Stuxnet opens cracks in Iran nuclear program
A politically motivated cyber-attack was recently successful in penetrating the computer defences of governments. Dr Karl pursues the path taken by the computer worm, Stuxnet, as it attacks a uranium processing plant in Iran.
Last time I talked about a very effective computer virus that successfully stuffed around the Iranian nuclear program.
The virus (which is actually more like a worm than a computer virus but let's call it a virus to keep it simple) is called Stuxnet. And even today we don't know who created it.
Firstly, the name. Stuxnet gets its vaguely malevolent name from two files found inside it. The first part, 'stu', comes from the (.stub) file; and the second part, 'xnet', comes from the (MrxNet.sys) file.
Stuxnet was aimed at both the Iranian nuclear power plant at Bushehr, and the uranium centrifuges at the underground site of Natanz. I'll just talk about how and what Stuxnet did to the uranium centrifuges.
First, what are centrifuges, and how are they related to uranium?
Centrifuges are machines that spin very quickly, and throw heavy stuff to the outside.
There's a low-speed centrifuge inside your washing machine that spins and throws most the water off your clothes. If your washing machine didn't have this centrifuge, you'd be hanging your clothes on the line while they were dripping wet.
These uranium centrifuges are about two-metres tall, about 40 centimetres across and spin very quickly indeed, at 1064 revolutions every second.
This is just a little slower than the speed at which they would get damaged.
How are centrifuges related to uranium? Well, suppose you have 1000 grams of uranium. Only seven of those grams are U235, while the remaining 993 grams are U238.
Now U235 is the only variety or isotope of uranium that goes bang. In other words, only U235 can be used in a nuclear weapon or nuclear reactor. But U235 and U238 are chemically identical.
How do you separate them? You combine uranium with the incredibly reactive gas fluorine to make a new gas, uranium hexafluoride. Then you pump this radioactive gas into a centrifuge and spin for week after week after week.
Ever so slowly, the gas with the heavier U238 gradually gets thrown to the outside wall of the spinning centrifuge, while the gas with the not-so-heavy U235 is left behind in the centre.
But this central gas still has a lot of the heavier U238 gas mixed in, so you take out that central gas and feed it into another centrifuge, spin it for a few more weeks or months, and repeat, over and over.
Of course, to be really efficient, a centrifuge has to spin very quickly, so quickly that it's only a few per cent away from self-destruction.
The underground uranium centrifuge plant at Natanz in Iran had some 6000 centrifuges up and spinning by April 2008.
Now these centrifuges were controlled by devices known as PLCs, or programmable logic controllers. A PLC is a kind of dumbed-down micro-computer that has only a few simple jobs. These jobs might be to open or close a valve, or to speed up or slow down a spinning motor, or to switch traffic lights.
PLCs run our world. They control traffic lights, elevators and escalators, water treatment plants, and even the size of the dollop of cream inside your sweet biscuits.
They've been around for ages, they're everywhere and they've never been seen as a security weakness.
So the manufacturers of Stuxnet, and we still don't know who they are, aimed their wicked little worm at the PLCs that ran the uranium centrifuges in Iran.
But the Iranian centrifuge plant was not connected to the Interweb. So the makers of Stuxnet instead sent their virus to five specific domains in Iran, via the Internet.
These domains were somehow associated with the Natanz centrifuge plant. We still don't know who or what these domains were, whether they supplied hardware or software, or if they were contractors such as electricians, plumbers, network specialists, or so on.
But we do know that the Stuxnet virus easily entered the computers at these domains with no trouble at all, because it had four zero-day vulnerabilities and two genuine, but stolen, digital certificates.
And one or more of the workers at one or more of these domains then broke the air-gap rule. He or she took a USB memory stick that they had used at the domain into the uranium centrifuge plant and used it in a computer there.
Stuxnet was now inside the computers that controlled the ultra-high-speed centrifuges that, in turn, separated out the desirable Uranium–235, the only isotope of uranium that is used in nuclear weapons or power plants.
So next time, I'll talk about how Stuxnet caused a nuclear accident in the uranium centrifuge plant.
Published 26 October 2011
© 2019 Karl S. Kruszelnicki Pty Ltd