Stuxnet: The Future of War Is Here

This may sound like science fiction, but it's not. It’s Monday morning. You’re sitting at work, in your firm’s cafeteria drinking coffee, when suddenly you spot a computer memory stick lying on the floor next to your table. You take it to the IT people, so they can return it to the rightful owner. They pop it into a USB port. . . it’s empty. A month later, your plant explodes. Think I’m exaggerating? I’m not.

With the rush to computerize everything, it was inevitable that the peculiar weaknesses of computers would be exploited for military purposes. For years now, the Chinese have been firing “cyber missiles” at American companies to steal their business secrets. In 2008, we saw Russia take down the internet across Estonia and Georgia with denial of service attacks from millions of infected Western computers; this disrupted government and military communications and spread panic. It is rumored that predator videofeeds can be (or have been) hacked. And we repeatedly hear of attempts to hack the Pentagon.

But those attacks were nothing.

Meet Stuxnet, an incredibly sophisticated computer worm that many are speculating was created by American or Israeli military cyber warriors. This is the future of war, and the first shot has already been fired.

Stuxnet was designed to get onto a computer system from a USB memory stick. . . the one you found in your cafeteria or next to your car or which was dropped into your coat pocket on the subway. Why use this method of transmission? Because most of the control systems that run industrial plants are intentionally isolated from the internet so they can’t be reached by hackers. The USB solution gets around that problem.

Once the memory stick is connected to a computer, Stuxnet exploits one of four separate, previously-unknown holes found in Microsoft Windows to load itself onto any computer into which the USB memory stick is placed (it is unheard of for ordinary hackers to reveal their knowledge of so many holes in one attempt). To achieve this, Stuxnet uses two compromised security certificates stolen from firms in Taiwan. Once it's on the computer, it first tries to find an internet connection. If it finds one, then it contacts a server in Denmark or Malaysia for instructions. If it can’t, then it spreads itself across the network looking for a backdoor to allow remote access.

This level of effort is highly unusual for a normal bit of malware. But what truly makes Stuxnet stand apart is that it was programmed with extensive knowledge of plant control systems manufactured by Siemens, as well as the blueprints of a particular target. What target? It’s not entirely clear (or if it is, no one is saying), but all indications are that Stuxnet was aimed at Iran (60% of the 45,000 infected computers are in Iran), with the Bushehr nuclear reactor and the Natanz enrichment facilities being the likely targets. Iran denies that any damage was done, though when this worm struck last year, the number of working centrifuges at Natanz mysteriously dropped.

So what can be done using such a worm?

Almost everything now runs on some sort of computer system, everything from the stock market to the electrical grid to air traffic control to traffic lights. Stuxnet reveals the potential for cyber attacks to be aimed at specific targets, like a particular electrical plant. Moreover, these attacks can be done without any trace or hint of where they came from. Thus, you could shut down the electrical grid in a country right before an invasion rather than bombing, or you could stop a pesky nuclear enrichment facility, or cut off a fuel supply. . . and it can all be done without anyone know who did it. There are few limits.

And how life-threatening can the damage be?

Well, for example, by tinkering at a nuclear power plant, you could recreate Chernobyl if you had the expertise. Or by shutting down the right valves, you could generate enough pressure to cause a natural gas pipeline to blow itself up. In fact, in 2004, it was claimed that a C.I.A. campaign of computer sabotage in Siberia in the 1980s caused a gas pipeline to explode when “the pipeline software that was to run the pumps, turbines and valves was programmed to go haywire, to reset pump speeds and valve settings to produce pressures far beyond those acceptable to the pipeline joints and welds.” This resulted in a three kiloton explosion, so large it could be seen from space.

Now consider this. So many of the computer chips, the processors, the routers and everything else that we use in every single home, business, and military application today are made in China, often by companies that are owned or controlled by the Chinese military. Who needs to plant a USB stick when your enemy will buy infected gear right out of your hand? Indeed, in a fascinating report some months ago, it was revealed that the Pentagon has turned to chip scroungers to save money when they need old chips, rather than paying to have new ones made. These scroungers typically get the chips from Chinese sources who take them out of old computer gear. In several instances, these chips have been linked to crashes of jet fighters and, in one instance, an aircraft carrier lost its radar system for several hours when some of these chips failed. That’s not very comforting, especially for a military and a country that rely so heavily on technology.

Fortunately, under a new policy, the Defense Department is quietly moving into the business of defending critical US infrastructure from cyber attacks. Specifically, DOD will provide cyber expertise to other government agencies, including Homeland Security, and to certain private companies.

Let’s hope that for once, the government is up to the task.