A different way to attack Iran's reactors

A report expected this week from the International Atomic Energy Agency (IAEA) has Israel abuzz with talk of the potential for a pre-emptive strike on Iran's nuclear facilities.

Western diplomats have told CNN that the report says Iran has mastered the critical steps necessary to design and build a nuclear weapon.

Missiles are not, of course, the only way to launch an attack.

Iran's nuclear facilities are under siege from cyber attacks. And one, the Stuxnet virus, was able to penetrate Iran's Natanz nuclear facility, researchers say.

How did it work?
Stuxnet was stealthy. The Natanz computer network is a closed system, separated from any other network or internet access. So, Stuxnet infected a third party first, likely a trusted contractor to the Natanz facility. That contractor may then have unknowingly passed on the virus by plugging in an infected removable drive into the computers inside the Natanz facility.

More importantly, Stuxnet was smart. It knew exactly what it was looking for: A specific software called Step 7 used specifically to run the Siemens controllers operating at Natanz.

Stuxnet spread through the network undetected. If it didn't find the Step 7 software, it left things alone. But once it found its target, Stuxnet set to work.

First, it effectively hijacked the Natanz control system, speeding up or slowing down the centrifuges, wearing them out prematurely.

As the centrifuges destroyed themselves, Stuxnet sent back signals that everything was fine and running smoothly. So, the operators may not have known this was happening until it was too late.

So, just how effective was Stuxnet?

According to the Institute for Science and International Security, IAEA records show that between the end of 2009 and early 2010 about 1,000 centrifuges at Natanz had to be replaced. Stuxnet is the suspected culprit.

Still, that's only about one out of every nine centrifuges and, despite a minor dip in production, uranium enrichment continued apace.

Who created Stuxnet is still a mystery. Many computer security researchers believe the virus is so complex and sophisticated that it would have needed the resources of a nation state -- or a combination of states -- to produce it.

Researchers at internet security firm Symantec say they have identified a new virus called Duqu that they believe is a successor to Stuxnet, although not all security experts agree.

"This is not a copycat," insists Orla Cox of Symantec. "Whoever created this had access to the same source code as Stuxnet."

Cox says Duqu is, at this stage, a malware designed simply to spy and collect information from Iran's computer systems, but she suspects it may be ultimately intended for sabotage.

"It could be that Stuxnet didn't entirely achieve what was wanted the first time around," Cox told CNN.

Duqu was released as late as August 2010, just after the Stuxnet virus had done its damage, stunning many researchers who had not expected to see another virus of the same complexity released so quickly.

Ralph Langner, the German computer security specialist credited with discovering Stuxnet, says it doesn't matter who created Duqu. The problem, he says, is that Stuxnet, in its bid to stop nuclear proliferation, may have sparked its own arms race.

"The first cyberwar weapon is comparable to the first nuclear weapon," he wrote in a blog post recently. "To build the first nuclear bomb, it took a genius like Oppenheimer and the resources of the Manhattan project. To copy the design, it requires just a bunch of engineers -- no genius needed.

Source: CNN