WikiLeaks logo
The Global Intelligence Files,
files released so far...

The Global Intelligence Files

Search the GI Files

The Global Intelligence Files


RE: FOR COMMENT- type 3- Stuxnet and the Covert War with Iran - 923 w

Released on 2012-10-18 17:00 GMT

Email-ID 1803358
Date 2010-09-24 20:53:11
Couple things

Kevin Stech

Research Director | STRATFOR

+1 (512) 744-4086

From: []
On Behalf Of Sean Noonan
Sent: Friday, September 24, 2010 13:11
To: Analyst List

[please tell me what to cut]


A computer virus that has been spreading on computers primarily in Iran,
India and Indonesia has been engulfed in speculation that it is a cyber
attack on Iran's nuclear facilities. The virus is very sophisticated, in
that it requires specific intelligence on its target, exploits multiple
system vulnerabilities, uses two stolen security certificates, and went
undiscovered for months. While there is no clear evidence of its creator
or even target, this kind of operation would require a large team with
experience and actionable intelligence. That indicates a national
intelligence agency with the panache and capability to create such an
advanced weapon.


The so-called Stuxnet worm came to prominence since Microsoft announced
its concern in a Sept. 13 Security Bulletin. Various experts in the IT
community had been analyzing it for at least a few months beforehand. It's
clear that the worm is very advanced, and would require a large team with
a lot of funding [out of curiosity, why do we think it required a lot of
funding?] and time to produce, as well as specific intelligence on its
target, indicating it was not created by a typical hacker.

On a technical level, it uses four different vulnerabilities to gain
access to Windows systems and USB flash drives. These are called
'zero-day' vulnerabilities, where the zero day is the first knowledge of
their existence. These are very rare and hard to find [well, all security
holes are zero-day at some point. So they're not rare. And they're not
hard to find. A very basic security hole will be zero-day for a period of
time. What they are is hard to keep secret. That's the main point].
Usually when hackers find them, they are exploited immediately, if not
pre-empted by software companies who fix them as soon as they are aware.
While one, it turns out, was found before but not fixed, it would require
a major effort to find and exploit all four. Another advanced technique
is that the worm uses two stolen security certificates to get access to
parts of the Windows operating system.

It also seems to be very specifically targeted to a certain system. It is
looking for a very certain Siemens software system- Siemens' Simatic WinCC
SCADA- combined with an individually unique hardware configuration. SCADA
are Supervisory Control and Data Acquisition systems that oversee a number
of Programmable Logic Controllers (PLCs)which are used to control
individual industrial processes. In other words, Stuxnet targets a
computer operating system that is used to program individual computers
that carry out automated activity in a large industrial facility. When
Stuxnet finds the right configuration of industrial processes run by this
software, a sort of fingerprint, it will supposedly execute certain files
that would disrupt or destroy the system and its equipment. Outside of
its creator, and maybe its victim, no one yet knows what this target is.

VirusBlokAda, a Minsk-based company, first publicly discovered it June 17,
2010 on customer's computers in Iran. Data from Symantec, a major
anti-virus software company, indicates most of the infected computers and
attempted infections have occurred in Iran, Indonesia and India. They
found nearly 60% of the infected computers to be based in Iran. But later
research found that least one version of Stuxnet had been around since
June, 2009.

Given the kind of resources required to create this worm, it would not be
going far to assume it was created by a nation-state. There are few
countries that have the kind of tech-industry base and security agencies
geared towards computer security and operations. Unsurprisingly, the
highest on the list are the United States, United Kingdom, Israel, Russia,
Germany, France, China and South Korea (in no particular order). Media
speculation has focused on the United States and Israel, both of whom are
trying to disrupt the Iranian's nuclear program. A <covert war> [LINK:] has definitely been
going on between the United States, Israel and Iran to try and prevent the
creation of a <deliverable nuclear weapon> [LINK:].
<A conventional war would be difficult, and while options are discussed>
clandestine attempts at disruption can function as temporarily solutions.

But the Stuxnet worm indicates a sort of creativity in operations that few
intelligence agencies have demonstrated in the past. U.S. President Obama
has a major diplomatic initiative to involve other countries in doing what
they can to stop nuclear proliferation in Iran, so it may even be too much
to assume the United States is responsible.

Whoever developed the worm had very specific intelligence on their
target. And if the target was indeed a classified Iranian industrial
facility, that would require reliable intelligence assets, likely of a
human nature, to have the specific parameters for the target. A number of
defections [LINK:]
could have provided this, as well as data from the plants designers or
operators. But the way the worm has been released- design to spread
through networks and flash drives until it finds its target- indicates
that intelligence asset no longer exists.

At this point, data on the virus is incomplete, and there likely will not
be any smoking gun revealing who created it. It very clearly targets an
industrial system using Siemens' programming, but that is all we know. Its
also difficult to tell if the virus has found its target yet- it may have
done so months ago and we are only seeing the remnants spread. It is
designed to shut down vital systems that run continuously for a few
seconds at a time, and if the target was a secret facility the attack may
never be publicized.

Iran has yet to comment on the virus. They may still be investigating to
see where it has spread, and to prevent any future damage. Just as well,
they will try to identify the culprit, who has shown serious panache and
creativity in designing this attack.


Sean Noonan

Tactical Analyst

Office: +1 512-279-9479

Mobile: +1 512-758-5967

Strategic Forecasting, Inc.