News

Stuxnet Is Not Superworm, Researcher Says

• By William Jackson
• 01/19/2011

An analysis of the Stuxnet worm shows it to be a combination of sophisticated and flawed work, most likely the product of a partnership between several entities with varying levels of expertise and resources.

That is the conclusion cybersecurity researcher Tom Parker, director of security consulting services at Securicon, made at the Black Hat Federal Briefings in Arlington, Va., today. Parker said descriptions of Stuxnet as the most advanced piece of malware ever discovered are "massive overstatements."

"If there is anyone who thinks this is a game changer, they have probably already lost the game," he said.

That is not to say that Stuxnet is not sophisticated and dangerous. Parker said Iran's uranium enrichment program was "without reasonable doubt" the worm's target and that the program probably was disrupted by damage to its hardware. But, "the fact that we are talking about it now shows that the developers failed to some extent."

Stuxnet, first publicly revealed in July, is a highly targeted attack that escaped into the wild to become one of the most closely scrutinized pieces of malicious code. Allthough much is known about it, much still remains to be learned, and it illustrates the current capabilities and limitations of cyber forensics, which can help to identify the developer and/or attacker. Although analysis of the code, functionality and processes of malware is possible, that remains an emerging science.

"There is a lot of gut instinct, but not a lot of science, at least in the public domain," Parker said. "There still is too much speculation and finger pointing."

Although it is not always possible — or necessary — to identify a specific person or other entity as the author of malware, knowing where it comes from and what its purpose is can help in determining how to defend against it and respond to it. This problem of attribution is particularly important in the emerging arena of cyberwar, in which knowing who the enemy's identity is critical to a response.

Tools and methods of analyzing malicious code need to be automated to deal with the growing volume of malware being discovered, so that risks can be prioritized and response policies properly applied.

A lot of very good work has been done on analyzing Stuxnet, Parker said, yet seven months after its discovery, a lot remains unknown. The leading theory is that it is the work of a nation state, probably Israel or the United States, and was intended to target Iran's program for enriching uranium. Parker said his work suggests this might not be true, at least completely.

The level of expertise and the skills needed to successfully target specific equipment makes it "very unlikely" that Stuxnet was developed by an individual or a small organization, Parker said. At the same time, some implementations in the work, such as the command and control channel it uses, are simplistic and unprotected, making it unlikely that it is the work of a Western nation with a great deal of technical expertise. The worm also escaped into the wild, which was almost certainly not intended.

And the worm did not rely exclusively on zero-day exploits to infect systems and rewrite code. "There were a lot of things in Stuxnet that people were calling zero-day but are not," Parker said. Three of seven exploits used by the worm turned out to have been for vulnerabilities known for one or two years, and one did not exploit a vulnerability, but a feature of Microsoft software. Three exploits were original to Stuxnet.

The combination of sophistication and simplicity suggests that much of the sophisticated work was outsourced to a party with expertise and resources. Targeting the specific controllers used in Iranian nuclear facilities required good human intelligence as well as access to regulated hardware for a testbed. Flawed implementation, on the other hand, suggests that it was used by a partner with less expertise. We might never know who those parties are, Parker said.

This does not mean that Stuxnet isn't significant. It was slick and clever and its exploits were well selected, and it could have been worse, Parker said. "The command and control could have not sucked," which would have made it much less likely to have been discovered, and then we would know nothing at all about it.