After Stuxnet was discovered over four years ago as one of the most sophisticated and dangerous malicious programs, researchers can now provide insight into the question: what were the goals of the Stuxnet operation?
After analyzing more than 2,000 Stuxnet files collected over a two-year period, experts can identify the first victims of the Stuxnet worm.
Initially security researchers had no doubt that the whole attack had a targeted nature. The code of the Stuxnet worm looked professional and exclusive; there was evidence that extremely expensive zero-day vulnerabilities were used. However, it wasn’t yet known what kind of organizations were attacked first and how the malware ultimately made it right through to the uranium enrichment centrifuges in the particular top secret facilities. A detailed analysis sheds light on these questions.
This is precisely the kind of equipment that is believed to be the main target of Stuxnet. Apparently, the attackers expected that these organizations would exchange data with their clients – such as uranium enrichment facilities – and this would make it possible to get the malware inside these target facilities. The outcome suggests that the plan was indeed successful.
Experts made another interesting discovery: the Stuxnet worm did not only spread via infected USB memory sticks plugged into PCs. That was the initial theory, and it explained how the malware could sneak into a place with no direct Internet connection. However, data gathered while analyzing the very first attack showed that the first worm’s sample (Stuxnet.a) was compiled just hours before it appeared on a PC in the first attacked organization.
This tight timetable makes it hard to imagine that an attacker compiled the sample, put it on a USB memory stick and delivered it to the target organization in just a few hours. It is reasonable to assume that in this particular case the people behind Stuxnet used other techniques instead of a USB infection.
