Speaker 1: Get in touch with technology with tech Stuff from how
Speaker 1: stuff works dot com. Hey there, and welcome to tech Stuff.
Speaker 1: I'm your host, Jonathan Strickland. I'm an executive producer here
Speaker 1: at how Stuff Works. And yeah, I still kind of
Speaker 1: have a cold. You can kind of hear it. It's
Speaker 1: not as bad as it was last week when I
Speaker 1: was recording those earlier episodes though, So that's something. Uh,
Speaker 1: since I have a cold, you know, I thought my
Speaker 1: brain got on this little topic. It's sort of this
Speaker 1: free association thing technology colds viruses. How about I talk
Speaker 1: about a famous virus. So we're going to really dive
Speaker 1: in to the story behind stucks net, a famous piece
Speaker 1: of malware that made headlines in and I've talked about
Speaker 1: it before on this show. In fact, Chris Palette and
Speaker 1: I did an episode about stucks net several years ago,
Speaker 1: but at the time not as much information was available
Speaker 1: about what was going on. Tech Stuff technically launched two
Speaker 1: years before stocks Net made headlines. So this is actually
Speaker 1: an opportunity for me to look back at something that
Speaker 1: developed over the course of the history of this show
Speaker 1: and learn more about where it came from, what's purpose was,
Speaker 1: and how that whole story unfolded. Before I really dive
Speaker 1: into the story, I want to mention one of the
Speaker 1: sources I used when I was researching these two episodes. Uh,
Speaker 1: this would be a book titled Countdown to Zero Day,
Speaker 1: stucks Net and the Launch of the World's First Digital Weapon.
Speaker 1: The book goes into great detail regarding the story of
Speaker 1: stocks Net. It also gives wonderful background information on the
Speaker 1: key figures of cryptography researchers, cybersecurity researchers, all these people
Speaker 1: who were very much instrumental in discovering and uncovering stuck
Speaker 1: s net and figuring out what it did and and
Speaker 1: who was probably behind it since that was never something
Speaker 1: that was officially acknowledged, but come on, we know who
Speaker 1: it actually was. I'll talk about that in these episodes.
Speaker 1: That's a great book. If you want more information about
Speaker 1: stucks Net after this episode, go check that out, count
Speaker 1: Down to Zero Day, stucks Net and the Launch of
Speaker 1: the World's First Digital Weapon. It goes into way more
Speaker 1: detail than I'm going to cover in these episodes. Now,
Speaker 1: these episodes are also going to contain a lot of
Speaker 1: history and politics in them because stucks net, unlike many
Speaker 1: other examples of malware was not intended to be a
Speaker 1: type of uh computer virus to create monetary gain for
Speaker 1: the people who designed it, or even just make people irritated.
Speaker 1: It wasn't that kind of malware. You may have a
Speaker 1: counter and malware that was meant to try and extort
Speaker 1: money from someone where it locks down a computer and
Speaker 1: the only way to get access, at least according to
Speaker 1: the messengersy receive, is to pay a ransom to the hackers.
Speaker 1: We call that ransomware. Stuck's Net was not that type
Speaker 1: of malware. Nor was it just some sort of capricious
Speaker 1: code that someone created in order to turn computer hard
Speaker 1: drives into giant concrete blocks. It was neither of those things.
Speaker 1: It had a very specific intent, and it was very
Speaker 1: much a at least all signs at least pointed to
Speaker 1: it being very much a state sponsored piece of software,
Speaker 1: meaning that some government agency or agencies was behind the
Speaker 1: development of this. So it sets it apart from a
Speaker 1: lot of other versions of malware. And in order to
Speaker 1: understand it, I think it's good to begin with a
Speaker 1: quick history lesson of Iran's nuclear program, because that was
Speaker 1: the ultimate target of stocks net back in the nineteen fifties. Iran,
Speaker 1: under the leadership of shaw Mohammad Reza PALAVII, had received
Speaker 1: the nod from the world community to pursue a nuclear
Speaker 1: power program. At that same time, nuclear powers like the
Speaker 1: United States, we're trying to discourage other nations from developing
Speaker 1: nuclear weapons. So they were essentially saying, hey, nuclear power,
Speaker 1: tots cool nuclear weapons, Let's not make this worse because
Speaker 1: nuclear proliferation was becoming a big fear among various powers
Speaker 1: in the world and of course populations in the world.
Speaker 1: So it was sort of an Atoms for Peace kind
Speaker 1: of initiative, saying, let's go and develop nuclear power for
Speaker 1: a country's that's great. That way you can generate electricity,
Speaker 1: but let's stay away from building the bombs. Iran's program
Speaker 1: was launched with the understanding that the country was only
Speaker 1: going to build these power plants, not weaponry, although all
Speaker 1: indications showed that the long term plan for Iran was
Speaker 1: in fact to develop nuclear weapons at some point. As
Speaker 1: part of this early agreement, the United States would sell
Speaker 1: to Iran the enriched uranium its power plants would need
Speaker 1: as fuel, so Iran wouldn't need to create its own
Speaker 1: uranium enrichment facilities. It would just purchase enriched uranium ready
Speaker 1: to go from the United States. And in fact, the US, Germany,
Speaker 1: and France were all totally supportive of Iran's efforts, perhaps
Speaker 1: because those countries also stood to benefit from it. They
Speaker 1: were all going to make a boatload of cash by
Speaker 1: selling equipment and fuel to Iran, so there was a
Speaker 1: financial incentive to support Iran's efforts to create nuclear power plants.
Speaker 1: All of this was despite the fact that the tools
Speaker 1: used to create nuclear power plants could receivably be put
Speaker 1: to use to build nuclear weapons. So you could have
Speaker 1: someone say, hey, I just need this technology because I
Speaker 1: want to make a power plant, but in reality they
Speaker 1: might be using that technology to make boom booms. So
Speaker 1: the thing that the U United States said that kind
Speaker 1: of justified their choice to support this program was, Hey,
Speaker 1: the Shah, he's awesome. We get along so well, we're
Speaker 1: like besties. And so there's no way that Iran, even
Speaker 1: if they did develop nuclear weapons, would be a threat
Speaker 1: to US, their their allies. So let's go ahead and
Speaker 1: go all in. Let's go ahead and make some money.
Speaker 1: Come on, capitalism, woo. It's not like Iran will ever
Speaker 1: have a problem with the United States. And then nineteen
Speaker 1: seventy nine happened. In nineteen seventy nine, the Ayatollah Ruala
Speaker 1: Kamaney overthrew the shop. Now Kamany did not share the
Speaker 1: Shah's opinion of the United States, and suddenly the U
Speaker 1: S was tugging at its collar and saying yikes. So
Speaker 1: Germany in the US withdrew their support for Iran's nuclear
Speaker 1: program and the Komani Aetola. Komani was not terribly interested
Speaker 1: in pursuing a nuclear power program either, so the power
Speaker 1: plants were pretty much abandoned for a few years. They
Speaker 1: were also the frequent target of bombing raids during various
Speaker 1: conflicts that Iran got into over the course of the eighties.
Speaker 1: Now that Aatola would eventually renew the nuclear program. In
Speaker 1: the nineteen eighties, after rumors spread that Iraq was developing
Speaker 1: nuclear weapons and Saddam Hussein, the leader of Iraq at
Speaker 1: the time, had already used chemical weapons against Iran during
Speaker 1: the Iran Iraq War, the Aetola hired on an engineer
Speaker 1: from Pakistan to help Iran, using plans for centrifuges that
Speaker 1: the engineer had stolen from European companies. So This engineer
Speaker 1: had worked on behalf of these European companies and then
Speaker 1: essentially did a little industrial theft, stealing the plans for
Speaker 1: centrifuges so that they could create a similar program in
Speaker 1: nations like Pakistan. This was all happening in secret, obviously,
Speaker 1: but Iran had gotten word of it, and so they
Speaker 1: contacted this Pakistani engineer who agreed to help out Iran.
Speaker 1: In nineteen Iran entered into a contract with Russia to
Speaker 1: complete a nuclear power reactor at Boucher. This site in
Speaker 1: Iran had been one of the original plan power plants
Speaker 1: way back in nineteen fifty seven, but the various conflicts
Speaker 1: between fifty seven and ninety five had delayed and even
Speaker 1: destroyed the work that had been done on the location.
Speaker 1: Iran and Russia were going to also build a uranium
Speaker 1: enrichment plant kind of co located with this nuclear power plant,
Speaker 1: but the United States stepped in and said to Russia, hey,
Speaker 1: we think that's like a bad idea man, and Russia
Speaker 1: eventually said dah and backed off. And that was supposedly that,
Speaker 1: except it totally wasn't just that. In two thousand, Iran
Speaker 1: started building a new facility at Natan's another site in Iran.
Speaker 1: Iranian officials claimed that this facility was a desert eradication location,
Speaker 1: but satellite imagery eventually showed that something else was up
Speaker 1: in that site. The design of the facility suggested it
Speaker 1: was going to house something super secret that was to
Speaker 1: be protected from missile strikes and air strikes. And the
Speaker 1: reason they were drawing this conclusion was that Iran was
Speaker 1: clearly excavating a lot of land building a large underground
Speaker 1: facility something that needed to be uh insulated from potential
Speaker 1: air attack, and the entrance hallway into the facility had
Speaker 1: a big U turn in it. It wasn't a straight
Speaker 1: shot down into the heart of the facility. That you
Speaker 1: turn was an indication that perhaps this was a way
Speaker 1: to avoid a smart missile flying down the entryway and
Speaker 1: hitting a target. If it had to turn nine degrees
Speaker 1: or eighty degrees, then chances are no missile would actually
Speaker 1: be able to do that, and it was thus a
Speaker 1: tactic to avoid damage in the case of an air strike.
Speaker 1: But why would you need that for some innocent desert
Speaker 1: eradication facility. Why would it need to be underground and
Speaker 1: have these kind of measures in place In two thousand two,
Speaker 1: some whistleblowers alerted the u N that this facility would
Speaker 1: actually be a uranium enrichment plant. Now, Iranian officials eventually said, okay, yeah,
Speaker 1: but we were gonna tell you about it. We just
Speaker 1: hadn't done that yet because there wasn't really any need to.
Speaker 1: Were still months away from going online, so it's not
Speaker 1: like there's any chance that this thing is is already
Speaker 1: producing enriched uranium. We just want to have a facility
Speaker 1: to create nuclear fuel that we're going to use for
Speaker 1: our power plants. We want to be self sufficient, is all.
Speaker 1: We don't want to have to buy our fuel from
Speaker 1: other nations. The u N stepped up inspections of the facility,
Speaker 1: or at least attempted to, although it initially encountered a
Speaker 1: lot of resistance from Iran. The u N would say,
Speaker 1: all right, well, we're ready to come in and investigate
Speaker 1: this facility, and then the people in Iran would say, sorry,
Speaker 1: it's not ready yet. Come back next month. And then
Speaker 1: they would come back next month and say, all right,
Speaker 1: we're ready to look at the facility and say, you
Speaker 1: know what, we lost the keys, don't know where the
Speaker 1: keys are. Could you come back maybe another day, and
Speaker 1: it became increasingly clear, at least to the the investigators,
Speaker 1: that something was up, and that there was a lot
Speaker 1: of activity going on, perhaps to cover tracks, perhaps to
Speaker 1: get rid of evidence, although it's impossible to say, because
Speaker 1: unless you actually are there to witness what is happening,
Speaker 1: you don't really know, but it seemed to imply that
Speaker 1: there was something hainky going on. Eventually they were able
Speaker 1: to set up a regular inspection schedule of this facility,
Speaker 1: and they were there to make sure that the uranium
Speaker 1: that was being produced was meant for nuclear power and
Speaker 1: not nuclear weapons. And meanwhile, countries like the United States
Speaker 1: were getting awfully antsy about Iran. On July six, two
Speaker 1: thousand nine, Wiki Leaks hosted a note written by founder
Speaker 1: Julian Assange that referenced some sort of serious nuclear accident
Speaker 1: that had happened at the uranium enrichment facility. Now this
Speaker 1: would have been shortly after the stux Net virus would
Speaker 1: initially be released, but at this time, no one outside
Speaker 1: of the people involved in stocks Net would have possibly
Speaker 1: known about the virus and become public knowledge. Yet, in January,
Speaker 1: a United Nations agency called the International Atomic Energy Agency
Speaker 1: or I a e A. Began to notice that something
Speaker 1: unusual was happening to the centrifuges at Iran's Natan's uranium
Speaker 1: enrichment plant. They saw that there was a failure rate
Speaker 1: that was unusually high. The agents would inspect the facilities
Speaker 1: at least once a month and then occasionally with some
Speaker 1: surprise inspections, and the whole point was just to make
Speaker 1: sure that nothing illegal was happening, that Iran was in
Speaker 1: fact not trying to stockpile enriched uranium in the effort
Speaker 1: to build bombs. This was an important uh thing that
Speaker 1: the U N was doing, but it also was not
Speaker 1: the most efficient way of doing it if you wanted
Speaker 1: to recognize trends, because they would swap out who went
Speaker 1: to investigate the facility each time. That kind of makes sense.
Speaker 1: You don't want one group to get compromised in any
Speaker 1: way or fooled in some way. Sending new people sends
Speaker 1: new sets of eyes. But it also meant that until
Speaker 1: you were looking at aggregated data, you could not necessarily
Speaker 1: see that something unusual is happening, And something unusual was
Speaker 1: happening specifically to the centrifuges. Now to understand that. It
Speaker 1: also helps to understand what the heck the centrifugures were
Speaker 1: being used for in the first place, Like what is
Speaker 1: their purpose in the process of refining uranium. Well, first,
Speaker 1: nuclear fuel needs to be made up of between three
Speaker 1: and a half to five percent uranium two thirty five isotope.
Speaker 1: So isotopes are two or more forms of the same element,
Speaker 1: in which the atoms of the different isotopes have a
Speaker 1: different number of neutrons. Chemically, the two atoms behave the
Speaker 1: same way, but they'll have different atomic masses because of
Speaker 1: the difference in neutrons uh, and they'll have different decay
Speaker 1: rates and things of that nature as well. So there
Speaker 1: are three may jr isotopes of uranium that occur naturally
Speaker 1: uh within the Earth's crust. So if you mine uranium,
Speaker 1: you're gonna come up with a mixture of different isotopes
Speaker 1: at different concentrations. Most of it, in fact, more than
Speaker 1: nine of the stuff that occurs naturally is uranium two
Speaker 1: thirty eight, less than one percent of it is uranium
Speaker 1: two thirty five, and then you get a ten ty
Speaker 1: tiny bit that's uranium two thirty four. If you want
Speaker 1: to make nuclear fuel, you need a much higher percentage
Speaker 1: of uranium two thirty five than what you find in nature.
Speaker 1: In nature it's less than a percent, and fuel you
Speaker 1: need it to be at least three and a half
Speaker 1: to five percent. By the time you're getting into the
Speaker 1: enrichment process. You need the uranium to be in gas form,
Speaker 1: so you would get uranium or you would refine that
Speaker 1: down to uranium oxide, and then you would take that
Speaker 1: to a conversion plant that would take the uranium oxide
Speaker 1: and turn it into a gas called uranium hexafluoride. This
Speaker 1: gas has various isotubes of uranium in it. You have
Speaker 1: both uranium two thirty eight and two thirty five, and
Speaker 1: you have it in the concentrations you would expect because
Speaker 1: it's from the stuff you mind from the ground. You
Speaker 1: then feed that gas into tubes inside a centrifuge. Centrifuges
Speaker 1: spin and they can spend it really high velocities. We're
Speaker 1: talking tens of thousands of revolutions per minute now. When
Speaker 1: they spin, it separates out the materials of different weight
Speaker 1: within those tubes. The heavy stuff moves towards the edges
Speaker 1: of the tubes, the sides of the tubes, and the
Speaker 1: lighter stuff will move towards the center. So if you
Speaker 1: spend the centrifugures at the right speed and you then
Speaker 1: effectively scoop out the middle of the tube, you can
Speaker 1: separate the uranium two thirty five from the uranium two
Speaker 1: thirty eight. Now you actually have to do this in
Speaker 1: a lot of different stages. You put them through one centrifuge,
Speaker 1: you do the scooping process, you doing about another centrifuge.
Speaker 1: You have to do this multiple times in order to
Speaker 1: really get the right concentrations. Eventually you can do this
Speaker 1: enough to manufacture the uranium pellets that you would use
Speaker 1: for nuclear fuel. If you wanted to make a nuclear weapon,
Speaker 1: you'd follow the same process, but you need way more
Speaker 1: uranium two thirty five. Nuclear weapons typically have a proportion
Speaker 1: of or more uranium two thirty five in them. Sometimes
Speaker 1: it's or greater, so you need a lot more uranium,
Speaker 1: and then you have to refine a lot of it
Speaker 1: and rich a lot of it in order to get
Speaker 1: to that level of uranium two thirty five. But it
Speaker 1: is exactly the same process, it's just a matter of
Speaker 1: more stuff. Centrifuges, as they turn out, are are delicate.
Speaker 1: They're the ones that Iran was using. We're supposed to
Speaker 1: have a ten year lifespan, but these are moving pieces
Speaker 1: of machinery. They have mechanical parts, and they work at
Speaker 1: high speeds, so eventually they'll fail. They may fail because
Speaker 1: of mechanical error, human error, all sorts of different stuff
Speaker 1: could cause them to break down. And because of that,
Speaker 1: typically in a year you might have to replace about
Speaker 1: ten of the centrifugures you have, even if they're brand new.
Speaker 1: But the thing that the i a e A. Discovered
Speaker 1: eventually after they looked at aggregated data, was that the
Speaker 1: number of centrifuges that they were replacing at this uranium
Speaker 1: and enrichment facility was much higher than that they had
Speaker 1: centrifugures at this point, So you would expect about eight
Speaker 1: hundred and seventy of them need to be replaced every year,
Speaker 1: but apparently the number was actually much higher than that,
Speaker 1: perhaps as high as two thousand or more, although the
Speaker 1: actual figures were never published. But the i a e A.
Speaker 1: Was keeping track of this stuff. They just didn't notice
Speaker 1: the trend until they were looking at again a sequence
Speaker 1: of these visits and then realized, hey, that that seems
Speaker 1: like a pretty high number to place that many centrifuges.
Speaker 1: Wonder what's happening with this? Well, while this was going on, uh,
Speaker 1: there were other things happening that we're indicating that something
Speaker 1: unusual had been unleashed in the world of computers. The
Speaker 1: folks at I A e A at this point did
Speaker 1: not suspect any kind of computer virus. They weren't sure
Speaker 1: what was causing the centrifuges to fail. It could have
Speaker 1: just been that they were really bad centrifugus, that Iran
Speaker 1: had purchased them from a bad source, although Iran was
Speaker 1: stating that they had actually made the whole thing themselves,
Speaker 1: that the centrifugures were based off their own design, although
Speaker 1: again the United Nations officials the investigators were not buying it.
Speaker 1: They said, wow, these things look an awful lot like
Speaker 1: the ones that were being used in Europe a few
Speaker 1: years ago. In fact, if I didn't know any better,
Speaker 1: I would say that these were direct copies of that
Speaker 1: and that they were based off stolen information. But Iran's
Speaker 1: messaging was that no, these were of our design and
Speaker 1: we built them at any rate. I A e A
Speaker 1: wasn't sure why these centrifuges were starting to fail at
Speaker 1: that same time, or actually a little bit later. In June,
Speaker 1: there was a cybersecurity professional named Seragei Ulasson in Belarus
Speaker 1: who was investigating some really weird computer behavior that had
Speaker 1: been reported in an Iranian computer. The computer in question
Speaker 1: was caught in an endless crash and reboot cycle and
Speaker 1: they weren't really sure what was causing it. The culprit
Speaker 1: looked like it might have been the anti virus software
Speaker 1: that was on the computer, that something was not compatible,
Speaker 1: and the antivirus software came from the company that uh
Speaker 1: Sarageulawson was working for. He was working for this company
Speaker 1: called virus Block Ada. The Iranian computer had that anti
Speaker 1: virus program on it. It was purchased originally from a reseller,
Speaker 1: so it wasn't purchased directly from the Belarus company, but
Speaker 1: rather an Ira Auny and company that had the right
Speaker 1: to re sell this anti virus software, and originally the
Speaker 1: person who owned the computer or the the agency that
Speaker 1: owned the computer contacted the reseller and said, I'm getting
Speaker 1: this error. It's the computer just keeps crashing and trying
Speaker 1: to reboot. What's going on the reseller eventually fielded that
Speaker 1: question up to Lawson. Lawson got permission to log into
Speaker 1: this problematic computer using a remote log in, and he
Speaker 1: began to look around to see what the heck was
Speaker 1: going on, and he eventually suspected the machine had been
Speaker 1: infected by some malware and that this malware included a
Speaker 1: root kit quick refresher. A root kit is software that
Speaker 1: gives an unauthorized party access to control of a computer system.
Speaker 1: Hackers use this to get a back door access and
Speaker 1: get information on computers, or they do it to create
Speaker 1: boton nets. Moreover, a root kit masks this activity. It
Speaker 1: acts as like a shield to hide it from the
Speaker 1: host computer in an effort to escape detection. So a
Speaker 1: good root kit is doing all this allowing someone to
Speaker 1: remotely access your computer, but you can't tell because it's
Speaker 1: hiding all that activity from you. Well, like all malware,
Speaker 1: root kits are only useful if the targeted machine doesn't
Speaker 1: have suitable anti virus protection on it. It could be
Speaker 1: out of date, or it might not have antivirus software
Speaker 1: on it at all, or it might be so new
Speaker 1: that antivirus software doesn't yet have a profile on that
Speaker 1: type of root kit. Which means that it will escape
Speaker 1: the anti virus software's detection because it doesn't know to
Speaker 1: look for it. Once anti virus software companies learn of
Speaker 1: a piece of malware, they can then adjust their software
Speaker 1: to identify and block those programs. But if there is
Speaker 1: a gap there, the malware can go for a while
Speaker 1: without detection, and it means that all machines can be
Speaker 1: vulnerable to those attacks until someone catches on. And that
Speaker 1: seems to be what was going on in this case.
Speaker 1: Now I have a lot more to say about the
Speaker 1: early detection of stucks net, but before I get into that,
Speaker 1: let's take a quick break to thank our sponsor. Alright,
Speaker 1: So a lawson realized that whomever was responsible for creating
Speaker 1: this malware that was causing this this computer to crash repeatedly,
Speaker 1: had done so by finding what is called a zero
Speaker 1: day exploit. A zero day exploit is a vulnerability within
Speaker 1: a piece of software code that has not yet been
Speaker 1: identified by anybody else, including the people who made the
Speaker 1: software code in the first place. The software coders are
Speaker 1: likely completely unaware of it. In fact, that's that's really
Speaker 1: what makes it zero day is the fact that you know,
Speaker 1: you come out with like a new version of of
Speaker 1: an operating system, for example, and you are not aware
Speaker 1: that that part of that operating system has this glaring
Speaker 1: flaw in it that uh could be exploited. That's a
Speaker 1: zero day exploit, and that ignorance is an incredibly powerful
Speaker 1: weapon for hackers. They will end up writing code that
Speaker 1: can exploit this vulnerability, and they know that there's no
Speaker 1: protection against it because the responsible parties for the software
Speaker 1: have not even realized that there's a potential for exploitation.
Speaker 1: The lawson figured out that the malware had to have
Speaker 1: been distributed by a USB thumb drive initially. Later on,
Speaker 1: researchers would figure out that the code would allow up
Speaker 1: to three machines to be infected by the same USB
Speaker 1: flash drive before the malware would prompt a computer to
Speaker 1: delete the contents of the flash drive, so it's kind
Speaker 1: of like a self destruct button. After three infections, the
Speaker 1: drive would be wiped. F a propagation could happen across
Speaker 1: a compromised network through computer computer connections, and later on
Speaker 1: they discovered even other different ways that the virus can
Speaker 1: move from computer to computer. It did not, however, move
Speaker 1: across the Internet. This was a piece of malware that
Speaker 1: was designed to infect computers that were on local networks
Speaker 1: but perhaps not connected to the Internet at large. So
Speaker 1: that was why they were using USB drives in the
Speaker 1: first place. Now, that did come with a disadvantage. It
Speaker 1: means that you have to get physical access to a
Speaker 1: machine to get the malware from the USB drive onto
Speaker 1: the computer, and that drastically reduces the number of computers
Speaker 1: you could potentially infect. So why would you do this, Well,
Speaker 1: one reason to go with the USB delivery mechanism is
Speaker 1: to target computers that have an air gap. And that
Speaker 1: air gap is what I was talking about a second ago.
Speaker 1: That's a computer or even a network of computers that
Speaker 1: has no direct connection to the wider Internet at large.
Speaker 1: As an air gap between the Internet and the computer
Speaker 1: or system of computers, it's kind of like a self
Speaker 1: contained island. It's cut off from the rest of the world,
Speaker 1: and it keeps the system safe from most forms of
Speaker 1: hacker intrusions. If there are no pathways that lead to
Speaker 1: the system, there's not a whole lot of hacker can do.
Speaker 1: A true air gap system would have no connectivity to
Speaker 1: the Internet at all. Now, some systems have what we
Speaker 1: call an air gap but they really have limited and
Speaker 1: controlled access to the Internet, typically through a computer or router.
Speaker 1: The acts as a gatekeeper or portal. But if you
Speaker 1: put your malware on a USB stick and then you
Speaker 1: convince someone with a physical access to the machine to
Speaker 1: insert the USB drive and air gap isn't really a problem.
Speaker 1: It might, however, mean that you, as a hacker, will
Speaker 1: remain unaware of your success. If the target machine has
Speaker 1: no way to phone home, if there's no way for
Speaker 1: the target machine to indicate hey, success, then you may
Speaker 1: just be hoping that whatever you planned on doing was working. So,
Speaker 1: like I said, all the vectors of attack for stocks
Speaker 1: net were based off of either USB or local network connections,
Speaker 1: but not over the Internet. And also the USB stick
Speaker 1: attack did not use auto run, at least not after
Speaker 1: the first initial wave of attacks. There were three separate
Speaker 1: waves of attacks, and the second and third one did
Speaker 1: not use the auto run feature. A lot of malware
Speaker 1: does depend on auto run, and that's a feature that
Speaker 1: will automatically launch a program from something like a USB
Speaker 1: drive or an optical drive once you insert the media.
Speaker 1: You're probably familiar with this. Let's say that you've got
Speaker 1: a DVD, an actual movie on a DVD and you
Speaker 1: put it into your computer, and the computer automatically launches
Speaker 1: the DVD player software so that you can watch it
Speaker 1: as soon as the DVD has gone into the optical drive. Well,
Speaker 1: that speeds things up for the user, makes it more convenient,
Speaker 1: you don't have to hunt for the right program. But
Speaker 1: it does present a security risk because if the software
Speaker 1: on the media is malicious, the computer is just automatically
Speaker 1: launched bad software. But here's the thing. You can turn
Speaker 1: off the auto run feature and a lot of systems
Speaker 1: will do that because it is a way to limit
Speaker 1: the risk and the vulnerability of those systems. You just
Speaker 1: turn off auto run and then your planned form of
Speaker 1: attack is not going to work. Someone puts that media
Speaker 1: into a computer where the auto run has been switched off,
Speaker 1: they'll get prompted or they'll they'll have the chance to
Speaker 1: run that stuff themselves. But chances are you go, if
Speaker 1: you don't recognize a program, you're not just gonna launch it.
Speaker 1: You might do some snooping first and find out if
Speaker 1: this is in fact something you want to run. So
Speaker 1: to remove that possibility, you might want to not use
Speaker 1: auto run feature to launch your malware. So that's what
Speaker 1: the hackers responsible for stucks net did. They decided that
Speaker 1: they would use a different approach. They targeted what are
Speaker 1: called l n K files. So an l n K
Speaker 1: file carries the information to display icons next to file
Speaker 1: types and applications like Windows Explorer. So if you've opened
Speaker 1: up a file directory type of program and you've seen
Speaker 1: those little icons next to file names, that's due to
Speaker 1: an l n K file. This was a pretty sophisticated
Speaker 1: form of attack, and as far as Lawson could figure out,
Speaker 1: it was the first of its type. Not turned out
Speaker 1: that it was not the very first of its type,
Speaker 1: but the previous implementations of this attack had not really
Speaker 1: received widespread coverage, so it was still really new. Adding
Speaker 1: to this sophistication was the fact that there were four
Speaker 1: different versions of the l en k files on those
Speaker 1: USB sticks, and that meant that they could affect up
Speaker 1: to seven different versions of Windows. That increased the number
Speaker 1: of potential targets for the mal where so if a
Speaker 1: computer was running one version of Windows, or maybe the
Speaker 1: next one or the next one, it still might be vulnerable.
Speaker 1: The only real thing that limited it was it needed
Speaker 1: to be a thirty two bit installation of Windows. If
Speaker 1: it were a sixty four bit installation, the virus was
Speaker 1: not going to work on it. Later on, researchers at
Speaker 1: the security firm Kaspersky UH discovered other zero day exploits
Speaker 1: that the virus took advantage of. So there wasn't just
Speaker 1: one zero day vulnerability that stucks net could glom onto.
Speaker 1: There were three more that Kaspersky found at that point.
Speaker 1: One exploited a print spooler vulnerability, and it would propagate
Speaker 1: the virus across networks that had a shared network printer
Speaker 1: and a lot of a lot of networks do the
Speaker 1: other two vectors use something called privilege escalation, which is
Speaker 1: where a program is able to leverage exploits to gain
Speaker 1: eventually a system level control over computer is even if
Speaker 1: those computers have been locked down. The combination of all
Speaker 1: the exploits suggested that the people responsible for the virus
Speaker 1: were serious heavy hitters who really desperately wanted to target
Speaker 1: specific computers. And it raised some really big questions why
Speaker 1: would you use four zero day exploits because common logic
Speaker 1: said you should just stick to one at a time.
Speaker 1: Once a zero day exploit is discovered, the clock is
Speaker 1: ticking before someone patches that respective software to plug up
Speaker 1: that vulnerability so that the exploit won't work anymore. So
Speaker 1: the zero day exploit is only really valuable until people
Speaker 1: discover it. If you have more than one zero day
Speaker 1: exploit involved in your malware, then you run the risk
Speaker 1: of someone discovering all of those exploits if the malware
Speaker 1: itself becomes evident, and if they find all of those exploits,
Speaker 1: that all of those can be patched, which means you
Speaker 1: lose all of those vectors of attack in a single
Speaker 1: cell swoop. So this was kind of considered a big gamble.
Speaker 1: Why would you throw all of your eggs into this
Speaker 1: basket having all of four zero day exploits. By the way,
Speaker 1: there was a fifth one actually that they had not
Speaker 1: yet discovered, though that one ended up getting patched after
Speaker 1: the first wave of attacks, uh not because of stocks net.
Speaker 1: The fifth vulnerability had been independently discovered through other means
Speaker 1: and had been patched, But ultimately that did mean five
Speaker 1: different zero day vulnerabilities were used when designing stucks net.
Speaker 1: Over the course of the life of stucks neet. On
Speaker 1: top of those zero day exploits, the virus used four
Speaker 1: other means to copy and send itself along to other machines.
Speaker 1: So in total it had nine different methods to spread
Speaker 1: the virus. One of them leveraged of vulnerability in special
Speaker 1: Semens software to gain system level privileges. Siemens is a
Speaker 1: company it's in Germany that creates all sorts of different
Speaker 1: kinds of software. The software in particular that stocks net
Speaker 1: was concerned with was for something called p lcs programmable
Speaker 1: logic circuits, so are controllers rather logic controllers. So these
Speaker 1: are little implementations that allow computers to communicate with various devices,
Speaker 1: typically that are used in industrial applications, so it might
Speaker 1: be like a conveyor belt or valve system, that kind
Speaker 1: of thing, which is a pretty odd thing for viruses
Speaker 1: to target. Typically, there was another clever way that the
Speaker 1: malware could spread. It would create a file sharing server
Speaker 1: folder on every computer it infected if that computer were
Speaker 1: connected to other infected machines. So it's a computer on
Speaker 1: a network and other computers on the network also got
Speaker 1: infected by stocks net. They would chat with each other
Speaker 1: and they would com hair notes. They would say, hey,
Speaker 1: one version of stucks net are you running. I've got
Speaker 1: one point two and they might say, well, I've got
Speaker 1: one point to one. Hey, your version is more current
Speaker 1: than my version is, Give me some of that sweet
Speaker 1: stucks net, And sure enough the system would propagate the
Speaker 1: latest version of stucks net across its network. So it
Speaker 1: was kind of appear to appear approach to spreading the
Speaker 1: latest and greatest version of stuck set. And if someone
Speaker 1: came in and infected a new computer with an even
Speaker 1: more recent version of stocks net, then shortly that version
Speaker 1: of stucks net would propagate across the other infected computers
Speaker 1: on the network. It was a way of making sure
Speaker 1: everyone was on the same page, even without them being
Speaker 1: aware of it. The malware would install two driver modules
Speaker 1: on the infected computer, and uh these driver modules were
Speaker 1: they were posing as as software drivers. Software drivers are
Speaker 1: lee aisons between a computer and some other piece of hardware. So,
Speaker 1: for example, if you have a separate computer mouse, or
Speaker 1: a microphone that you plug into your computer, or a
Speaker 1: webcam that you plug into your computer, the driver is
Speaker 1: what allows for meaningful communication between that device and your computer.
Speaker 1: You may have occasionally had an issue where one of
Speaker 1: your peripherals no longer seems to work on your computer,
Speaker 1: and it's because the driver is out of date. It
Speaker 1: may be that there was an update to the operating
Speaker 1: system and that update has broken that communication channel between
Speaker 1: your peripheral and your computer, and it requires that you
Speaker 1: update your software drivers so that now the two machines
Speaker 1: can talk to each other again. That's what the malware
Speaker 1: would install. These these apparently innocent, at least on casual glance,
Speaker 1: driver modules onto the infected computer. Now normally, later versions
Speaker 1: of Windows would send an alert to a user whenever
Speaker 1: an up of software was to be installed. If you've
Speaker 1: used Windows seven or later than you know about this.
Speaker 1: You get that little window that pops up and says, hey,
Speaker 1: I see that you're trying to install this thing. Is
Speaker 1: that really your intention? Because it gives you the chance
Speaker 1: to say, heck no, I didn't know that was happening,
Speaker 1: stop it, and then you could investigate, and if it
Speaker 1: were malware, you would know something was up and you
Speaker 1: can maybe do something about it. So the goal of
Speaker 1: the hackers is not to have this window pop up.
Speaker 1: So this malware stocks Net was a lot more insidious
Speaker 1: than just a fake driver. It contained a digital certificate
Speaker 1: from a legitimate Taiwanese hardware company called real tech Semiconductor
Speaker 1: digital certificates are like authorized signatures. These are away for
Speaker 1: companies to authenticate that the software they distribute in fact
Speaker 1: actually comes from them, and big players that are trusted
Speaker 1: can use those certificates to authenticate. Driver is another software
Speaker 1: machines without the need for that pop up notification. You're
Speaker 1: not gonna get it every time, because essentially what's happening
Speaker 1: is Microsoft says, hey, there's this software that wants to
Speaker 1: execute on this machine. Oh wait, this software is from
Speaker 1: such and such company, and I know they're cool, And
Speaker 1: it's a digital certificate that tells me that it's absolutely
Speaker 1: from that company because they protect their certification process, so
Speaker 1: I know it's not from anyone else, so I don't
Speaker 1: need to worry the user. I'm not gonna send that
Speaker 1: pop up because everything's totally on the up and up,
Speaker 1: so as long as the software is authenticated as being
Speaker 1: from a trusted source, there's no extra step in there.
Speaker 1: But that created a pathway for potential attacks, though at
Speaker 1: the time not very many people were considering that. One
Speaker 1: person who was was a security expert with the Finnish
Speaker 1: company f Secure. That is a company from Finland, not
Speaker 1: a company that finished things, and in July he pointed
Speaker 1: out that if a hacker were to get access to
Speaker 1: digital certificates, they could potentially sneak in malware onto computers
Speaker 1: using that, which was exactly what was going on with
Speaker 1: stucks net. Now, this researcher wasn't aware of stocks neet
Speaker 1: at the time. He was just saying, hey, this is
Speaker 1: a potential problem. And as it turns out, it wasn't
Speaker 1: just a potential problem, it was a real problem that
Speaker 1: was going on at that very moment. Moreover, digital certificates
Speaker 1: have an expiration date, and this is to help make
Speaker 1: sure that they remain secure. You have to renew your
Speaker 1: certificate so that it doesn't stick around long enough for
Speaker 1: bad actors to get hold of it and then leverage
Speaker 1: it the way the malware authors had done in the
Speaker 1: case of stocks net. So you end up creating a
Speaker 1: certificate that has an expiration date on it. After the
Speaker 1: expiration date, you you then administer a new certificate that
Speaker 1: has new code on it, but it still has that authentication.
Speaker 1: And that way, if anyone tries to use the old
Speaker 1: certific of get, then an operating system like Windows can
Speaker 1: say wait a minute, that certificate is out of date. Uh,
Speaker 1: I'm going to alert the user because that could be
Speaker 1: an indication that someone had gotten a hold of an
Speaker 1: old authentication certificate and they're trying to pass it off
Speaker 1: as legitimate. So anytime a certificate expires, it's no longer
Speaker 1: really useful for the case of malware distributors. So some
Speaker 1: companies will hire out their certificates, like they'll create certificates,
Speaker 1: and then other parties will come to them and say, hey,
Speaker 1: we have created the software. We would like to say
Speaker 1: that we created it in partnership with you, and in return,
Speaker 1: you can put your authentication certificate on this software, which
Speaker 1: will help us out a lot. Uh So some companies
Speaker 1: will actually do that. Others are way more protective of
Speaker 1: their digital certificates. No one was sure at this point
Speaker 1: if Real Tech had their certificate stolen somehow, if if
Speaker 1: the hackers had managed to uh illegally get hold of
Speaker 1: this digit at all certificate, or if there had been
Speaker 1: some other form of transaction involved, if fuel Ticket perhaps
Speaker 1: licensed out essentially they're certificate. Circumstantial evidence suggested that it
Speaker 1: was a stolen certificate. Looking at the malware code, it
Speaker 1: appeared that one of the driver modules had its certification
Speaker 1: signed to it just six minutes after the original code
Speaker 1: had been compiled. This was found out by converting the
Speaker 1: code into binary and then being very meticulous about looking
Speaker 1: for the data for any sort of time stamp information. Now,
Speaker 1: it is possible to fudge things like the date and
Speaker 1: time of compiling, but that's not necessarily easy to do,
Speaker 1: so you could say that the compiled dates not really
Speaker 1: a smoking gun, but it does suggest that the certification
Speaker 1: had been sticking around in the pocket of whomever had
Speaker 1: been designing stucks net and then immediately slapped onto stucks
Speaker 1: net once the code was compiled and ready to go. Now,
Speaker 1: I've got a lot more to say in the first
Speaker 1: episode about stuck s net, but before I continue, let's
Speaker 1: take another quick break to thank our sponsor. Lawson would
Speaker 1: reach out to both real Tech and Microsoft to alert
Speaker 1: both companies of this vulnerability because it had that digital
Speaker 1: certification from real Tech and it was affecting Microsoft based machines.
Speaker 1: He had not figured out what the malware was actually
Speaker 1: for yet that would be the payload. He was understanding
Speaker 1: a little bit of how the malware would infect machines,
Speaker 1: but he didn't know what it was supposed to do.
Speaker 1: He didn't know it could potentially infect millions of computers
Speaker 1: around the world because that digital certification gave it kind
Speaker 1: of a v I P pass onto machines, and if
Speaker 1: it was meant to steal information or cause mischief, he
Speaker 1: wanted to nip that in the bud. One interesting tidbit
Speaker 1: is whomever it des I in the malware have been
Speaker 1: really careful to do it in such a way that
Speaker 1: the major anti virus packages out there wouldn't suspect a thing.
Speaker 1: It was compatible with all the major anti virus packages,
Speaker 1: so most people wouldn't have any way of telling that
Speaker 1: something hinky was going on. Clearly, the hackers who designed
Speaker 1: this had worked with computers that had these anti virus
Speaker 1: software packages installed on them to make sure that it
Speaker 1: would slip under the radar. But Virus Block Ada was
Speaker 1: a small operation, and it may have been able to
Speaker 1: have this this incompatibility problem where it was causing the
Speaker 1: computer to crash and reboot over and over again, simply
Speaker 1: because the people who were designing the stux Net virus
Speaker 1: had never really encountered this particular anti virus platform before,
Speaker 1: and they weren't able to make sure that stux Net
Speaker 1: would not be picked up by it, and so it
Speaker 1: was a real enigma. Lawson couldn't even get the virus
Speaker 1: to regularly replicate the problems he was seeing, so he
Speaker 1: wasn't really certain what was happening. Uh. It was largely
Speaker 1: a matter of luck that this happened at all and
Speaker 1: brought people's attention to it. After two weeks without hearing
Speaker 1: anything back from Microsoft Real Tech Who, Lawson posted information
Speaker 1: about what he had found both to his company's website
Speaker 1: and on an English speaking cyber security forum. He did
Speaker 1: that on July twelve, two thousand and ten. That was
Speaker 1: the same day that the Finnish security firm was talking
Speaker 1: about how digital certificates from trusted sources could become a
Speaker 1: vector for malware on July. Just a few days later,
Speaker 1: security researcher and tech journalist Brian Krebs posted about the malware,
Speaker 1: and it quickly became the talk of the cyber security
Speaker 1: sphere at that point. Microsoft is the company that actually
Speaker 1: gave the malware its name, and the company named it
Speaker 1: that by combining some elements of code that were found
Speaker 1: in the virus itself, including the file name for one
Speaker 1: of the driver modules, which was m R x net
Speaker 1: dot sis. At this time, virus Block Ada had updated
Speaker 1: its anti virus software to sniff out stucks net. It
Speaker 1: was looking for any sort of markers that would identify
Speaker 1: stucks net, and the company discovered that the malicious code
Speaker 1: had infected many computers across the Middle East. In particular,
Speaker 1: on July, a Slovakian security firm called e Set e
Speaker 1: s Et discovered a new driver module that seemed to
Speaker 1: be very similar to the stocks net one that was
Speaker 1: previously identified. This one had a digital certificate from a
Speaker 1: different company called j Micron Technology, which was also from
Speaker 1: Taiwan and in fact was located just a couple of
Speaker 1: blocks away from Real Tech. The malware appeared otherwise to
Speaker 1: be pretty much the same as its predecessor, So why
Speaker 1: did it have a different digital certificate? Well, part of
Speaker 1: the reason was that the real tex orti get had
Speaker 1: expired in June two thousand and ten, so you couldn't
Speaker 1: infect new computers using it. Windows would not allow a
Speaker 1: driver with an expired digital certificate to install itself on
Speaker 1: a computer without notifying the user. The new legitimate digital
Speaker 1: certificate from j Micron Technology could sidestep that problem. The
Speaker 1: new attack may have launched on July four, just two
Speaker 1: days after Ulison had made his findings public, and it's
Speaker 1: possible that the malware was released hurriedly in reaction to
Speaker 1: the announcement, and it what might have been an attempt
Speaker 1: to infect as many computers as possible before Microsoft could
Speaker 1: patch the vulnerability. There's some evidence to support this hypothesis,
Speaker 1: as the code in this release was a little less
Speaker 1: buttoned down than the original attack had been back in
Speaker 1: two thousand nine. And by some evidence, I mean there
Speaker 1: were some sloppy mistakes. The digital certificate contained a block
Speaker 1: of information about the company that issued the certificate, kind
Speaker 1: of like a you know, a little bit of information
Speaker 1: about J Mikron, and that bit of information included a
Speaker 1: u r L to a J Mikron website, except there
Speaker 1: was a typo in the u r L, and so
Speaker 1: any attempt to visit that particular address would return a
Speaker 1: Server not Found error. Uh. If anyone had tried it,
Speaker 1: they might have said, well, this is kind of strange
Speaker 1: that a company would issue a digital certificate and yet
Speaker 1: have the wrong u r L in there. You would
Speaker 1: think that for something that important they would make absolutely
Speaker 1: certain they had correct information included so that was one
Speaker 1: red flag. There were also fields within the certificate that
Speaker 1: had the value change me written in them instead of
Speaker 1: whatever information should have been there. Now clearly that was
Speaker 1: a note written by a hacker to his or her
Speaker 1: team as a placeholder, you know, don't let this go
Speaker 1: out before you change it, but it was never actually
Speaker 1: replaced or changed. Those elements suggest the malware was rushed
Speaker 1: out the door ahead of plan. Researchers later determined that
Speaker 1: the original attacks happened in three waves. June of two
Speaker 1: thousand nine was the first one and used an auto
Speaker 1: run attack. March and April were the second two attacks,
Speaker 1: and then after that you end up with these approaches
Speaker 1: that we're using a different digital certificate. It didn't appear
Speaker 1: to have anything to do with identity theft, didn't have
Speaker 1: anything to do with creating a botan net, So why
Speaker 1: would you design code that can infect millions of machines
Speaker 1: but it didn't actually cause harm to the host computers
Speaker 1: or do anything else of any real consequence. Frank Baldwin,
Speaker 1: a cybersecurity expert in Germany, discovered the first clues as
Speaker 1: two stucks nets purpose. Baldwin had analyzed the code and
Speaker 1: noticed that appeared to have been designed to target computers
Speaker 1: that had a particular type of software on it. That
Speaker 1: software came from the German company Siemens that I mentioned earlier. Now,
Speaker 1: they make lots of different stuff, including software for other
Speaker 1: businesses and particular software, or to be more specific, the
Speaker 1: two programs that this virus was searching for. Whenever it
Speaker 1: would infect a computer, it would look to see if
Speaker 1: one or both of these programs was installed. Also on
Speaker 1: that computer, there were for industrial control systems. It's the
Speaker 1: sort of thing you would find in a manufacturing facility,
Speaker 1: so again like the controllers for things like valves or
Speaker 1: conveyor belts or other simple interconnected systems. Now, Baldwin's hypothesis
Speaker 1: was that the malware was a type of industrial espionage.
Speaker 1: He thought perhaps a company had created this malware in
Speaker 1: an attempt to spy on competitors and learn how they
Speaker 1: operate in an effort to gain a market advantage over them.
Speaker 1: That wasn't exactly the right track, but at least showed
Speaker 1: that this malware was meant for a very specific reason.
Speaker 1: What that reason was I've kind of alluded to already,
Speaker 1: but we're going to dive into more of that in
Speaker 1: our next episode to really look at how ducks Net
Speaker 1: unraveled and what were the motivations behind it, who was responsible,
Speaker 1: and what was the fallout from this stuff. Uh, there's
Speaker 1: no pun in that there was no nuclear fallout. I
Speaker 1: want to be clear about that, because otherwise this would
Speaker 1: be a very dark series of episodes. As it stands,
Speaker 1: it's still pretty scary because we're talking about cyber warfare
Speaker 1: at this point, using computers to create real world physical effects,
Speaker 1: which is pretty phenomenal. Up to this point, most people
Speaker 1: thought of that as being just theoretical, that computers could
Speaker 1: do a lot of damage to data and could create
Speaker 1: a nuisance, but couldn't necessarily cause physical damage to the
Speaker 1: real world around us. Stocks Net proved we shouldn't be
Speaker 1: so sure about that again. I'll talk about that more
Speaker 1: in our next episode. If you guys have suggestions for
Speaker 1: tech topics I should cover in the future, maybe it's
Speaker 1: a company, maybe it's a specific technology, maybe it's a
Speaker 1: per soon in tech who you think I should profile,
Speaker 1: let me know. Or if there's someone you think I
Speaker 1: should interview or have on as a guest co host,
Speaker 1: let me know that as well. You can get in
Speaker 1: touch with me through email. The address for the show
Speaker 1: is tech stuff at how stuff works dot com, or
Speaker 1: draw me a line on Facebook or Twitter. The handle
Speaker 1: for both of those is tech stuff hs W. Follow
Speaker 1: us on Instagram, and of course you can watch me
Speaker 1: record this show live at twitch dot tv slash tech stuff.
Speaker 1: I typically record on Wednesdays and Friday's. There's a chat
Speaker 1: room there. You can join in on the merry band
Speaker 1: and have fund high spirited conversation about that weird thing
Speaker 1: I just said and had to go back and fix
Speaker 1: so that the podcast listeners will never know, but you'll
Speaker 1: know because you're pretty darn cool. Well that's it for
Speaker 1: me for now. I'll talk to you again really soon
Speaker 1: for more on this and thousands of other topics. Is
Speaker 1: that how stuff works dot com m