Stuxnet: the code that broke machines

The story

In 2010, a small security company in Belarus found an unusual piece of malware on a customer’s computer. Researchers around the world spent months taking it apart. They found something new: software built to sabotage industrial equipment.

Stuxnet looked for a specific kind of industrial controller connected to centrifuges at Iran’s Natanz uranium enrichment facility. When it found one, it changed the speed of the centrifuges in ways that wore them out, while playing back recordings of normal readings to the operators watching the screens.

The facility’s systems were not connected to the internet. Researchers believe the worm was carried in on USB drives. It was widely reported to be a joint US and Israeli operation, which neither government has confirmed.

Why it mattered

Stuxnet was the first malware discovered that spies on and sabotages industrial systems, and one writer called it the first digital weapon of geopolitical importance. It showed that a network with no internet connection can still be reached, and that the equipment running factories and utilities can be attacked as well as ordinary computers.

The lesson today

Most businesses will never face an attack like Stuxnet. But it changed how everyone thinks about computers that run equipment:

• Being offline is not the same as being safe. USB drives, laptops and vendor connections all cross the gap.
• Equipment computers need protecting too. Machines that run production often cannot be updated, so they need to be kept on their own part of the network and watched.
• Screens can lie. Monitoring is only as good as its data, which is why separate, independent checks matter.