > > > I don’t think I’m following your logic on this one. The vulnerabilities that were exploited required patches from Microsoft and Siemens, what do you think they could have done with respect to “system hardening” to prevent this? > > Protecting against known vulnerabilities would be a first step. This wasn’t an attack that came “from the sky.” We knew about it for half a year. Patches can present vulnerabilities, too. I’m still not following you. The reason the vulnerabilities were patched was because Stuxnet had been discovered - it had already infected systems. So I still don’t understand what “system hardening” should have taken place prior to the discovery of the malware and the specific exploits it uses? ---
**Author:** ![Khendrask](https://avatars.discourse-cdn.com/v4/letter/k/3e96dc/32.png) [@Khendrask](https://boards.straightdope.com/u/Khendrask)\ **Post date:** [September 28, 2010, 10:58am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/52 "2010-09-28T10:58:27Z")
> [@Kevbo](#): > > Following this with interest, as I work in the field of industrial controllers. One of the strong selling points of PLCs vs. general purpose computers is that they have never been the target of malware…until now. In the last decade or so Windows has become reliable enough to use as a human-machine interface (HMI) to these systems… This isn’t malware attacking the PLC CPUs, it was a targeted, custom attack. The virus on the programming terminals was injecting user-level code into the programs and data blocks downloaded to the physical PLC processor. The processor would then run checking code every 100ms (the ‘user’ OB35 standard timer program block) and look for specific data in data tables, as well as communicate back up to the supervisory system. The attack wasn’t generic at all. The same deployment wouldn’t do anything to any of the hundreds of PLCs or HMI’s. at the site I work at. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [September 29, 2010, 2:01am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/53 "2010-09-29T02:01:43Z")
Latest report: cleaned systems getting re-infected from internal project files that had become infected also. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [September 29, 2010, 3:29pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/54 "2010-09-29T15:29:21Z")
Update: Iran trying to hire outside security experts after attempts to remove failed. [http://www.debka.com/article/9050/](http://www.debka.com/article/9050/) ---
**Author:** ![Kevbo](https://avatars.discourse-cdn.com/v4/letter/k/e47774/32.png) [@Kevbo](https://boards.straightdope.com/u/Kevbo)\ **Post date:** [September 29, 2010, 10:54pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/55 "2010-09-29T22:54:00Z")
> [@Khendrask](#): > > This isn’t malware attacking the PLC CPUs, it was a targeted, custom attack. Yeah, I got that. Not worried about this attack, worried about future ones perhaps not so specifically targeted. ---
**Author:** ![dauerbach](https://avatars.discourse-cdn.com/v4/letter/d/c2a13f/32.png) [@dauerbach](https://boards.straightdope.com/u/dauerbach)\ **Post date:** [September 29, 2010, 10:59pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/56 "2010-09-29T22:59:17Z")
Surprisingly, several news stories have said that this virus sends information to the originators. That doesn’t seem possible, as it seems that the power plant computers would have no way to contact the outside world. Also, from what I read, although the virus can and does propagate to other machines it does not do anything if they are not the power plant. How then do all these other people know that they are infected? ---
**Author:** ![Todderbob](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@Todderbob](https://boards.straightdope.com/u/Todderbob)\ **Post date:** [September 29, 2010, 11:16pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/57 "2010-09-29T23:16:28Z")
> [@dauerbach](#): > > Surprisingly, several news stories have said that this virus sends information to the originators. That doesn’t seem possible, as it seems that the power plant computers would have no way to contact the outside world. > > Also, from what I read, although the virus can and does propagate to other machines it does not do anything if they are not the power plant. How then do all these other people know that they are infected? It wasn’t the power plant that was targeted, according to most independent news agencies it was the centrifuges which process yellow cake (Uranium ore) into “Uranium” (weapons grade, refined uranium). ---
**Author:** ![KarlGauss](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/karlgauss/32/3713_2.png) [@KarlGauss](https://boards.straightdope.com/u/KarlGauss)\ **Post date:** [September 30, 2010, 12:56am UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/58 "2010-09-30T00:56:03Z")
From the DEBKA article: > [@](#): > > Not only have (the Iranians) own attempts to defeat the invading worm failed, but they made matters worse: The malworm became more aggressive and returned to the attack on parts of the systems damaged in the initial attack. > > One expert said: “The Iranians have been forced to realize that they would be better off not ‘irritating’ the invader because it hits back with a bigger punch.” I recognize that “cyberterror” may well lead to rounds of retaliation with everyone coming out the worse for wear. Still, I have to admit that I’m full of admiration for the Israelis; they seem to have pulled off quite the coup. What a brilliant way to prevent a nuclear-armed Iran. 🆒 ---
**Author:** ![Squink](https://avatars.discourse-cdn.com/v4/letter/s/b5e925/32.png) [@Squink](https://boards.straightdope.com/u/Squink)\ **Post date:** [November 19, 2010, 12:42pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/59 "2010-11-19T12:42:15Z")
[Worm Was Perfect for Sabotaging Centrifuges](http://www.nytimes.com/2010/11/19/world/middleeast/19stuxnet.html?_r=1&hp) > [@](#): > > a study released Friday by Mr. Chien, Nicolas Falliere and Liam O. Murchu at Symantec, concluded that the program’s real target was to take over frequency converters, a type of power supply that changes its output frequency to control the speed of a motor. > > The worm’s code was found to attack converters made by two companies, Fararo Paya in Iran and Vacon in Finland. A separate study conducted by the Department of Homeland Security confirmed that finding, a senior government official said in an interview on Thursday. Still: > [@](#): > > “We don’t see direct confirmation” that the attack was meant to slow Iran’s nuclear work, David Albright, president of the Institute for Science and International Security, a private group in Washington that tracks nuclear proliferation, said in an interview Thursday. “But it sure is a plausible interpretation of the available facts.” So, no calls to the ‘Destroy\_Iranian\_Centrifuges(now, **HARD** )’ function, however: > [@](#): > > In a spooky flourish, Mr. Albright said in the interview, the worm ends the attack with a command to restore the current to the perfect operating frequency for the centrifuges — which, by that time, would presumably be destroyed. Gotta balance those parentheses! 😉 ---
**Author:** ![Todderbob](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@Todderbob](https://boards.straightdope.com/u/Todderbob)\ **Post date:** [November 19, 2010, 3:31pm UTC](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976/60 "2010-11-19T15:31:26Z")
> [@Squink](#): > > Gotta balance those parentheses! 😉 Makes sense. More ndifficult to find the worm if you don’t even know what caused the problem. [Previous page](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976.md?page=2) [Next page](https://boards.straightdope.com/t/was-the-stuxnet-malware-designed-to-destroy-irans-bushehr-nuclear-power-plant/554976.md?page=4)