Stuxnet analysis by Langner

In the summer of 2010, a malware of unprecedented complexity made the news. It used multiple zero-day exploits, and was dubbed “Stuxnet” by anti-virus companies. Even though it proved to be the most sophisticated piece of malicious code known to man, nobody had a clue what its purpose was. The simple reason: All IT security experts were looking in the wrong direction. Stuxnet didn’t act like any previous malware before. Its objective was not the theft or manipulation of data. It was the physical destruction of gas centrifuges in the Natanz fuel enrichment plant, the crown jewel of Iran’s nuclear program.

Once that rumors emerged that Stuxnet could be targeting industrial control systems, our team downloaded a copy of the malware and started an analysis that ultimately spanned three whole years. During the course of this analysis, we:

– identified that Stuxnet was a targeted cyber-physical attack, aimed at one specific, unique target
– identified that this target was the Iranian nuclear program (something that nobody wanted to believe — for months)
– analyzed the exact details of how this attack, or more accurately: these two attacks, were intended to work.

Stuxnet Technical Deep Dive at S4x12