In June 2009 a complex computer virus began to circulate. It wasn't widely recognised, and didn't seem to do much damage. It is now evident that that was an early variant of what came to be known as the Stuxnet worm. By March 2010 an updated version had appeared that was able to propagate more effectively; the third version appeared a month later with some further, minor upgrades.

Stuxnet is unusual in that although it spreads quite easily (due to its ability to exploit more vulnerabilities than any other malware) it does not damage most computers. If the infected system does not meet a very exact set of configuration requirements the virus will not do any harm and will probably go unnoticed. The worm is the first malware (that we know of) that actively sabotages industrial systems. It is also the first to include a programmable logic controller (PLC) rootkit. Stuxnet is carefully targeted to only damage systems that use a Windows operating system; use Siemens PCS 7, WinCC and STEP7 industrial software applications for Windows; and operate one or more Siemens S7 PLCs. This is extremely specific and there are very few systems around the world that the virus could impair.

Iran's Natanz uranium enrichment facility has suffered from a number of setbacks over the last two years, and it just so happens that the installation uses the exact software configuration given above. The effect of the virus is to stop electric motors from shutting down. This was proven by Liam O'Murchu from Symantec, who have analysed Stuxnet, at a conference in 2010; in his demonstration he attached a motor to his computer and programmed it to run for 15 seconds. When the program was run using Stuxnet-infected software the motor continued running indefinitely. There is a significant lack of clarity over Iran's nuclear activities, and it is widely supposed (although denied by Iran) that the nation is pursuing a military nuclear agenda. As such, details about the exact problems are hard to establish, but the timeline would suggest that Stuxnet was to blame.

Experts from the Finnish antivirus firm F-Secure have also suggested that the (or at least a) purpose of the virus was to undermine North Korea's fledgling nuclear weapons initiatives.

Another Chernobyl?
When the news first came out on 23 November 2010 that PLCs at Iranian nuclear facilities had been infected, the media was full of scare stories warning that Iran could be home to 'another Chernobyl'. The Iranians, by contrast, announced that not only was Stuxnet not a problem, but that there were no problems at all and that the media reports were just western propaganda. In truth, a nuclear accident in Iran (at least one caused by Stuxnet) is highly unlikely, regardless of anybody's rhetoric. The Iranians are not stupid, and they know about Stuxnet. They will be extremely careful not to run infected software, even if it means inventing a different reason to explain delays in their projects.

No-one has claimed responsibility for the construction of Stuxnet, but certain features of the virus indicate that it must have had state backing. Its size and complexity are unprecedented, far beyond anything previously seen. This suggests resources not available to hackers responsible for most viruses. Also, the fact that the targeting of the virus was so specific means that the programmers had to have detailed knowledge of the control systems at the Natanz facility. It has been widely speculated, including by experts like Ralph Langner who first identified the fact that Stuxnet infects PLCs, that the malware was the product of a collaboration between the US and Israel, two of Iran's biggest critics; indeed the conspiracy theory blogs are bulging with references to 'Zionist' words hidden in the code. An article in The New York Times in January this year made the case for the US/Israeli construction. But in fact there is little hard proof to say who built it. In many ways it is irrelevant. The real threat is that Stuxnet has set a new precedent for conflict. There have been state level cyber-attacks before (or at least via proxies); Russian hackers have attacked both Georgia and Estonia in the past, but they were 'traditional' Distributed Denial of Service (DDoS attacks) in which websites and servers are inundated with more information than they can cope with.

Cyber-warfare provides states and organisations with 'bloodless' ways to attack their enemies, and the burgeoning number of hackers around the world creates the ideal camouflage. The loose association of hackers known as Anonymous, formed in 2003, has been responsible for a large number of controversial DDoS attacks since 2008. It is more likely that this group will grow than disappear, and that their techniques will get more sophisticated; having access to variants of a tool such as Stuxnet, the code for which is now posted openly on hacker websites, could make their attacks more effective. Buried within Anonymous's membership (such as it is) are likely to be a few individuals pursuing more malevolent agendas, and they are going to be extremely hard to spot. As Michael J Assante, former chief security officer at the North American Electric Reliability Corporation, told The Washington Post, “Quite honestly you've got a blueprint now, a copycat may decide to emulate it, maybe to cause a pressure valve to open or close at the wrong time. You could cause damage, and the damage could be catastrophic."

What to do?
It is important that IT departments do not adopt a 'we always know best' approach to security. In 2009 two hospitals in the UK, one in Sheffield and one in Whipps Cross in London, had system meltdowns due to infection with the Conficker computer virus. The hospitals' IT departments had decided to avoid installing certain updates, deciding that they were unnecessary, and this allowed the virus to penetrate. This is a particularly apt example. Mikko Hypponen, F-Secure's Chief Research Officer, believes that Stuxnet could very well be derived from the Conficker worm. In January this year he told USA Today that he thinks Conficker could even have been the beta-test version of Stuxnet. Conficker was noisy and focused randomly on home and corporate desktop PCs. By contrast, Stuxnet is stealthy and aimed primarily at large factory systems, but uses the same exploit. It is possible that Conficker was used to map network ranges that could be used in Stuxnet attacks.

At this point the best most people can do is to be alert to the dangers. Staying up-to-date with anti-virus solutions and security updates is essential, not only at a personal level but at an organisational level. Being afraid of change will not be productive; technology will continue to develop, and the tools available to hackers will evolve too. Investment in cyber-security is not wasted money.