Speaker 1: Get in tech with technology with tech Stuff from how
Speaker 1: stuff works dot com. Hey there, and welcome to tech Stuff.
Speaker 1: I am your host, Jonathan Strickland. I'm an executive producer
Speaker 1: here at how Stuff Works and I love all things tech.
Speaker 1: And if you listen to the previous episode, you heard
Speaker 1: part one of what was Up with stocks Net, the
Speaker 1: infamous computer virus that made headlines in ten and opened
Speaker 1: up a new era of cyber warfare. If you have
Speaker 1: not already listened to that episode, I recommend you go
Speaker 1: do it, because we're gonna pick up right where we
Speaker 1: left off now. In the previous episode, I set the
Speaker 1: ground by talking about how Iran had been pursuing a
Speaker 1: nuclear power strategy and potentially developing nuclear weapons as well,
Speaker 1: much to the constern nation of other nations like the
Speaker 1: United States, and that at some point at a uranium
Speaker 1: enrichment facility in Iran, people began to notice that centrifuges
Speaker 1: were really acting up. They were breaking down way more
Speaker 1: frequently than they should have been considering their age and
Speaker 1: how much they were working. At the same time, there
Speaker 1: was this tiny little anti virus company that had found
Speaker 1: some sort of weird code on an Iranian machine that
Speaker 1: was having a problem. It was constantly crashing and rebooting,
Speaker 1: and that led to the discovery of some malware that
Speaker 1: Microsoft would later name stuck s net. That malware would
Speaker 1: affect various machines running on different versions of Windows, and
Speaker 1: it seemed really really virulent, like it would very quickly
Speaker 1: infect a machine, but no one was really sure what
Speaker 1: it was doing. At this point. They they had not
Speaker 1: really unraveled the payload of the malware. They more or
Speaker 1: less understood how it was spreading, how it was going
Speaker 1: from one computer to the next, but they weren't sure why, like,
Speaker 1: what was the purpose of it? What did it actually do?
Speaker 1: And that's kind of where we pick up now. The
Speaker 1: date we're talking about is July. This is less than
Speaker 1: a week after the news broke about stocks net actually
Speaker 1: being a thing, And there was a security analyst with
Speaker 1: Samantech named Liam Omerchu who took a look at the
Speaker 1: main stucks net file and he was gob smacked. The
Speaker 1: file was way larger than your typical malware would tend
Speaker 1: to be. Malicious software is usually pretty simple. It's often inelegant,
Speaker 1: and it might only be fifteen kilobytes in size or less.
Speaker 1: It just needs to be big enough to do whatever
Speaker 1: it is the hacker intended for it to do, and
Speaker 1: smaller sizes are usually easier to slip in through something
Speaker 1: else than something that's larger. But Stuck's net was different.
Speaker 1: It was five kobyites, much larger than your typic a malware,
Speaker 1: and it didn't seem to contain any filler data in it.
Speaker 1: It wasn't like there was some sort of extra piece
Speaker 1: of data to make it look like it was something else,
Speaker 1: like a JPEG or a music file or something along that.
Speaker 1: Oh Murchu saw that the file had been through a
Speaker 1: packer sort of like a ZIP application, something that would
Speaker 1: compress the file. What's more, the people who had made
Speaker 1: it used an off the shelf compressor called Ultimate Packer
Speaker 1: for execute Able or up X, so they didn't bother
Speaker 1: to make their own tool. They used en off the
Speaker 1: shelf tool that made it very easy to unpack because
Speaker 1: all you had to do is have a copy of
Speaker 1: this tool. So oh Murchu was able to unpack this
Speaker 1: file without very much fuss. But here's the thing. Even
Speaker 1: though this wasn't a case where hackers had created a
Speaker 1: customized packer, which would make it more difficult to detect uh.
Speaker 1: The simple compression was a bit of a h I
Speaker 1: don't want to say a trap, but it was certainly
Speaker 1: misleading because the rest of the file showed that they
Speaker 1: had gone to a considerable length to hide what was
Speaker 1: happening and to create a very sophisticated type of malware.
Speaker 1: The unpacked file ballooned in size to one point one
Speaker 1: eight megabytes. Remember it had been five kilobytes, so this
Speaker 1: is more than twice the size of that packed file.
Speaker 1: At this stage, Omerchu saw what Baldwyn had noticed. Baldwyn,
Speaker 1: of course, was the analyst I talked about in the
Speaker 1: last episode who had discovered that there were references to
Speaker 1: two different pieces of software created by a German company
Speaker 1: called Siemens that made programs that were designed for other businesses.
Speaker 1: So this was the point where Omerchu saw that same information.
Speaker 1: The payload of the virus took the form of a
Speaker 1: d l L file. D l L stands for Dynamic
Speaker 1: Link lie Bray. It's a file extension found in Windows machines.
Speaker 1: The stocks net DLLL contained smaller d l l's within it,
Speaker 1: and each of those layers were encrypted, so it was
Speaker 1: like unraveling it you found another puzzle, and inside that
Speaker 1: was another puzzle, and the puzzles all were using different
Speaker 1: strategies in order to encrypt them, so it made it
Speaker 1: very tricky to find out what it should actually this
Speaker 1: thing was supposed to do. He also saw the stocks
Speaker 1: net was being incredibly sneaky. The malware was designed to
Speaker 1: live in a computer's memory, so instead of a computer
Speaker 1: referencing it's hard drive space in order to pull up
Speaker 1: information from the malware, which would make it easier to
Speaker 1: actually track down if you were looking for it, it
Speaker 1: would just reference it in its actual memory. And it
Speaker 1: altered the application programming interface for Windows so that it
Speaker 1: could execute code without getting picked up by anti virus software. Essentially,
Speaker 1: when Windows would go to execute a process related to
Speaker 1: Stuck's Net, the altered a p I would direct that
Speaker 1: inquiry to the file resting in the computer's memory beneath
Speaker 1: detectable levels, so the computer would just from its perspective,
Speaker 1: look like everything was working perfectly, but in reality, things
Speaker 1: were getting re routed so that it was covering up
Speaker 1: the viruses tracks. Stucks Net would also hide its processes
Speaker 1: within other processes, so it was abbuse skating what was
Speaker 1: going on, and it was really a confusing and effective
Speaker 1: way to hide what was actually happening. Oh Mrchue's conclusion
Speaker 1: was that the programmers who made this must have really
Speaker 1: known their stuff, and they must have worked really hard
Speaker 1: to make it difficult to detect stucks net even without
Speaker 1: a thorough or even with rather a thorough investigation. Oh
Speaker 1: Virtue also saw that the code had been encrypted and
Speaker 1: that it contained further encrypted files within it, and whomever
Speaker 1: had set it up had gone to great pains to
Speaker 1: get very difficult to get at the raw code, and
Speaker 1: he noted that the malware had an expiration date on
Speaker 1: it as well. That date was June two thousand twelve,
Speaker 1: and that meant that the malware would actually consult a
Speaker 1: computers onboard clock and look and see what day it is,
Speaker 1: what time it is. If the date was after June
Speaker 1: two thousand twelve, the malware wouldn't install itself on the
Speaker 1: target computer. So it was like a checklist, like, check
Speaker 1: the date is it before June two thousand twelve, It
Speaker 1: is gravy, let's go there. If it was after, like
Speaker 1: too late now and stop. So any computers previously infected
Speaker 1: with stucks net could continue and would continue to be compromised.
Speaker 1: They wouldn't magically become clear on June twelve, but no
Speaker 1: new computers would get infected by stocks net. Oh Merchu
Speaker 1: and his team also found that the malware had a
Speaker 1: phone home kind of feature. Every single time it infected
Speaker 1: a new computer, the malware would attempt to send a
Speaker 1: message back to headquarters. The headquarters was masked by using
Speaker 1: two domains that appeared at least on casual inspection to
Speaker 1: belong to soccer fans. One u r L was To
Speaker 1: Day's Football dot com Football spell fu t b o L,
Speaker 1: and the other was My Premieer My Premier Football dot
Speaker 1: com and again football Fu t b o L. The
Speaker 1: owner of the domains was unknown, but when they started
Speaker 1: to take a closer look at it, they realized that
Speaker 1: the registration had a fake name attached to it and
Speaker 1: that the credit cards associated with the account were fraudulent.
Speaker 1: The servers hosting the domains were in Malaysia and Denmark,
Speaker 1: but that didn't really necessarily mean anything. It was just confusing.
Speaker 1: The phone home messages included a small amount of encrypted data.
Speaker 1: O Merchu's team was able to break the encryption, however,
Speaker 1: and they saw that an infected machine would send a message.
Speaker 1: They gave the server the infected machines internal I P address,
Speaker 1: which version of Windows the machine was using, and whether
Speaker 1: or not that machine also happened to have those two
Speaker 1: Siemens programs installed on it. Eventually, the researchers figured out
Speaker 1: that stucks net would shut itself down if it could
Speaker 1: not find evidence of those Siemens programs on the host machine.
Speaker 1: The virus would continue to try and infect other machines
Speaker 1: from its infected host if it were on a network system,
Speaker 1: but otherwise it would not unleash it's payload if the
Speaker 1: Siemens programs weren't present, which was also confusing because here
Speaker 1: you had some malware that was so specific that it
Speaker 1: only leapt into action if those two programs were on
Speaker 1: the host computer. Otherwise it wouldn't do anything at all.
Speaker 1: So it clearly wasn't meant to rek havoc across all machines.
Speaker 1: It was still problematic that was infecting lots of different computers,
Speaker 1: because obviously you never want to have malware infect your computer.
Speaker 1: But if you didn't have those Siemens programs on your computer,
Speaker 1: it didn't do anything else apart from a tip to
Speaker 1: In fact, other computers network to yours. It didn't mess
Speaker 1: with your files, it didn't encrypt anything without your permission,
Speaker 1: it didn't delete anything. Everything was fine. So a lot
Speaker 1: of the code and implementation suggested that stocks net was
Speaker 1: probably the product of years of work from at least
Speaker 1: one or two or maybe three teams of talented programmers.
Speaker 1: There were some gaps in the code and implementation, however,
Speaker 1: that led some security experts to call it perpect perplexing,
Speaker 1: lye sloppy, or careless. One of those was Nate Lawson,
Speaker 1: who's a cryptographer, who criticized the code and said that
Speaker 1: it smacked of amateurism in many ways. And here's a
Speaker 1: direct quote. He said, I really hope it wasn't written
Speaker 1: by the USA, because I'd like to think our elite
Speaker 1: cyber weapon developers at least know what Bulgarian teenagers did
Speaker 1: back in the early nineties. Sick Burn Lawson. As part
Speaker 1: of their research, Ovirtua and his team over its Sumantech
Speaker 1: had contacted the domain name system service providers that were
Speaker 1: responsible for those two U r l's, and they decided
Speaker 1: to create a new destination for all those communications. Uh.
Speaker 1: It was kind of like a just a redirect, so
Speaker 1: these messages that were supposed to go to these two
Speaker 1: u r l's that we're posing as soccer fan sites
Speaker 1: would instead end up going Samantech. And they were hoping
Speaker 1: that by looking at the messages that these computers were
Speaker 1: sending back, they might be able to figure out what
Speaker 1: the heck this malware was trying to do. So they
Speaker 1: started looking for any patterns to get a better idea
Speaker 1: of what was going on, and one of the things
Speaker 1: they saw was that the majority of computers that were
Speaker 1: sending the messages were in Iran. Iran also had the
Speaker 1: most computers hosting the sought after Siemens programs, so that
Speaker 1: made them suspect that perhaps the people who made this
Speaker 1: malware were targeting Iran specifically for some reason. And the
Speaker 1: path Iran computers had never really been at the high
Speaker 1: end of infection rates whenever malware would break out, so
Speaker 1: that suggested to the team that they must have been
Speaker 1: the intended target, otherwise their percentage would not be so high. Uh,
Speaker 1: someone had to be concentrating on them. Working with that
Speaker 1: information that Iran was in fact the intended target, and
Speaker 1: then the virus was specifically looking for machines that had
Speaker 1: a particular type of industrial control software on it. They
Speaker 1: started to form hypotheses as to what the purpose of
Speaker 1: the malware could have been. So one possible explanation is
Speaker 1: that was part of an espionage project aimed at Iran's
Speaker 1: nuclear power program. Uh Natan's had attracted worldwide attention, as
Speaker 1: it could have been a front operation that appeared to
Speaker 1: be making nuclear fuel for power purposes, but in reality
Speaker 1: was secretly enriching uranium in order to make nuclear weapons,
Speaker 1: So that was one of the possibilities. They also thought
Speaker 1: that maybe it was targeting perhaps gas pipelines or electric
Speaker 1: power grids. They weren't entirely sure. Also, the propagation methodology
Speaker 1: suggested that perhaps the programmers had wanted to infect machines
Speaker 1: belonging to engineers who were responsible for transferring commands to
Speaker 1: programmable logic controllers or p lcs. Those are the type
Speaker 1: of controllers that the Siemens software would communicate with. Those
Speaker 1: commands would exist on air gapped systems, and typically you
Speaker 1: would transfer the commands by downlaying the commands the proper
Speaker 1: set of instructions onto a USB stick, and then you
Speaker 1: would transfer the commands to a computer responsible for controlling
Speaker 1: the p lcs via that USB stick, So you don't
Speaker 1: have the machine the kind of the overseer for all
Speaker 1: these plc's connected to the Internet, that would be a
Speaker 1: security vulnerability. Instead, you would create the program instructions on
Speaker 1: a different machine, put it on USB stick, and then
Speaker 1: transferred over to the overseer computer. And uh. The problem
Speaker 1: was that stucks net would propagate it self and copy
Speaker 1: itself onto USB sticks that were inserted onto computers that
Speaker 1: had been infected by stocks net. So you could have
Speaker 1: an engineer who's just innocently trying to transfer some commands
Speaker 1: to another computer actually infect that computer, so the engineers
Speaker 1: themselves became the carriers of the virus. If one worked
Speaker 1: from the hypothesis that the code was in fact meant
Speaker 1: to target computers at Iran's uranium enrichment facility, it narrowed
Speaker 1: done the list of potential attackers. For one thing, the
Speaker 1: sophistication of the code, the links the hackers went to
Speaker 1: in order to avoid detection, and the rapid response to
Speaker 1: the presence of the code being announced to the world
Speaker 1: in general suggested that there must have been a state
Speaker 1: sponsored group, a government funded attempt, So whomever was doing
Speaker 1: this had access to some pretty extensive resources. The candidates
Speaker 1: that people were identifying early on included Russia China, both
Speaker 1: of them had been working on date sponsored cyber warfare
Speaker 1: strategies for a few years. Israel was another possibility, and
Speaker 1: then there was, of course, the United States. There was
Speaker 1: also the chance that Iran had somehow developed this malware
Speaker 1: itself and then accidentally unleashed it on its own computers,
Speaker 1: but that was considered a lesser possibility. So who done it?
Speaker 1: I'll talk more about that in a second, but first
Speaker 1: let's take a quick break to thank our sponsor. So
Speaker 1: while they were looking through the code, the semantic team
Speaker 1: noted that they saw something that looked like it was
Speaker 1: a date that was written out in Unix format. So
Speaker 1: when you unscramble that the date would have been May nine,
Speaker 1: nineteen seventy nine, and this was a potential hint as
Speaker 1: to the origin of this malware. On May nine, the
Speaker 1: Iranian government executed a businessman named Habib El Ghanian by
Speaker 1: fire by firing squad so al Ghanian had been accused
Speaker 1: of spying on Iran on behalf of Israel. He was
Speaker 1: a philanthropist and a member of the Jewish community in Iran,
Speaker 1: and he was then accused by the government saying you
Speaker 1: aren't actually you're an Israeli spy. There was nothing in
Speaker 1: the code itself that would directly link to that event.
Speaker 1: There were no mentions of the name El Ghanaian in there,
Speaker 1: but there was that date and that was something that
Speaker 1: kind of stood out to the team when they were
Speaker 1: thinking about They did a Google search on that date
Speaker 1: to see if anything notable had happened, and when they
Speaker 1: saw that, they thought, huh, because one of the entities
Speaker 1: we thought about as possibly being responsible for this was Israel,
Speaker 1: so maybe that's an implication there. So I thought maybe
Speaker 1: this is a actually a long run at some form
Speaker 1: of retribution in response to that execution. There was another
Speaker 1: potential reference to Israel that was found in this code,
Speaker 1: although this one is definitely very tenuous, and that was
Speaker 1: in the form of one of the file directories and
Speaker 1: a file that was found within that stuck snet code.
Speaker 1: The file directory contained the words Murtis m y r
Speaker 1: t u S and Guava. Murtis is the genus that
Speaker 1: Guava belongs to, and in Jewish history, there is a
Speaker 1: prominent figure named Queen Esther but before she became Queen
Speaker 1: Esther's name was Hadasa, which is the Hebrew word for
Speaker 1: myrtle or Murdis. Now, again, this was like a long
Speaker 1: shot connection if you're looking at this, but it was
Speaker 1: a possible clue that maybe someone from Israel was involved. However,
Speaker 1: other people pointed out that there was another potential explanation
Speaker 1: for the Murtis name, that in fact it wasn't Murtis
Speaker 1: but my rt use because r TU could stand for
Speaker 1: remote riminal unit, So it wasn't, you know, a smoking
Speaker 1: gun by any stretch of the imagination. The Semantic team
Speaker 1: also saw that the stucks net code contained a function
Speaker 1: that logged every machine the malware had infected along its way,
Speaker 1: So that instance of malware, once it passed from one
Speaker 1: machine to another, it would send a note back to
Speaker 1: h Q, and that note would include, hey, I jumped
Speaker 1: from machine A to machine B. So by looking at
Speaker 1: an instance of the malware, you could track all the
Speaker 1: machines and it infected. In fact, you could trace the
Speaker 1: infection from the last point all the way to the
Speaker 1: very first one. So if you intercepted the message, as
Speaker 1: Semantic had been doing, because they had contacted those domain
Speaker 1: name servers to send that traffic to them instead of
Speaker 1: to those bogus soccer sites. You could actually trace back
Speaker 1: every infected machine to that point of infection, and from
Speaker 1: there you could look at the computers that were initially
Speaker 1: targeted as the starting point. Using that method, they identified
Speaker 1: five companies in Iran that served as the insertion points
Speaker 1: for the malware, and according to Samantech, those five companies
Speaker 1: accounted for twelve thousand infected machines at those locations and
Speaker 1: were responsible for an additional one hundred thousand more machine
Speaker 1: infections in more than one hundred countries. Now, one of
Speaker 1: the reasons stucks net was uncovered so quickly, relatively speaking,
Speaker 1: was because the designers had made it so viral. Using
Speaker 1: USB as an injection method helped reduce the target zone
Speaker 1: for the virus, but still the methods that stucks net
Speaker 1: depended upon to go from machine to machine pretty much
Speaker 1: guaranteed that it would eventually infect computers outside of its
Speaker 1: intended target zone. Most people agree that the stucks net
Speaker 1: designers wanted to really contain the infection. They just wanted
Speaker 1: to surgically target specif efect machines, but they also really
Speaker 1: really wanted to get a hit, So it was kind
Speaker 1: of a balancing act. How do you make sure that
Speaker 1: your malware is virulent enough so that you are guaranteed
Speaker 1: to hit your target, but you don't want it spreading
Speaker 1: throughout the world. They thought they got a good balance,
Speaker 1: especially with a USB delivery methodology, but as it turns out,
Speaker 1: it definitely expanded beyond Iran's borders, and that in turn
Speaker 1: made it more likely that someone was going to figure
Speaker 1: out that it existed. And once you know it exists,
Speaker 1: you can start to make countermeasures and protect yourself against
Speaker 1: it and try to remove the virus from infecting machines.
Speaker 1: So that computer that was caught in that crash reboot
Speaker 1: phase ended up being a red flag. But even if
Speaker 1: that computer had not failed at that time, some other
Speaker 1: machine would surely have done something similar and then stucks
Speaker 1: that would have been uncovered. So it probably would have
Speaker 1: just been another month, maybe two months. It's impossible to
Speaker 1: say because history is already unfolded. But it wouldn't have
Speaker 1: gone unknown forever, because again, it was just it was
Speaker 1: too violent. It was moving beyond the intended audience or
Speaker 1: intended targets. Even at the stage however, no one was
Speaker 1: totally sure what Stuck's net was actually doing. They knew
Speaker 1: what how it was doing things like how it was
Speaker 1: infecting machines, and they knew that it was looking for
Speaker 1: this Siemens software packages, but it didn't know why, what
Speaker 1: is its purpose? It was clearly searching for logic controllers,
Speaker 1: so stuff that was going to control industrial equipment. This
Speaker 1: was not something that was meant to infect the average
Speaker 1: person's PC. It was very much an industrial approach and
Speaker 1: it was targeting Iranian companies that seemed to be clear
Speaker 1: and security researchers had figured out that stucks net would
Speaker 1: replace a legitimate DLL file for a Siemens software package
Speaker 1: with what appeared to be a duplicate, and in fact
Speaker 1: it could do all of the functionality of the original
Speaker 1: DLL file. It just had a few extra tricks up
Speaker 1: its sleeve, like it could overwrite instructions to logic controllers
Speaker 1: which could be used to sabotage machinery. So, in other words,
Speaker 1: you send a command to a particular industrial device, this
Speaker 1: malware could potentially change that command. Not only could it
Speaker 1: change it, it could send feedback that the intended command
Speaker 1: was the one that went through, so to you when
Speaker 1: you review it it looks like, oh no, everything did
Speaker 1: exactly what was supposed to do. I mean, I told
Speaker 1: it to do X, and according to the computer log
Speaker 1: that's what happened. It did X. But in reality it
Speaker 1: did Why. It's just that the Duck's net was such
Speaker 1: a clever, clever little piece of software. It could cover
Speaker 1: up its tracks and make you think that everything was
Speaker 1: working the way it was supposed to, and yet stuff
Speaker 1: was breaking. The malware would also sent dormant for about
Speaker 1: two weeks and just record all operations that would go
Speaker 1: on during those two weeks, but it wouldn't change anything. Then,
Speaker 1: when the malware would start messing with stuff, start changing
Speaker 1: those operations, start changing those commands internally, it would replay
Speaker 1: the recordings of those operations from the previous two weeks.
Speaker 1: This is kind of like movies, you know, like in Speed,
Speaker 1: where Keano Reeves's character is able to get the video
Speaker 1: footage of him on the bus repeated on a loop
Speaker 1: so that Dennis Hopper's character doesn't get wise that they're
Speaker 1: actually trying to get off the bus and instead they're
Speaker 1: just being really focused about going more than There are
Speaker 1: a ton of movies that do this where someone has
Speaker 1: messed with a security camera, so it's just showing a
Speaker 1: repeated loop of video while they go and do something sneaky.
Speaker 1: That's exactly what this this virus was doing, except instead
Speaker 1: of being video footage, it's a recording of the operations
Speaker 1: that it was going through. On August, a Semantech team
Speaker 1: went public with the assertion that stuck net was designed
Speaker 1: to cause physical damage to infrastructure controlled by logic controllers.
Speaker 1: They still weren't sure exactly what type of systems might
Speaker 1: be the targets. They suspected it was nuclear power plants
Speaker 1: or nuclear enrichment facilities, uranium enrichment facilities, but they weren't
Speaker 1: entirely certain. They said it could be gas lines, or
Speaker 1: it could be something else. But they figured the purpose
Speaker 1: was not to steal information, but rather actual sabotage to
Speaker 1: cause physical damage to targets, and that would be the
Speaker 1: first documented case of actual cyber warfare. Five days later,
Speaker 1: a little bit later in August, Iranian officials ordered the
Speaker 1: outbound connections to those two dummy u r l's that
Speaker 1: had been gathering in from a on stocks net infective
Speaker 1: machines to be severed within the country. So, in other words,
Speaker 1: that information would not go outside of Iran anymore. If
Speaker 1: it was being directed to those two domains, the machines
Speaker 1: were still infected, they just couldn't send back information to
Speaker 1: h Q. A security analyst named Ralph Langner, who specialized
Speaker 1: in p lcs those logic controllers that were being affected,
Speaker 1: was looking into stocks net. Now. Normally, he and his
Speaker 1: analysts wouldn't bother with computer viruses because that wasn't their field.
Speaker 1: Their field was looking at logic controllers. But since stucks
Speaker 1: net targeted logic controllers through Windows based machines, he felt
Speaker 1: it was necessary to understand that malware a little bit better,
Speaker 1: and he deduced that the real purpose of the malware
Speaker 1: was to disrupt Iran's nuclear program. He published a few
Speaker 1: blog posts about this in September. The first was titled
Speaker 1: Hack of the Century, and in those blog posts he
Speaker 1: laid out his hypothesis that Stuck's net was targeting centrifuges
Speaker 1: in Iran for the purposes of destroying them and disrupting
Speaker 1: Iran's plans at the very least now Mistakenly, he identified
Speaker 1: the nuclear power plant Bouchere as the target because he
Speaker 1: thought that the uranium enrichment facilities were co located at
Speaker 1: the nuclear power plant. In reality, they were not, They
Speaker 1: were miles away in Natans, but he thought Boucher was
Speaker 1: probably the target at the time. It was later Frank Reager,
Speaker 1: who worked for a German security firm called g S
Speaker 1: m K, who identified Natans as the target for the
Speaker 1: malware rather than Boucher. As for who was behind it, well,
Speaker 1: all signs pointed to a joint United States Israeli operation.
Speaker 1: As early as two thousand five, advisors were asking President
Speaker 1: George Bush to do something about Natans. Israeli officials were
Speaker 1: asking about an air strike, but Bush was not eager
Speaker 1: to go down that path. This is George W. Bush,
Speaker 1: by the way, the second George Bush. The United States
Speaker 1: was already at that time involved in armed conflicts in
Speaker 1: Iraq and Afghanistan. They were not going terribly well. It
Speaker 1: was very slow going and had a lot of negative
Speaker 1: publicity about it. So George W. Bush wasn't really eager
Speaker 1: to also throw Iran into the mix. Cyber war experts
Speaker 1: suggested to the president that a digital strike was possible
Speaker 1: and laid out their idea for using code to disrupt
Speaker 1: critical operations in the Iranium enrichment facility and actually damage
Speaker 1: and destroy centrifuges just by using code. Now, at the time,
Speaker 1: this was still considered a pretty radical idea. They decided
Speaker 1: that this was a decent line of attack. They got
Speaker 1: to go ahead, got the code name Operation Olympic Games
Speaker 1: behind the scenes, but uh yeah, and went ahead. And
Speaker 1: now it's never been officially acknowledged, but the reports that
Speaker 1: have come out since the time of stuck s net
Speaker 1: stated that President Bush had requested four hundred million dollars
Speaker 1: from Congress to fund covert operations with the purpose of
Speaker 1: interfering with Iran's nuclear program, and Congress said okey doke. Now,
Speaker 1: not all of that money went to the development of
Speaker 1: stuck snat, some of it went towards other efforts to
Speaker 1: stir up trouble in Iran. The plan was to slow
Speaker 1: down Iran's uranium enrichment operations. There were no illusions that
Speaker 1: their efforts would destroy the facility, but rather gum up
Speaker 1: the works enough to keep Iran from making a lot
Speaker 1: of progress while they figured out another way to confront
Speaker 1: the situation. Reportedly, General James Cartwright of the U S
Speaker 1: Strategic Command and Keith Alexander, who was a former n
Speaker 1: s A director. Were in charge of the high level
Speaker 1: planning for Operation Olympic Games. The n s A and
Speaker 1: an Israeli team from Defense Forces Unit AT eight two hundred,
Speaker 1: which is kind of their version of the n s A.
Speaker 1: We're responsible for actually developing the code. By changing the
Speaker 1: rotational speed of the centrifuges repeatedly, they could cause the
Speaker 1: machines to tear themselves apart. Now, there was no danger
Speaker 1: of a nuclear explosion. It wasn't like they were going
Speaker 1: to trigger some sort of catastaclismic event. But the uranium
Speaker 1: was just a gas form, so if you made the
Speaker 1: centrifuges break, it would kind of disperse into the air. Now,
Speaker 1: it was dangerous for humans to be exposed to uranium gas,
Speaker 1: but it wasn't explosive or anything like that. It apparently
Speaker 1: took about eight months for the time the plan was
Speaker 1: approved to when it was ready to be implemented, which
Speaker 1: was a really fast turnaround. The team presented pieces of
Speaker 1: a destroyed centrifuge to President Bush as proof that their
Speaker 1: idea of using computer code to tear physical machinery apart
Speaker 1: was legitimate. They had acquired sub centrifuges the exact saint
Speaker 1: kind that Iran had been relying upon, and they had
Speaker 1: run several tests using code to change up the frequency
Speaker 1: at which the centrifuge would rotate, and they changed it
Speaker 1: repeatedly until it would literally spin itself into pieces. So
Speaker 1: they created an early build of what would become Stuck's net.
Speaker 1: Later on people would refer to it as Stuck's Net
Speaker 1: point five. This version of its some helm eventually found
Speaker 1: its way onto computers in Iran, though the version there
Speaker 1: didn't target the spinning motor of the centrifuges. Instead, it
Speaker 1: was targeting valves that controlled the flow of uranium gas
Speaker 1: into and out of the centrifuges, So they can mess
Speaker 1: with the the gas pressure inside the centrifuge, but they
Speaker 1: could not change the rotation speed. When President Obama took
Speaker 1: office in two thousand eight, he was reportedly informed of
Speaker 1: the operation, and he decided to have it continue because
Speaker 1: a non military intervention in Iran's nuclear plan was still
Speaker 1: preferred to the alternative. I got a little bit more
Speaker 1: to talk about as far as Stuck stat as concerned,
Speaker 1: but before I get into this last section, let's take
Speaker 1: another quick break to thank our sponsor. All Right, We've
Speaker 1: talked a lot about the payload. We talked a lot
Speaker 1: about the delivery system of stocks net. We talked about
Speaker 1: what it was meant to do. Was meant to disrupt
Speaker 1: Iran's nuclear program. So the question is did it actually
Speaker 1: succeed in what it was supposed to do well? That
Speaker 1: is actually debatable. If we assume, as has been reported,
Speaker 1: that the goal of the malware was to slow down
Speaker 1: Iran's nuclear plan, the answer is a kind of succeeded.
Speaker 1: Despite stocks net and other strategies that were employed at
Speaker 1: the same time they were all designed to limit Iran's
Speaker 1: nuclear capabilities, the country was able to produce more enriched
Speaker 1: uranium in than it had in previous years. The country
Speaker 1: made less of it than what they had anticipated. They
Speaker 1: had projected that they would make much more than what
Speaker 1: they did because of the setbacks they experienced from stocks
Speaker 1: net and other measures, but still, year over year, they
Speaker 1: produced more enriched uranium. So while Iran wasn't where the
Speaker 1: government officials wanted it to be in terms of its
Speaker 1: nuclear aspirations, it was still making progress, just more slowly
Speaker 1: than what they wanted. Stocks Net also ended up opening
Speaker 1: up the possibility of a new era of cyber warfare.
Speaker 1: There had already been plenty of incidents of state sponsored
Speaker 1: hackers inserting malicious code into the infrastructure of other nations,
Speaker 1: so that was not new. But this stucks Net marked
Speaker 1: the first documented case of someone using computers to cause
Speaker 1: physical damage to a country's equipment. And once people saw
Speaker 1: what was possible, and there would be future attempts that
Speaker 1: would be built on that same realization. So that's not great.
Speaker 1: One of stocks nets legacies was a warning that it's
Speaker 1: no longer just a world in which computers can be
Speaker 1: the targets. Programmable logic circuits are legit targets, and they're
Speaker 1: incorporated into all sorts of different critical infrastructure systems like
Speaker 1: power grids and gas pipelines, and unlike computers, there were
Speaker 1: no anti virus software packages that could protect p l
Speaker 1: c s. If you could protect the computers that interface
Speaker 1: with those plc's, you'd be pretty safe. But stucks net
Speaker 1: had shown that it was possible to make this very
Speaker 1: hard to do, and it concerned a lot of folks
Speaker 1: in multiple industrial organizations as a result. Imagine that just
Speaker 1: a few lines of code could cause billions of dollars
Speaker 1: in damages by making critical pieces of infrastructure fall apart
Speaker 1: or overheat or otherwise fail. It's kind of scary. Another
Speaker 1: legacy was that hackers would use the stux Net vector
Speaker 1: ers an approach in future malware attacks. It would use
Speaker 1: that same strategy, sometimes using the same vulnerabilities, because even
Speaker 1: though a operating system might patch a vulnerability once it's discovered,
Speaker 1: you still have to have that patch roll out to everybody.
Speaker 1: People have to update their operating systems. By the way,
Speaker 1: this is a good time to remind you to make
Speaker 1: sure your software is up to date, because if there
Speaker 1: are vulnerabilities that exist, those are active on your software
Speaker 1: if you haven't patched yet. So while everyone else would
Speaker 1: be immune to an attack that has been patched, the
Speaker 1: vulnerability that the attack would rely upon has been patched
Speaker 1: out of existence. If you haven't uploaded or updated rather
Speaker 1: your software with that patch, you're still potentially a victim.
Speaker 1: So make sure your software is up to date. Another legacy,
Speaker 1: besides the fact that now we have the fear of
Speaker 1: Stuck's net, was that you could end up getting a
Speaker 1: similar approach that had a different payload Entirely. One of
Speaker 1: those that seemed to fit this definition. At first, anyway
Speaker 1: was called Doku du key que you. Unlike stucks net,
Speaker 1: it did not have a payload aimed at programmable logic
Speaker 1: controllers or p lcs. Instead, it's payload had a key logger,
Speaker 1: and a key logger is a program that just records
Speaker 1: every key stroke made on the infected computer's keyboard. So
Speaker 1: it's a way to steal stuff like user names and passwords,
Speaker 1: as well as other information. But while this payload was different,
Speaker 1: the delivery mechanism that the malware relied upon was nearly
Speaker 1: identical to stocks net, and like stucks net, Doku had
Speaker 1: a self destruct code built into it. The malware was
Speaker 1: set to the leade itself and all traces of itself
Speaker 1: from a machine after thirty six days. As it turns out,
Speaker 1: it wasn't perfect that doing this, It actually would leave
Speaker 1: behind a few traces if you knew what to look for,
Speaker 1: but you had to find out about Dooku first, or
Speaker 1: else you wouldn't even know to look for the trace
Speaker 1: evidence it would leave behind. Now, the suggested to the
Speaker 1: Semantic team, the same team that had investigated the ducks
Speaker 1: Neat virus, that the code was intended as an advance
Speaker 1: scout to seek out target computers for the quote unquote
Speaker 1: real attack that would be sure to follow. So, in
Speaker 1: other words, it wasn't necessarily meant as an attack all
Speaker 1: in of itself. It was meant to identify potential target computers. Dooku,
Speaker 1: as it turned out, appeared to be designed to attack
Speaker 1: certificate authorities. Now, these are the companies that create those
Speaker 1: digital certificates I mentioned in the previous episode, and it
Speaker 1: does this on behalf of other organizations, and those digital
Speaker 1: certificates act as an authentication, a proof that a piece
Speaker 1: of software comes from a trusted source. So if you
Speaker 1: could compromise one of these organizations that creates these certificates,
Speaker 1: you could issue yourself seemingly legitimate certificates from all sorts
Speaker 1: of trusted sources and use that to deliver malware to
Speaker 1: many potential targets that would have next to no defense
Speaker 1: against it because their machines are trusting the source. They've
Speaker 1: been told by the operating system, Hey, you can let
Speaker 1: this guy in. I know him, he's cool. Later on,
Speaker 1: investigation into Dooku indicated that it actually preceded Stuck's net.
Speaker 1: It was an older virus. It just wasn't discovered till
Speaker 1: after stucks net had been discovered. It may have actually
Speaker 1: served as a guide for the team who designed stucks net.
Speaker 1: They may have relied upon Dooku's architecture to build stucks net.
Speaker 1: It did not use USB sticks to infect computers, however.
Speaker 1: Instead the code was hidden inside a bogus word document,
Speaker 1: and the document contained the malware that would explore eight
Speaker 1: a vulnerability in the font parsing engine for Windows. Dooku
Speaker 1: was suspected of gathering some of the information that stucks
Speaker 1: net would later capitalize on, but researchers also felt that
Speaker 1: the two malware packages had been designed by different teams
Speaker 1: who were working from essentially the same foundation. Another malware
Speaker 1: suite dubbed Flame by Kaspersky used a similar approach to
Speaker 1: stuck's net in some ways, but this malware was modular,
Speaker 1: meaning different payloads could be attached to the delivery mechanism,
Speaker 1: so the virus could do different things depending upon which
Speaker 1: modules you attached to it. It would determine what the
Speaker 1: code would actually do once the machine that you were
Speaker 1: targeting was infected. Uh some modules would end up activating
Speaker 1: a microphone so that you could record nearby speech. Some
Speaker 1: would take screenshots of the target computer screens. Others would
Speaker 1: just be key loggers or programs that could copy documents
Speaker 1: that were store it on the computer and send it
Speaker 1: back to a different computer, spying stuff in other words. Now,
Speaker 1: Flame was enormous. It was twenty megabytes, so that's huge.
Speaker 1: You know, stucks net when it was packed up was
Speaker 1: five kilobytes and it was considered big, But twenty megabytes
Speaker 1: was huge if you had all the different modules added in.
Speaker 1: And it was really interesting that someone had developed this
Speaker 1: very sophisticated approach to uh malware, something that could be
Speaker 1: adapted to specific uses, and you didn't have to include
Speaker 1: all the modules. You just include the ones that are
Speaker 1: important for whatever function you need. Um, it's pretty spooky
Speaker 1: stuff really, and like dooku. Further investigations suggested that Flame
Speaker 1: actually came before stucks net. Again, it was discovered after
Speaker 1: stucks net, but the compiling code suggested that it actually
Speaker 1: was made first, and it led some to suspect that
Speaker 1: the stucks net developers had first started using Flame as
Speaker 1: their guide to create their malware, but then later on
Speaker 1: they switched gears and use Dooku to finish it out.
Speaker 1: So that's the story about stocks Net. There's a lot
Speaker 1: we still don't know, and I would recommend that you know,
Speaker 1: if you're interested in learning more about this virus, check
Speaker 1: out that book I I talked about in the first episode.
Speaker 1: That book is count Down to Zero Day, stucks Net
Speaker 1: and the launch of the world's first digital weapon. The
Speaker 1: book goes into much more detail about the story of
Speaker 1: stucks Net and the people involved. It gives you background
Speaker 1: on each of them. They're very interesting folks too. You
Speaker 1: also learn other weird stories, like how different security firms
Speaker 1: could have worked with each other and maybe unraveled stocks
Speaker 1: net a little more quickly, but due to some issues
Speaker 1: with communication and maybe some ego problems that didn't happen.
Speaker 1: So I always find those kind of stories to be
Speaker 1: really interesting too, just as interesting as the political nature
Speaker 1: and the technological nature of this virus. It was kind
Speaker 1: of a perfect storm and really a fascinating and ultimately
Speaker 1: kind of scary topic. The idea of using code to
Speaker 1: make physical changes to our world in a destructive way
Speaker 1: is a little worrisome, maybe more than a little, especially
Speaker 1: when you consider the fact that investigators have found evidence
Speaker 1: of uh Chinese hacking code in power grid infrastructure in
Speaker 1: the United States. Maybe that's just there to spy. Maybe
Speaker 1: it's also there is a potential way to shut down
Speaker 1: parts of the power grid should China and the United
Speaker 1: States ever enter into a more aggressively antagonistic relationship with
Speaker 1: each other. That's the world we live in now. It
Speaker 1: helps to educate yourself, but I admit it is kind
Speaker 1: of scary, but hey, not all topics that tech stuff
Speaker 1: need to be scary. Maybe next week I'll talk about
Speaker 1: Teddy Ruxman being told by Tari that Teddy Ruxman is terrifying.
Speaker 1: But if you guys have any suggestions for future episodes
Speaker 1: of tech Stuff, get in touch with me. Let me know.
Speaker 1: Maybe there's a company you want me to talk about
Speaker 1: a specific technology. Maybe there's a guest I should have
Speaker 1: on the show, either as someone I should interview or
Speaker 1: someone who could be a guest co host for the day.
Speaker 1: Let me know your ideas. Send me the information on email.
Speaker 1: Here's the address text Stuff at how stuff works dot com,
Speaker 1: or you can drop me a line on Facebook or Twitter.
Speaker 1: The handle of both of those is text Stuff h
Speaker 1: s W. Make sure you follow us on Instagram and
Speaker 1: if you want to watch me record these shows live.
Speaker 1: Go to twitch dot tv slash tech Stuff. There's a
Speaker 1: schedule there that tells you when I go online, and
Speaker 1: there's a chat room you can join in and chat away,
Speaker 1: and I'll be happy to chat with you, and I'll
Speaker 1: talk to you again really soon. For more on this
Speaker 1: and that of other topics, is it how stuff Works
Speaker 1: dot com m