In a July presentation for members of the computer media, Roel Schouwenberg, a senior anti-virus researcher for Kaspersky Lab, laid out details about the Stuxnet worm. This worm exploits an unusual number of different security weak spots and it seems in particular to attack SCADA (Supervisory Control and Data Acquisition) systems. SCADA systems are used to manage large facilities such as oil rigs, factories, and nuclear reactors. Schouwenberg noted that SCADA computers often run older operating systems without security protection or regular updates.
The presentation included a map of the worm's prevalence. Most of the world's countries displayed a peaceful green, meaning low prevalence, but Iran and Indonesia glowed a bright, warning red. Schouwenberg observed that the worm is so polished and complex it must have required a lot of resources, suggesting it was created by a nation-state.
More recently Ralph Langner, a security researcher and expert in SCADA systems, performed a forensic analysis of the worm in action. He concluded that the worm's purpose is sabotage and suggested that the sabotage may have already taken place at Iran's Bushehr reactor. Given the nature of the attack and the multiple vulnerabilities it exploits, Langner concluded it must have been released by a nation-state.
Stu Sjouwerman, a consultant with Sunbelt Software, raised the stakes, stating in the company's newsletter that the worm must have been created by the United States or Israel to attack Iran's nuclear infrastructure. "Governments have cyberwar capability and this is the equivalent of artillery," said Sjouwerman. "It looks like Iran is completely pwned."
Malware experts at Symantec and F-Secure, among others, have confirmed many facts about Stuxnet. The worm is vastly more prevalent in Iran than in the rest of the world, with additional "hot spots" in Pakistan and Indonesia. It definitely targets SCADA systems. It hides from view using rootkit techniques. And it exploits an unprecedented number of vulnerabilities to reach its target systems.
The world's news agencies are taking note. A ComputerWorld reporter called it "the best malware ever." BBC News on Thursday reported as fact that the Stuxnet worm "targeted high-value Iranian assets."
Is this the first salvo of a cyber war against Iran? Is the attack already over? Certainly once the Stuxnet worm is fully analyzed its effectiveness will be diminished. Symantec researcher Liam O'Murchu won't draw firm conclusions yet but O'Murchu and researchers from Kaspersky Lab plan presentations on Stuxnet at the Virus Bulletin 2010 conference in Vancouver next week.