Stuxnet

I start the evidence there, because it is the fact most people in this field would get wrong if asked cold, and for years I would have gotten it wrong too. Stuxnet, the worm reported in June 2010 that rewrote the logic on Siemens controllers driving high speed motors, is routinely described as an American and Israeli operation. That may be accurate. It comes from reporting built on officials who did not give their names. It does not come from any government. In sixteen years there has been no declassification, no official statement, no indictment, no sanctions designation, and no court finding that says who built it, who authorized it, or who put it where it went.

The only government on the record about Stuxnet at all is the victim's. On 29 November 2010 Iran's president told a press conference, as the wire services translated him, that "they succeeded in creating problems for a limited number of our centrifuges with the software they had installed in electronic parts." He named no worm, no facility, and no author.

A guilty plea is sometimes offered as the missing confirmation. In October 2016 a retired American general pleaded guilty to making false statements to federal investigators during a leak inquiry. The Justice Department's announcement describes classified information, two reporters, and a particular country. It does not contain the word Stuxnet, or Iran, or cyber. A plea to lying about conversations is not a plea to anything those conversations contained.

What can be shown

What can be shown is more than you might expect. The code is public, and the people who took it apart published their work. Symantec's dossier documents a worm that spread through four Windows vulnerabilities nobody had patched, reached Siemens engineering software, and loaded code onto particular controllers that looked for frequency converter drives from two named manufacturers running between 807 and 1,210 hertz. When it found them, it pushed the drives to 1,410 hertz, then down to 2, then to 1,064, and hid the change from the engineering station. By 29 September 2010 Symantec had counted about 100,000 infected hosts, roughly 60 percent of them in Iran.

That is the machine. For the hall, we have inspectors and a think tank. The International Atomic Energy Agency counts cascades at Iran's enrichment plant as part of its safeguards work. In December 2010 the Institute for Science and International Security read those counts, found centrifuges disconnected in eleven of the eighteen cascades in one module, and concluded that in late 2009 or early 2010 Iran decommissioned and replaced about 1,000 IR-1 centrifuges. Then it hedged its own finding, in the same report: "Although Stuxnet is a reasonable explanation for the apparent damage to module A26, questions remain about this conclusion."

That sentence is the most careful thing ever written about Stuxnet, and it is almost never quoted.

What is believed

Now set that record beside what is commonly said.

The famous number is 984. It is six groups of 164 in the attack code, the layout one targeted controller addresses. It describes the weapon, not the damage. In February 2011 the Institute recorded it as a media figure, noting that Iran had not provided such a number and that the inspectors did not appear able to make so precise an estimate. It called 984 plausible because it sits close to the Institute's own figure. Plausible and close is where the record ends. Nobody has published a count of 984 broken machines.

"A fifth of Iran's centrifuges" does not match the one estimate that exists; the Institute put its 1,000 at over ten percent of the peak number installed at the plant. "Set Iran back two years" traces to no technical document at all, and the same Institute concluded that Stuxnet did not lower Iran's production of low enriched uranium during 2010. The inspectors' reports record Iran's own estimate of its total low enriched uranium production rising through the period, from about 2,065 kilograms at the end of January 2010 to about 3,606 in early February 2011. Enrichment continued.

The engineer whose analysis did most to explain the attack, Ralph Langner, called it "a low-yield weapon with the overall intention to reduce the lifetime of Iran's centrifuges." He was arguing against the catastrophic story. Coverage routinely cites him in support of it.

Then there is the thumb drive in the parking lot, the image that carries most retellings. It has no primary source. When Kaspersky's researchers traced the earliest infections to five Iranian industrial companies, they found the first recorded infection by the 2009 variant a few hours after the file was compiled, an interval they wrote "almost completely rules out infection via USB drive." How the worm crossed into the enrichment hall itself is on no public record. Symantec, which did as much work as anyone, said only that the original infection "may have been introduced by removable drive." May have been.

So Stuxnet survives the test. The myth does not. The worm is real, what it was built to do can be read from its code, and Iran's own president said software caused problems with its centrifuges. Who sent it, how it got in, and what it cost Iran are believed, sometimes on good grounds, and are not shown.

The method

That split between what can be shown and what is believed is the method of this book, and I would rather show it than announce it.

Primary sources outrank secondary coverage. A filing, a government advisory, a court record, a victim's statement, or a responder's own report outranks the article that summarized it. Coverage is evidence of what was said. It is never, on its own, evidence of what happened. A claim that rests on one outlet, or on unnamed sources, or on one vendor's assessment, stays labeled as reported however often it is repeated, because one article copying another is not two sources. Quotations appear in full, hedges included.

But primary means authoritative as to what was said, never as to what was true. Iran's statement is the primary record of what its president chose to say about damage. It is not a centrifuge count. Symantec's dossier is primary on what the code does and openly tentative on how it arrived. We read each source for exactly what it can carry, and no further.

Where the record is silent, the silence is the story. Sixteen years without an acknowledgment is not a gap to fill with the likeliest name. It is the finding. And consistent with is not confirmed. A code structure that matches a cascade layout, and disconnected centrifuges in an inspection report, are consistent with sabotage at that plant. Together they are strong. They are still an inference, and the people who drew it said so.

The same discipline governs names. A leak site or a ransom note gets "claimed by." "Attributed to" is reserved for a government document or a vendor assessment that states its confidence, and we name the body doing the attributing. Stuxnet has neither. Nobody has claimed it and no government has attributed it.

How to read an entry

Every entry carries the same rail down its left side, in three colors, and the colors are a claim about evidence. Tan is what is established: when it was discovered, the sector, the systems reached, the scale. Red is what is claimed: how the attacker got in, who the attacker was, the root cause, the malware. Charcoal is consequence and reference: what stopped, what it cost, what happened to the process, and which entries to read alongside it.

A field nobody has ever stated reads Undisclosed, and Undisclosed sits in red, because an unknown is not a fact. We never drop a field to make an entry look complete, so some pages will show you a slab of red before you read a word. That is the design doing the editorial work. Every entry also carries a section called What Is Not Known, which is never left out, and beneath every entry is a line called Soft Spots. It repeats every place the entry leans on an inference, ours included and labeled as ours, so that no later edit can quietly promote it. The rail on this page applies it to Stuxnet, so you can see it working before entry one.

The ladder

Read the fifty on a ladder rather than by sector. At the top, commands executed on control systems with a physical effect that someone other than the attacker corroborated. Below that, loss of supervisory control while the process kept running. Then access alongside the control network, and capability built there. Then reconnaissance from outside. Then IT compromises that halted physical operations without touching a control system at all. And at the bottom, capability that was never deployed. Several entries sit off it altogether: IT compromises that stopped nothing physical.

Stuxnet is the case everyone puts on the top rung by reflex, and its corroboration is an inference from inspection counts, labeled as such by the people who made it. Across the fifty, a corroborated physical effect from commands on a control system is rare. Many of these entries are IT compromises that stopped a plant, a port, or a pipeline because nobody had built a way to run without the system. That is not an embarrassment for the book. It is the argument of the book.

What we got wrong

A standard applied only to other people is a posture, so ours come first.

Volume 1 left Stuxnet out entirely. Our Triton entry listed its attack vector as remote access or phishing, and our blog on it told readers that investigators believed the attackers came in that way. The responders who worked that case published no initial access vector at all. The US Treasury said phishing in 2020, a separate and later claim, and the Triton entry now keeps the two apart. We gave a plausible guess an investigator's badge.

And our Jaguar Land Rover entry, on the live site, stated as fact that the intrusion began with a phone call to the IT helpdesk asking for a password reset. There is no source for that anywhere. No official statement has ever said how the attackers got in; a minister who described helpdesk calls in the Commons took care to add, "I am not saying that that is what happened in this case"; and the company's group security chief at the time has since said that "no social engineering was involved in the attack." The story was not contested. It was unsourced, and it was ours. This volume corrects both entries, with dated notes rather than silent edits. We correct our own record first. It is what earns the right to correct anyone else's.

Why Stuxnet is not one of the fifty

Stuxnet is not an entry, and I owe you the reason. Every entry closes on three recommendations, and they come from one idea: take the path away, remove standing access, and make anything that only reads data read it one way. The published analyses describe the enrichment plant as isolated from outside networks, and it was reached anyway, by a route no primary record documents. Our controls barely apply to that target. Writing Stuxnet as an entry would mean bending it until our recommendations fit, which is exactly the move this book exists to refuse.

So it opens the book instead, as the case that shows the standard before the standard is applied to anyone else, us included.

The fifty that follow are different. Where the record shows how an attacker got in, most often something answered a question it never needed to answer: a remote access login, an exposed controller, a firewall that talked to anyone who asked. Where the record does not show it, the entry says so in red. Stuxnet is the rare case where, as the published analyses describe it, the plant had already stopped answering, and the worm reached it anyway. Where the way in is on the record, most of the others never stopped answering at all.

In OT, the first control is not detection and it is not response. It is refusing to answer the question.