incident · 1276732800000

Stuxnet Discovery

Security researchers discovered Stuxnet, a highly sophisticated computer worm designed to sabotage Iran's nuclear enrichment facilities by targeting specific industrial control systems.

What happened

In June 2010, a Belarusian security firm discovered a complex piece of malware, later named Stuxnet. Subsequent analysis revealed it was a highly targeted worm designed to infiltrate Iranian nuclear facilities, specifically the Natanz enrichment plant. Stuxnet altered the speeds of centrifuges, causing them to tear themselves apart while feeding false telemetry to operators to hide the sabotage.

Technical mechanism

Stuxnet utilized multiple zero-day vulnerabilities (including Windows print spooler and LNK file parsing flaws) to spread via USB drives and local networks. It specifically targeted Siemens Step7 software and programmable logic controllers (PLCs) used in industrial control systems, modifying the PLC code to manipulate connected machinery.

Why it matters

Stuxnet is widely considered the first cyberweapon, demonstrating that malware could cause physical destruction to critical infrastructure and ushering in a new era of cyber warfare.

Impact

Stuxnet reportedly destroyed roughly 1,000 IR-1 centrifuges at the Natanz facility, significantly delaying Iran's nuclear program. It fundamentally changed the global perception of cyber threats to critical infrastructure.

Response

Security vendors analyzed the malware and released removal tools. Microsoft patched the exploited zero-day vulnerabilities. Industrial control system vendors began emphasizing cybersecurity.

Defensive lessons

  • Air-gapped networks can be breached via physical media.
  • Industrial control systems require dedicated security monitoring and protection.
  • The threat of destructive cyber-physical attacks is real.

Evidence register

  1. Symantec — W32.Stuxnet Dossier (verified)