Stouxnet Research Paper

Ralph Langner’s article on the Stuxnet worm discusses the hardware, distribution and targets of the attack. He also goes into detail regarding the outlook of future attacks and what we can do to prevent them.

Following the US and Israeli Stuxnet attack on Iran’s Nuclear program in 2010, enemy states have been targeting some critical infrastructures and federal government agencies. As the US interest in securing its borders against all threats both domestic and abroad continue to grow, several new threats and vulnerabilities colossus in its cyberspace. In a recent report by Bhattacharyya (2016), “Russian hackers attacked the State Department email system and the Office of Personnel Management reported that 5.6 million Americans’ fingerprints were stolen as

The sheer number of POS machines that were infected in such a short period of time indicated that the malware was probably downloaded on the machines using an automated update process. There is a Dell SecureWorks report that explains how the malware was downloaded on the systems using SCCM (Jarvis & Milletary, 2014). This particular malware had been custom software that was developed to be undetectable when scanned by virus scanners (Krebs, 2014a & Radichel, 2014). We can safely say that malware is certainly the most common threat to any system, including large enterprise wide-area networks, small networks, and home users’ systems. The most common reason for this is that malware is usually designed to infect a system on its own; this means the originator of the malware does not have any direct involvement in the process. This of course makes this type of attack a lot easier to spread using the Internet, and thus much more widespread. (Easttom,

Year Zero began with the detection of the Stuxnet malware, allegedly developed by the United States, who partnered with Israel. This malware was released in order to damage Iranian machines and “mess with Iran’s best scientific minds.” Stuxnet proved that the United States was willing to do whatever it took to develop these forms of offensive capabilities which are needed to “dominate the cyber battlespace.” This attack was used to send Iran’s nuclear program back almost two years. I think that what made Stuxnet dangerous was that it was nearly impossible to detect, developers had “zero days” to fix or patch damage that had already been done. The computers used to transfer the malware were not connected to the Internet, they jumped the “air gap” by allowing the malware to be transferred through portable devices, leading to an even more traumatic cyberattack.

Another occurrence of cyberwarfare and its power lies within the Stuxnet worm, unleashed primarily to attack Iranian industrial programmable logic controllers (PLCs) in the nation’s Nuclear facilities. The Stuxnet worm is typically introduced to its target environment via an infected USB flash drive, and upon being loaded onto a computer running the Microsoft Windows operating system the worm would then seek out Siemens Step7 software. This software will then allow for Stuxnet to control Iranian PLCs, collecting information on industrial systems and causing the fast-spinning centrifuges to tear themselves apart. Stuxnet’s complexity is evident in its three prong approach to infection: It unloads a worm that executes all routines related to the main attack, it executes a link file that automatically activates other copies of the worm on the same network, and it activates its rootkit, which allows it to hide its processes and activity on the local computer as well as the entire computer network. Kaspersky Lab, an international software security group operating in almost 200 countries and territories worldwide, concluded that the attack “is a one-of-a-kind, sophisticated malware attack backed by a well-funded, highly skilled attack team” and that the “attack could only be conducted with nation-state support and backing”. In May 2011, the PBS program Need To Know cited a statement by Gary Samore, White House Coordinator for Arms Control and Weapons of Mass Destruction, in which

The fix to the Malware problem is the implementation of the NIST SP 800-83 regulation. It covers all aspects of malware handling and will assist in mitigating the

A 2011 report by McAfee revealed a five-year history of compromised computer systems that they deemed “Operation Shady RAT”. Operation Shady

In 2004 Shawn Carpenter discovered a series of coordinated cyber raids in what the FBI believed to come from government supported groups in China. Hackers were able to infiltrate several computer networks, including those at NASA, Lockheed Martin, Redstone Arsenal, and Sandia National Laboratories. This is considered one of the biggest cyber-attacks ever.

Two of the common known attacks on computing systems are the deployment of computer viruses and malware.

In his article, Is “Stuxnet” the best malware ever? Gregg Keizer of Computer World says:

Cyber warfare is a battle without causalities, a war waged only by written words, fought digitally by those who are bent at disrupting the infrastructure of a nation built on sweat, labor and concrete. Digital battles that are being fought not for money, not for a simple website defacement proclaiming you are the most ‘l33t hax0r on the interwebs’. One of the most major, yet under reported example of this; a lowly worm named Stuxnet. A worm, by the most mundane of definitions, is a self-replicating program, usually malicious, and whose

To understand the business of malware, one must understand how malware has evolved in the past twenty-five years. Malware, which includes all kinds of malicious software, was originally created to show the weaknesses of computers. The first type of malware, created in 1986, was a virus called “Brain.A. Brain.A was developed in Pakistan, by two brothers - Basit and Amjad. They wanted to prove that PC is not secure platform, so they created virus that was replicating using floppy disks” (Milošević). Even today malware is still used to check the security of machines.

Dmitri Alperovitch, Vice President of Threat Research at cyber security company McAfee, named the attack "Operation Aurora". Research by McAfee Labs discovered that “Aurora” was part of the file path on the attacker’s machine that was included in two of the malware binaries McAfee said were associated with the attack. "We believe the name was the internal name the attacker(s) gave to this operation," McAfee Chief Technology Officer George Kurtz stated.

Kaspersky Lab, a Russian based private equity company, is Europe’s largest software company, providing anti-virus software for individual, corporate and mobile users (Kshetri, 2011). Kaspersky’s product line includes software applications for protecting systems against malware, viruses, worms, Trojans, spyware, adware, and e-mail spam. In addition, KL offers firewall products, consulting, implementation, software development and support services (Kshetri, 2011).

A computer virus is Program or a portion of the codes that enter into the computer to target vandalism and characterized by their ability to copy itself to many copies and their ability to move from place to place and from computer to computer, disappearances and contents cover.