News

Stuxnet Is Not Superworm, Researcher Says

An analysis of the Stuxnet worm shows it to be a combination of sophisticated and flawed work, most likely the product of a partnership between several entities with varying levels of expertise and resources.

That is the conclusion cybersecurity researcher Tom Parker, director of security consulting services at Securicon, made at the Black Hat Federal Briefings in Arlington, Va., today. Parker said descriptions of Stuxnet as the most advanced piece of malware ever discovered are "massive overstatements."

"If there is anyone who thinks this is a game changer, they have probably already lost the game," he said.

That is not to say that Stuxnet is not sophisticated and dangerous. Parker said Iran's uranium enrichment program was "without reasonable doubt" the worm's target and that the program probably was disrupted by damage to its hardware. But, "the fact that we are talking about it now shows that the developers failed to some extent."

Stuxnet, first publicly revealed in July, is a highly targeted attack that escaped into the wild to become one of the most closely scrutinized pieces of malicious code. Allthough much is known about it, much still remains to be learned, and it illustrates the current capabilities and limitations of cyber forensics, which can help to identify the developer and/or attacker. Although analysis of the code, functionality and processes of malware is possible, that remains an emerging science.

"There is a lot of gut instinct, but not a lot of science, at least in the public domain," Parker said. "There still is too much speculation and finger pointing."

Although it is not always possible — or necessary — to identify a specific person or other entity as the author of malware, knowing where it comes from and what its purpose is can help in determining how to defend against it and respond to it. This problem of attribution is particularly important in the emerging arena of cyberwar, in which knowing who the enemy's identity is critical to a response.

Tools and methods of analyzing malicious code need to be automated to deal with the growing volume of malware being discovered, so that risks can be prioritized and response policies properly applied.

A lot of very good work has been done on analyzing Stuxnet, Parker said, yet seven months after its discovery, a lot remains unknown. The leading theory is that it is the work of a nation state, probably Israel or the United States, and was intended to target Iran's program for enriching uranium. Parker said his work suggests this might not be true, at least completely.

The level of expertise and the skills needed to successfully target specific equipment makes it "very unlikely" that Stuxnet was developed by an individual or a small organization, Parker said. At the same time, some implementations in the work, such as the command and control channel it uses, are simplistic and unprotected, making it unlikely that it is the work of a Western nation with a great deal of technical expertise. The worm also escaped into the wild, which was almost certainly not intended.

And the worm did not rely exclusively on zero-day exploits to infect systems and rewrite code. "There were a lot of things in Stuxnet that people were calling zero-day but are not," Parker said. Three of seven exploits used by the worm turned out to have been for vulnerabilities known for one or two years, and one did not exploit a vulnerability, but a feature of Microsoft software. Three exploits were original to Stuxnet.

The combination of sophistication and simplicity suggests that much of the sophisticated work was outsourced to a party with expertise and resources. Targeting the specific controllers used in Iranian nuclear facilities required good human intelligence as well as access to regulated hardware for a testbed. Flawed implementation, on the other hand, suggests that it was used by a partner with less expertise. We might never know who those parties are, Parker said.

This does not mean that Stuxnet isn't significant. It was slick and clever and its exploits were well selected, and it could have been worse, Parker said. "The command and control could have not sucked," which would have made it much less likely to have been discovered, and then we would know nothing at all about it.

About the Author

William Jackson is the senior writer for Government Computer News (GCN.com).

comments powered by Disqus

Reader Comments:

Thu, Jan 20, 2011 Dan Iowa

This guy is missing the point. Stuxnet is a game changer, but not because it use a certain kind of vulnerability. It's a game changer because it shows the reality of cyber warfare; something that I still see debated. It shows that it's possible to attack something that is not even connected to the internet, and have that attack succeed. It shows that attackers may not just be trying to take out your bank account or share music files, but might be going after something like a nuclear power plant or the power grid. Whether or not zero day exploits were used is irrelevant to those points; and the use of a zero day exploit would not be news.

Wed, Jan 19, 2011

Mr. Parker then obviously did not know that the US was in possession of a complete uranium enrichment line identical in product but smaller in scale that we got from Libya as a result of their renouncing WMDs. So testing was easy, and the Seimens Step 7 controllers are COTS product, as were the VFD's that controlled the centrifuge motors. So it's not as if this was developed in the dark with a hope of working, the US had complete and unfettered access to identical hardware for test purposes. Assuming, of course, that the US did it. But we did publicly state we moved the Libyan uranium enrichment system to Idaho National Labs, and Inel is the DOE's premier facility for SCADA systems research and hardning efforts. From the New York Times: http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html?emc=eta1

Wed, Jan 19, 2011

this is the one they found. Maybe it was the .01 version. The 1.0 version is out there and has not been detected.

Wed, Jan 19, 2011 Salsa20Lover crypto

This guy is wrong, Stuxnet is a game changer. Its incredibly complex, and it dawns in a new era of weaponized code. How could one not think this is a game changer? has this been done before?

Add Your Comment Now:

Your Name:(optional)
Your Email:(optional)
Your Location:(optional)
Comment:
Please type the letters/numbers you see above

Redmond Tech Watch

Sign up for our newsletter.

I agree to this site's Privacy Policy.