Israel Matzav

Wednesday, November 17, 2010

Confirmed: Stuxnet meant to attack Iranian nuke plants

On Sunday, I reported on a Symantec simulation (that took place on Friday) that indicated that it was highly like that the Stuxnet worm was designed with Iranian nuclear plants specifically in mind. That research was confirmed on Sunday by a German laboratory (Hat Tip: Daily Alert).

Independently, Langner Communications of Germany, on Sunday also discovered that another part of the worm's attack code is configured in a way that would match the structure of a turbine control system for steam turbines used in power plants, such as those installed at the Bushehr nuclear power plant in Iran. Langner also confirmed that the worm appears to attack key components of centrifuges.

Ivanka Barzashka, a research associate at the Federation of American Scientists, said the Symantec findings, "if true, are very significant."

In an e-mail, Barzashka wrote that the targeted frequency range, from 807 megahertz to 1210 megahertz, "is consistent with the operational frequencies of gas centrifuges used for uranium enrichment. Centrifuges are delicate pieces of equipment. There is a huge incentive for pushing the machines to operate at the maximum speed allowed by the materials they are made of. In addition, before they reach their maximum operating speeds, centrifuges have to traverse certain 'critical frequencies' at which they encounter resonance and can fly apart."

"Rigging the speed control is a very clever way of causing the machines to fly apart," she added. "If Symantec's analysis is true, then Stuxnet likely aimed to destroy Iran's gas centrifuges, which could produce enriched uranium for both nuclear fuel and nuclear bombs."

Following the discovery of the Stuxnet virus, analysts said it was likely the creation of a sophisticated entity, namely a government agency. Speculation centered on the United States or Israel as the most likely originators of the worm.

We have no comment. Heh.

Labels: Iranian nuclear program, Langner Communications, Stuxnet, Symantec

Sunday, November 07, 2010

Wow - More than 30 programmers built Stuxnet worm

Expert analysis of the code from the Stuxnet worm, the computer worm that interfered with Iran's development of nuclear weapons, has concluded that some 30 programmers were involved in writing code for the worm (Hat Tip: Instapundit).

At a small conference on cybersecurity sponsored by TechAmerica, Symantec's Brian Tillett put a number on the size of the team that built the virus. He said that traces of more than 30 programmers have been found in source code.

Another tidbit that I hadn't seen reported elsewhere is that the peer-to-peer network built into the worm was encrypted. And not only was it encrypted, Tillett noted, but encrypted to FIPS 140-2 standards, which -- judging by the noise of the crowd -- is very impressive to security geeks.

Gee, you think there's a government behind that? Hmmm.

Labels: FIPS 140-2, Iran, nuclear weapons, Stuxnet, Symantec