Stuxnet is not Superworm, researcher says

Worm is sophisticated, but also has flaws

An analysis of the Stuxnet worm shows it to be a combination of sophisticated and flawed work, most likely the product of a partnership between several entities with varying levels of expertise and resources.

That is the conclusion cybersecurity researcher Tom Parker, director of security consulting services at Securicon, made at the Black Hat Federal Briefings in Arlington, Va., today. Parker said descriptions of Stuxnet as the most advanced piece of malware ever discovered are “massive overstatement.”

“If there is anyone who thinks this is a game changer, they have probably already lost the game,” he said.

That is not to say that Stuxnet is not sophisticated and dangerous. Parker said Iran’s uranium enrichment program was “without reasonable doubt” the worm’s target and that the program probably was disrupted by damage to its hardware. But, “the fact that we are talking about it now shows that the developers failed to some extent.”


Related stories:

Stuxnet reveals vulnerabilities in industrial controls

'One of a kind' Stuxnet worm remains a serious mystery


Stuxnet, first publicly revealed in July, is a highly targeted attack that escaped into the wild to become one of the most closely scrutinized pieces of malicious code. Allthough much is known about it, much still remains to be learned, and it illustrates the current capabilities and limitations of cyber forensics, which can help to identify the developer and/or attacker. Although analysis of the code, functionality and processes of malware is possible, that remains an emerging science.

“There is a lot of gut instinct, but not a lot of science, at least in the public domain,” Parker said. “There still is too much speculation and finger pointing.”

Although it is not always possible — or necessary — to identify a specific person or other entity as the author of malware, knowing where it comes from and what its purpose is can help in determining how to defend against it and respond to it. This problem of attribution is particularly important in the emerging arena of cyberwar, in which knowing who the enemy’s identity is critical to a response.

Tools and methods of analyzing malicious code need to be automated to deal with the growing volume of malware being discovered, so that risks can be prioritized and response policies properly applied.

A lot of very good work has been done on analyzing Stuxnet, Parker said, yet seven months after its discovery, a lot remains unknown. The leading theory is that it is the work of a nation state, probably Israel or the United States, and was intended to target Iran’s program for enriching uranium. Parker said his work suggests this might not be true, at least completely.

The level of expertise and the skills needed to successfully target specific equipment makes it “very unlikely” that Stuxnet was developed by an individual or a small organization, Parker said. At the same time, some implementations in the work, such as the command and control channel it uses, are simplistic and unprotected, making it unlikely that it is the work of a Western nation with a great deal of technical expertise. The worm also escaped into the wild, which was almost certainly not intended.

And the worm did not rely exclusively on zero-day exploits to infect systems and rewrite code. “There were a lot of things in Stuxnet that people were calling zero-day but are not,” Parker said. Three of seven exploits used by the worm turned out to have been for vulnerabilities known for one or two years, and one did not exploit a vulnerability, but a feature of Microsoft software. Three exploits were original to Stuxnet.

The combination of sophistication and simplicity suggests that much of the sophisticated work was outsourced to a party with expertise and resources. Targeting the specific controllers used in Iranian nuclear facilities required good human intelligence as well as access to regulated hardware for a testbed. Flawed implementation, on the other hand, suggests that it was used by a partner with less expertise. We might never know who those parties are, Parker said.

This does not mean that Stuxnet isn't significant. It was slick and clever and its exploits were well selected, and it could have been worse, Parker said. “The command and control could have not sucked,” which would have made it much less likely to have been discovered, and then we would know nothing at all about it.

 

About the Author

William Jackson is freelance writer and the author of the CyberEye blog.

Reader Comments

Tue, Jan 25, 2011 Cyber Princessa

A second reference to Mssr Rockwell SCADA Owner regarding your lament of "no prevent strategies." There are several automated technologies (IBM, HP and others have acquired them) that scan the source code of software to find the "holes" in code that are exploitable by hackers et al. Hardening the software layer of critical systems is the key. Finding the vulnerabilities is an easy button - getting the company's, agencies,and more importantly software developers to actually fix the vulnerabilities that they find is the challenge. Congress just passed a law in the Dept of Defense to make them start doing just that. Time will tell - but have hope - there are ways to make it much more difficult to attack a system. Today most of our Government systems are sitting ducks.

Fri, Jan 21, 2011 Mike aRLINGTON

I'm wondering what the software looks like for the worm's we wern't supposed to find. We've been doing this stuff since the early 80's, read the Farewell Dossier. Does anyone really think we don't know what's going on with Iran, do I really have to say, there are no secrets. We can run IP over powerlines right? So, do we really need a modems? Smart Grid indeed!

Thu, Jan 20, 2011 DEFENDER OF THE FREE WORLD

The gentlemen from Florida's comments are misguided... Iran looks for ways to attack the West & Israel all the time by doing such things as providing bomb materials and weapons to Hezbollah, IEDs to insurgents in Iraq and Afghanistan, and other subversive activities. Why would you think this action would have some sort of effect on that? They already do those things as much as they can, so you think now they will be doubly angry and intensify their actions? Anything that sets their nuclear program back or hinders their military is a win win situation regardless if a 17 year old hacker (unlikely in this situation) or a nation state develops and deploys the virus to attack their infrastructure.

Thu, Jan 20, 2011 Ken Orr USA

The Rockwell SCADA owner is spot on. Beyond the issue of protecting our current SCADA sysetms, how do we design a Smartgrid that is impervious to this kind of attack?

Thu, Jan 20, 2011 Cyber Ninja

A Manuel: when and if they recover the process and equipment, and resume production, there will always remain the military option to destroy the plant. I am certain that IAEA, the Isrealis and others won't let that bomb get built.

Show All Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above