Stuxnet - The standard malware, if not unusually sophisticated!

Symantec has issued a dossier on Stuxnet depicting ins-outs of the malware, who were the targets & what was the objective.
According to Symantec, Stuxnet targets specific frequency converter drives ( only frequency drives from two companies that are running at high speeds – between 807Hz and 1210Hz.) — power supplies that are used to control the speed of a device, such as a motor. The malware intercepts commands sent to the drives from the Siemens SCADA software, and replaces them with malicious commands to control the speed of a device, varying it wildly, but intermittently.


The malware, however, doesn’t just sabotage any frequency converter. It inventories a plant’s network and only springs to life if the plant has at least 33 frequency converter drives made by Fararo Paya in Teheran, Iran, or by the Finland-based Vacon.

Exerpts from Symantec.
The new key findings are:

• We are now able to describe the purpose of all of Stuxnet’s code.
• Stuxnet requires particular frequency converter drives from specific vendors, some of which may not be procurable in certain countries.
• Stuxnet requires the frequency converter drives to be operating at very high speeds, between 807 Hz and 1210 Hz.  While frequency converter drives are used in many industrial control applications, these speeds are used only in a limited number of applications.
• Stuxnet changes the output frequencies and thus the speed of the motors for short intervals over periods of months.  Interfering with the speed of the motors sabotages the normal operation of the industrial control process.
• Stuxnet’s requirement for particular frequency converter drives and operating characteristics focuses the number of possible speculated targets to a limited set of possibilities.

The malware appears to have begun infecting systems in January 2009. In July of that year, the secret-spilling site WikiLeaks posted an announcement saying that an anonymous source had disclosed that a “serious” nuclear incident had recently occurred at Natanz.Statistics from 2009 show that the number of enriched centrifuges operational in Iran mysteriously declined from about 4,700 to about 3,900 beginning around the time the nuclear incident WikiLeaks mentioned would have occurred.

Researchers who have spent months reverse-engineering the Stuxnet code say its level of sophistication suggests that a well-resourced nation-state is behind the attack. It was initially speculated that Stuxnet could cause a real-world explosion at a plant, but Symantec’s latest report makes it appear that the code was designed for subtle sabotage. Additionally, the worm’s pinpoint targeting indicates the malware writers had a specific facility or facilities in mind for their attack, and have extensive knowledge of the system they were targeting.

Here's a video demonstration by Symantec.





REFERENCES:
http://www.wired.com/threatlevel/2010/11/stuxnet-clues/
http://www.symantec.com/connect/blogs/stuxnet-breakthrough