Speaker 1: Brought to you by the reinvented two thousand twelve Camray.
Speaker 1: It's ready. Are you get in touch with technology with
Speaker 1: tech Stuff from how stuff works dot com. Hello again, everyone,
Speaker 1: and welcome to tech stuff. My name is Chris Polett,
Speaker 1: and I am an editor at how stuff works dot com.
Speaker 1: Sitting across from me as always a senior writer, Jonathan Strickland. George,
Speaker 1: you've heard about this virus? Shall I cough on you? George?
Speaker 1: That was a good one. Yeah, that's from a classic film, definitely.
Speaker 1: I actually know where that comes Oh yeah, wow, I
Speaker 1: can't believe you've seen that one. I haven't. I just
Speaker 1: know where it comes from. All right, Well, we're going
Speaker 1: to launch directly into a little listener mail. This listener
Speaker 1: mail comes from Patrick, who says, Dear text Stuff, I
Speaker 1: really think an appropriate topic for discussion would be the
Speaker 1: infamous stucks net that has been all over the news
Speaker 1: these past few months. Thank you, and I hope to
Speaker 1: hear from more from you guys. Well, Patrick, we thought
Speaker 1: we'd tackle stucks net to We've talked about a couple
Speaker 1: of times in other podcasts, just kind of mentioning it
Speaker 1: off hand, and of course we've done podcasts about viruses
Speaker 1: and worms before. But the stucks net is it's is
Speaker 1: a particularly interesting form of malware. Yes, yes, it is
Speaker 1: in fact a worm um and UH one of the
Speaker 1: reasons it's so interesting is because it is extremely complex.
Speaker 1: It seems to be targeted at a specific purpose, and
Speaker 1: if if not a specific purpose, as a specific location.
Speaker 1: And uh, no one officially knows where it came from.
Speaker 1: Somebody knows, but it's It does also seem to be
Speaker 1: a state sponsored um virus, or at least some department
Speaker 1: in some country appears to be responsible for it, based
Speaker 1: upon the various investigations that have gone on since the
Speaker 1: discovery of stocks net. Yeah. Now, it's important to note
Speaker 1: that we have to be careful when we talk about
Speaker 1: that because we don't know for sure. And as we
Speaker 1: have mentioned many times before, probably most notably in our
Speaker 1: hacking of Google and China discussions that we've had before, UM,
Speaker 1: it is possible to make an attack look like it
Speaker 1: came from someone it didn't, and that'll that will come
Speaker 1: up later in our discussion too. But UM, you know
Speaker 1: it it appears that way, but there's really no way
Speaker 1: for UH to tell for sure. And and and we've
Speaker 1: had some very dedicated computer security experts looking into this.
Speaker 1: So some seriously talented people have been evaluating this the
Speaker 1: stucks net worm and have been unable to determine that
Speaker 1: for sure. So do you want to uh, should we start?
Speaker 1: I guess we This really all started back in two
Speaker 1: thousand nine as far as we know, Yes, yes, So
Speaker 1: let's let's give a brief overview of what stucks net
Speaker 1: is and what it's meant to do. So stocks net
Speaker 1: is a worm, is a Windows based worm, so it's
Speaker 1: this isn't This is not a you know, that doesn't
Speaker 1: target Lenox, it doesn't target mac os, targets machines running
Speaker 1: various forms of the Windows operating system. And as far
Speaker 1: as we are able to determine it by the time
Speaker 1: of this recording, it originally spread through USB sticks or
Speaker 1: USB drives. Yes, it is not. It is not propagated
Speaker 1: primarily over the Internet, right, And the reason for that
Speaker 1: is because the intended target of stocks net that tends
Speaker 1: to be disconnected from the Internet, so you can't target
Speaker 1: it from the Internet. That that specific target is well.
Speaker 1: Stocks net is able to attack factory systems. Yes, it
Speaker 1: actually targets a series of vulnerabilities in the Windows operating system,
Speaker 1: which I understand have been patched at this time at
Speaker 1: the time the ducks net virus was written, or the
Speaker 1: original one was written. Um, it was aimed at several
Speaker 1: vulnerabilities and use those vulnerabilities to get at industrial control
Speaker 1: systems for gas pipelines and power plants right and aimed
Speaker 1: as very specific hardware connected to Windows networks. And in
Speaker 1: fact the ultimate target for this turned out to be
Speaker 1: some centrifuges in Iranian uh nuclear facilities. So these were
Speaker 1: centrifugures that were designed to to process uranium, and the
Speaker 1: idea here apparently was to infect systems so that an
Speaker 1: outside controller could gain access to the systems and overload
Speaker 1: them in such a way as to cause possibly irreparable
Speaker 1: damage to the facilities. Now, as it turns out, that
Speaker 1: does not seem to have happened. It doesn't look like
Speaker 1: the damage was was as deva stating as it could
Speaker 1: have been, and there's some interesting explanations for why that is.
Speaker 1: One of which is that some security experts have said
Speaker 1: stucks net is kind of like a double layer worm,
Speaker 1: the core of which is incredibly complex. One of the
Speaker 1: most sophisticated worms possible, but the outer layer of which
Speaker 1: is less complex and that because of the the reduced complexity,
Speaker 1: this is the layer that is that's specifically designed to
Speaker 1: help hide stucks net from prying eyes and discovery. Because
Speaker 1: it was less sophisticated, it was not as difficult to discover,
Speaker 1: although it took an entire year before anyone saw it. Um,
Speaker 1: it's not it's not so hard to discover that is
Speaker 1: impossible to weed it out. So if the outer layer
Speaker 1: had been as sophisticated as the inner layer, it may
Speaker 1: even be that we still would not know what stucks
Speaker 1: net is so infecting, you know. The idea here is
Speaker 1: that you you send in some sort of infected USB
Speaker 1: uh media, whether that's a USB stick or a an
Speaker 1: external drive or some other device that could contain the
Speaker 1: stuck net code in it, connected to a computer that's
Speaker 1: within this network that's not connected to the Internet necessarily,
Speaker 1: or maybe there's like a couple of machines on the
Speaker 1: periphery that are connected to the Internet, but the main
Speaker 1: machines aren't. You infect the machine within that network, then
Speaker 1: the worm spreads within inside that network until it hits
Speaker 1: those critical systems that that are connected to the the
Speaker 1: factory environment right now. UM I I read an interview
Speaker 1: with security expert Ralph Langner who spoke with Eleanor Mills
Speaker 1: of c net UM and Langner said a good way
Speaker 1: to get this virus in place would be to infect
Speaker 1: a one of the contractors who worked with these power
Speaker 1: systems um SO a contractor in this case a trusted
Speaker 1: business partner. Hey can you come in and fix this machine?
Speaker 1: So if you can infect UH somebody else and have
Speaker 1: you know their machines or at a USB drive and
Speaker 1: have them take the virus in on foot with a
Speaker 1: USB stick and put it on a computer inside the
Speaker 1: power plant. UM then this person who already had clearance
Speaker 1: is you know, you don't have to worry about getting
Speaker 1: it into the impregnable. You don't have to do hard
Speaker 1: impossible type thing to get in there and plant this stuff.
Speaker 1: You can use a lower point of security for that.
Speaker 1: And the reason he thinks that, I'm sorry to interrupted
Speaker 1: the reason he thinks that, based on on my readings
Speaker 1: of his theory, UM there were other UH countries that
Speaker 1: were infected to including Indonesia, India and Pakistan who all
Speaker 1: used this one same contractor, a Russian contractor who worked
Speaker 1: on the the Bush Air nuclear power plant in Iran.
Speaker 1: So the same contractor worked at all those places and
Speaker 1: Stuck snat surfaced and all those locations. So I think,
Speaker 1: based on that you've got you've got yeah, I mean
Speaker 1: he's that that's a logical idea. Yeah, So I think
Speaker 1: based on on that information, he said, well, you know what,
Speaker 1: I bet that's how they did it. And the goal
Speaker 1: here is that at least one of those machines within
Speaker 1: that network has to have some sort of connection to
Speaker 1: the Internet. If it doesn't, then you cannot control from
Speaker 1: outside the network. You cannot control what's going on inside
Speaker 1: the factory. But but the in general, the the factory
Speaker 1: systems themselves are not connected the Internet. There's a gap there,
Speaker 1: it's air gap. That's what it's often called um. But
Speaker 1: as long as you can get control of the network
Speaker 1: that is, in turn connect to the factory systems, you
Speaker 1: might you have the oportunity to infect them. And what's
Speaker 1: interesting is the original version of Stuck's net required use
Speaker 1: auto run to initiate itself, but you can turn auto
Speaker 1: run off on your machine. So if you are let's
Speaker 1: say you work for a facility where security is a
Speaker 1: major concern. You may have a policy that auto run
Speaker 1: must be disabled, so that way nothing no malware that
Speaker 1: uses auto run would automatically upload itself to your system. Well,
Speaker 1: the the next generation of stucks net, which, by the way,
Speaker 1: but the first two generations of stuck snet were deployed
Speaker 1: before we ever knew that they existed. Well, anyone not
Speaker 1: connected to the the the scheme had no idea they existed.
Speaker 1: We didn't know they existed until I wasn't July of
Speaker 1: two when it first showed up. But they think it
Speaker 1: could have been out in the wild and looking for
Speaker 1: targets as or I shouldn't say that, because we were
Speaker 1: just saying that it doesn't spread of the internet. It
Speaker 1: was available and ready to go as uh, possibly even
Speaker 1: a year earlier, but they don't know for sure. Well,
Speaker 1: essentially a full year had passed since it had been
Speaker 1: first deployed and when it was first discovered. That's true. Yeah,
Speaker 1: they first spotted it in the summer of two thousand nine. Well,
Speaker 1: the later generations used a vulnerability in l n K
Speaker 1: which allows the exploit to essentially install itself. Basically, what
Speaker 1: happens is you plug your USB stick that happens to
Speaker 1: be UM infected with the stuck s net virus into
Speaker 1: your computer, and then you decide to use uh explorer
Speaker 1: to look at what is on that that memory stick.
Speaker 1: Just by using Explorer to open up the memory stick,
Speaker 1: you have uh that that's all it takes for stocks
Speaker 1: net to then in fact that computer, now your basic computer.
Speaker 1: Like you guys out there who are using your computers,
Speaker 1: stucks net would not do anything to your machine. You
Speaker 1: wouldn't get any you know, you're not you're not being
Speaker 1: spied on, You're not being uh, your your computer is
Speaker 1: not gonna start acting weird. The whole purpose of stuck
Speaker 1: snet is to affect these factory systems, not individual users computers. Yes,
Speaker 1: and in fact it's looking specifically for a semen sematic
Speaker 1: wind c C step seven uh software. And most of
Speaker 1: us don't have that. No, I don't I I don't
Speaker 1: have it on my Windows installations. No, it's not even
Speaker 1: in Minecraft. So yeah, if you don't have that, then
Speaker 1: it's not going to target you. But if you are
Speaker 1: running a very large system like a water facility, power facility,
Speaker 1: nuclear power facility, which of course that was the main target, UM,
Speaker 1: then you'd have to be concerned about this, and the
Speaker 1: the other part of this that was really interesting is that,
Speaker 1: like Chris said, it targeted several vulnerabilities, not just one. Right,
Speaker 1: your typical virus or worm, especially if it's developed by
Speaker 1: someone who just you know, knows an enough to get
Speaker 1: into trouble, but not like enough to make a really
Speaker 1: sophisticated tool. Those tend to target a single vulnerability, but
Speaker 1: Stuck's net was much more sophisticated, and it used a
Speaker 1: series of vulnerabilities to spread itself. The one of the
Speaker 1: other things that that the reasons why it was able
Speaker 1: to install itself without checking for a certificate is because
Speaker 1: it stole certificates. Yes, And that's that's another interesting point too,
Speaker 1: because originally it had used and used an official certificate yes,
Speaker 1: that had been stolen and uh, they revoked that certificate,
Speaker 1: and it surfaced very shortly thereafter with another yes exactly,
Speaker 1: so it appears to be completely legit. And the two
Speaker 1: certificates came from two companies that exist within a few
Speaker 1: miles of each other in Taiwan. Interesting. Yeah, interesting huh.
Speaker 1: So that suggests that someone, maybe another contractor, was specifically
Speaker 1: stealing electronic certificates from other from companies in order to
Speaker 1: mask this stuff. And that's the thing is that if
Speaker 1: you if you've told your computer or your if your
Speaker 1: network administrator has told all the computers to trust UH
Speaker 1: software that comes from a particular source, and it bears
Speaker 1: that certificate, then there's no reason for the computer to say, Hey,
Speaker 1: I see you're trying to upload stuck snet. Are you
Speaker 1: sure you want to continue? Thanks clippy. UM, you see
Speaker 1: you're trying to bring down the system from within. Do
Speaker 1: you need help with that? And when I'm trying to
Speaker 1: think of something to say, don't sorry now um. And
Speaker 1: that's that's funny that you mentioned the Taiwanese connection, because
Speaker 1: when stuck snet is in operation, it is it actually
Speaker 1: makes tries to make contact with two control servers in
Speaker 1: Malaysia in Denmark, and it does use a peer to
Speaker 1: peer scheme to compare versions of itself and update to
Speaker 1: the most recent version. So it is it is checking.
Speaker 1: It may not necessarily have an Internet connection, but if
Speaker 1: it's UH, if it can find other versions of itself
Speaker 1: on the intra net where it is located, it will try. UM.
Speaker 1: The diversions will try to update themselves to the most
Speaker 1: current version to take advantage of any vulnerabilities that might
Speaker 1: be available to it. UM. And this is I mean,
Speaker 1: it's it's really fascinating stuff. UM. I also read another
Speaker 1: article uh with security expert Bruce Schneier, who uh some
Speaker 1: of you might have heard of. Actually he's a pretty
Speaker 1: outspoken guy. UM. You know, information suggests that uh, you
Speaker 1: know it uh may have infected as many as a
Speaker 1: hundred thousand or even more computers worldwide, but about six
Speaker 1: that was in uran UM, which suggests that Iran was
Speaker 1: in fact the target, and specifically, Ralph Langer had found
Speaker 1: and in his partners at his firm had found data
Speaker 1: structures in the netens facility UH in Iran that that
Speaker 1: matched that specifically matched the stucks net code. So it
Speaker 1: is possible that uh, it was aimed at that particular facility,
Speaker 1: and you know, in particular was totally redundant, un repetitive.
Speaker 1: But let me reiterate, there was a there were several articles.
Speaker 1: The Telegraph, UM and New York Times have published articles
Speaker 1: that suggest uh that uh, you know that that that's
Speaker 1: facility in particular was the target. And the idea here
Speaker 1: is that it would it was an effort to disrupt
Speaker 1: Iran's nuclear program, and that, like I said, the idea
Speaker 1: was that you would uh make the centrifuges that are
Speaker 1: um processing the uranium in these facilities to spend too
Speaker 1: fast and to essentially break them UM. And what's really
Speaker 1: fascinating to me is that stucks Net didn't just what
Speaker 1: wasn't just designed to go there and just immediately ramp
Speaker 1: everything up. It actually would analyze the operations of the
Speaker 1: facility for several days for two reasons. One to determine
Speaker 1: what would be the most disruptive course of action. So,
Speaker 1: in other words, if the centrifuges are turning in a
Speaker 1: certain number of revolutions per second, how many more does
Speaker 1: it need for it to be the perfect amount to
Speaker 1: be disastrous without immediately setting off all the alarms. The
Speaker 1: second was that the reason it was observing for several
Speaker 1: days was to create a kind of partitioned system so
Speaker 1: that when people are looking at their monitors and are
Speaker 1: trying to upload code to fix the problem, that it
Speaker 1: all is um. It's a it's all segregated from those
Speaker 1: factory systems. So if you're looking at the screen, if
Speaker 1: you're an engineer looking at your screen trying to fix
Speaker 1: the problem. What you see looks like the problems fixed,
Speaker 1: that the code you've uploaded has gone in and that's
Speaker 1: been incorporated and that's taking care of the problem. But
Speaker 1: in reality, those centrifutures are still spinning like crazy. And
Speaker 1: that was the really clever thing. It's the idea of
Speaker 1: like you pull this mask down or that you know,
Speaker 1: you you shield what's really happening, and all the the
Speaker 1: monitoring systems don't show that anything's going wrong at all.
Speaker 1: That that's pretty devious and that was another reason why
Speaker 1: security experts call this a very sophisticated attack, because it
Speaker 1: wasn't just that it was able to infect systems, you know, efficiently,
Speaker 1: it was able to mask that infection somewhat. And there's
Speaker 1: also it also involved a root kit, so if you've
Speaker 1: listened to our root kit podcast, there was a root
Speaker 1: kit element to this as well. And m yeah, I
Speaker 1: thought that was a pretty neat idea. The and and
Speaker 1: a lot of the the attribution for this. As we said,
Speaker 1: we still don't know for sure who did it, no right,
Speaker 1: but you'll if you if you do research on it
Speaker 1: and you start looking around at articles that were published
Speaker 1: this year, you'll see that the there's some common elements
Speaker 1: popping up that at least one Western power was involved
Speaker 1: in this, and that Israel was involved in it. Yes,
Speaker 1: a lot of a lot of fingers initially pointed to
Speaker 1: the United States government, UM, and which is still a possibility,
Speaker 1: which is you know, yeah, as is the British government. UM.
Speaker 1: Bruce Snyer. It's so hard to say. Bruce Schneier said
Speaker 1: that he thinks that around eight to ten people spent
Speaker 1: about six months, maybe a little longer on creating this
Speaker 1: UM and uh, you know, they think that Israel has
Speaker 1: mentioned I read one article from Schneier that suggested had
Speaker 1: had a number of references in it. UM. There bits
Speaker 1: of code that have dates in them that appeared to
Speaker 1: be yes, dates important dates in Iranian Israeli relationship, and
Speaker 1: in an incredibly negative way. We're talking like dates of
Speaker 1: assassinations and things of that and things like that. UM.
Speaker 1: Some people have said that they just happened to be
Speaker 1: the code that you needed to get that done, the
Speaker 1: particular function in the software done, and it just so
Speaker 1: happened to end up like that, which is possible, Which
Speaker 1: is completely possible if you've ever seen any of those theories,
Speaker 1: any numerology theory where they say this number is significant
Speaker 1: because blah blah blah. Uh. A lot of that ends
Speaker 1: up being confirmation bias, which is that's a logical fallacy.
Speaker 1: That's when you look at something and you count all
Speaker 1: the hits and you ignore all the misses. So it's
Speaker 1: possible that this is another case of that. So we
Speaker 1: have to keep that in mind too. Yeah, I don't
Speaker 1: suggest ignoring the misses because she's going to get really
Speaker 1: angry with you. Well, she's gonna be gone for a week,
Speaker 1: so just I can't really pay attention to her anyway. Um.
Speaker 1: Joking aside, though, UM, I have a quote from Schneier
Speaker 1: who said, quote whoever wrote stuck s net was willing
Speaker 1: to spend a lot of money to ensure that whatever
Speaker 1: job it was intended to do would be done end quote.
Speaker 1: So uh, it's a professional job. It's it's not something
Speaker 1: that script kitties, which are you know, hackers who do
Speaker 1: this for the fun of hacking and not for a
Speaker 1: monetary purpose or for bringing down governments or you know,
Speaker 1: the high level hacking people are doing it for fun. Um.
Speaker 1: You know, this is not a casual hacking project. This
Speaker 1: is something serious the amount of code was something like
Speaker 1: one point five megabytes, which is actually huge for a worm. Yeah,
Speaker 1: because worms and viruses tend to be very tiny bits
Speaker 1: of code, just like just like you can imagine a virus,
Speaker 1: you know, and virus that can affect an organism is
Speaker 1: very tiny. Well, typically your viruses that affect computers tend
Speaker 1: to be tiny too. They might be a tiny part
Speaker 1: of a larger program, and the larger programs designed, but
Speaker 1: the larger program is just an infection method. It's not
Speaker 1: actually part of the virus or worm necessarily. Another article
Speaker 1: I saw that may point to Israel as as being
Speaker 1: a potential source for this attack, and again we don't
Speaker 1: know for sure, was in the New York Times. It
Speaker 1: published on January fift and it's called Israeli test on
Speaker 1: worm called crucial in Iran nuclear delay. And in this
Speaker 1: UH article it the writer's state that m Israel has
Speaker 1: this UH nuclear facility in Demona, that UM one of
Speaker 1: those facilities is designed to be essentially a copy of
Speaker 1: the main target in Iran. Right, I remember that article.
Speaker 1: And the idea here is that just because you create
Speaker 1: something that can infect a factory system doesn't mean that
Speaker 1: you can you know, really rereak havoc because you need
Speaker 1: to know how the machines within that that facility work.
Speaker 1: So in this case, we're talking about the centrifuges. So
Speaker 1: they had a facility using the same centrifuge technology that
Speaker 1: the Iranian facility was using, so that in theory, they
Speaker 1: could test the stucks net uh worm out to make
Speaker 1: sure that it would be effective and that they could
Speaker 1: indeed control these centrifugures from a remote location. Now granted,
Speaker 1: these are again these are all allegations and and uh theories.
Speaker 1: So well, I think if I'm not mistaken, that's the
Speaker 1: article by William J. Brod, John Markoff, and David E.
Speaker 1: Sanger Um. And yeah, they they added that Siemens, Remember
Speaker 1: I said that that was a specific Siemens controller and
Speaker 1: software that it targets UH. Siemens had done had cooperated
Speaker 1: with the United States government on some research on that
Speaker 1: kind of equipment, on on the equipment used in the
Speaker 1: Iranian nuclear program. So that just that just adds fuel
Speaker 1: to the fire. Now, I mean, again, this could all
Speaker 1: be coincidence. These things happen. Semens makes a lot of
Speaker 1: different kinds of industrial equipment that's used all over the world.
Speaker 1: So you know, you could say that and it it.
Speaker 1: You know, I don't think that's anything that UH is
Speaker 1: a definitive finger pointing at the United States government involved
Speaker 1: in that, and personally, UM, if it were me and
Speaker 1: I were trying to do something like this, I wouldn't
Speaker 1: want anything that that even revealed this. In fact, I
Speaker 1: would want to um obfuscate. I would try to cover
Speaker 1: up or maybe point to finger at someone else, which
Speaker 1: is why some I agree with the people who say
Speaker 1: that those little hints that might be in the code
Speaker 1: that seemed to point to Israel, if I were trying
Speaker 1: to blame somebody, I would try to blame somebody that
Speaker 1: that would be an obvious UH target for that kind
Speaker 1: of attention, and Israel would be obviously interested in discontinuing
Speaker 1: Iranian's nuclear program. So if I were you know, Antarctica,
Speaker 1: I picked that because it's not a government that's likely
Speaker 1: to do that, and it's run by penguins. Um. But
Speaker 1: penguins are very much anti nuke they are, so yeah.
Speaker 1: I mean, if if another country wanted to disable that UH,
Speaker 1: and I were running that country, I would say, let's
Speaker 1: point to finger someone else, throw some throw some red
Speaker 1: herrings in the code to make it look like it's
Speaker 1: these guys over here and not me. So I wouldn't
Speaker 1: be a bit surprised. I can't imagine that you would
Speaker 1: want and something this sophisticated. Why would you want anything
Speaker 1: that would attract attention to yourself as as the creator
Speaker 1: of this worm, Why would you create a system that could,
Speaker 1: in theory reset itself at the year two thousand. Well,
Speaker 1: I'm just saying sometimes people aren't as smart as we
Speaker 1: give them credit for. So, yeah, there's I totally agree
Speaker 1: that your argument is valid. I mean there we cannot
Speaker 1: leap to the conclusion that this is necessarily the source
Speaker 1: of the attack. Yeah, And I don't mean to h
Speaker 1: to sound like I've reached conclusions. I just I it
Speaker 1: seems illogical to me to point the finger at yourself.
Speaker 1: Um I think that, if anything, that's probably code that
Speaker 1: needed to be there in order to make the software work,
Speaker 1: rather than hints to that. Um So, I actually think
Speaker 1: it's all due to aliens and Roswell. That's that's who
Speaker 1: did it, and they got so ticked off. What happened
Speaker 1: was they finally got Independence Day and they said, what
Speaker 1: taking us down with a virus written on an Apple computer.
Speaker 1: No less will show you an Apple computer from the
Speaker 1: dark ages of Apple computer to um. So maybe we
Speaker 1: should talk about the fact that, um, the you may
Speaker 1: have heard on the news about hackers releasing a decrypted
Speaker 1: version of stuck snet code. Okay, that happened. Okay, I hadn't.
Speaker 1: I hadn't realized that. The only other thing I was
Speaker 1: going to add was that stucks neet is designed to
Speaker 1: become inactive on June. Yes, actually does have a a
Speaker 1: an expiration date, which is kind of funny. So if
Speaker 1: you try the stucks net after that point, it may
Speaker 1: make you a little sick to your stomach. Right. So
Speaker 1: the that you may have heard, again, like I said,
Speaker 1: that hackers have released this decrypted code, which, on its surface,
Speaker 1: if that's all you hear, you think, wow, that's scary,
Speaker 1: because now this incredibly sophisticated weapon that was designed by
Speaker 1: people who apparently really knew what they were doing, has
Speaker 1: just been distributed around the world for free, and now
Speaker 1: we're gonna see chaos rain. Well, there's a couple of
Speaker 1: things you need to keep in mind. One is that
Speaker 1: a lot of the vulnerabilities that stuck s net initially
Speaker 1: targeted have been patched. Since then I read that all
Speaker 1: have all of them have been have they? Okay? So yeah,
Speaker 1: the latest information I had was a couple of months old,
Speaker 1: so and that at the time when it was written,
Speaker 1: there was still one remaining to be patched. But I
Speaker 1: would imagine by that time that has happened. Well, frankly, UM.
Speaker 1: Another indication that UM, this is written by somebody very
Speaker 1: sophisticated is as as one of the security researchers point out, UM,
Speaker 1: vulnerabilities are something that true hackers prize. Once you have
Speaker 1: a hole in the code that you know about and
Speaker 1: and hasn't been patched yet, UM, that's your ticket to
Speaker 1: generating something a success, a successful attack. UM. And the
Speaker 1: fact that they had multiple vulnerabilities UM targeted sort of
Speaker 1: suggests that these people were not fooling around. UM. So yeah,
Speaker 1: I mean that's you. We're talking several opportunities to uh
Speaker 1: to make a dent in the nuclear program of Iran.
Speaker 1: So well, getting back to to the hackers just really briefly, UM,
Speaker 1: first of all, can you can you take a wild
Speaker 1: guess at who at the the name of the group
Speaker 1: of hackers that stole this information is the start with
Speaker 1: an A it does does it end with it anonymous?
Speaker 1: Yes it does, so it's our It's it's the group Anonymous,
Speaker 1: the group that UM you know has has has some
Speaker 1: connections to other Internet what or websites, things like four chan.
Speaker 1: But Anonymous has sort of become like Internet vigilantes and
Speaker 1: they banded together and uh, they they enact virtual what
Speaker 1: they see as virtual justice on targets that they perceive
Speaker 1: as being ah antithetical to what the values they hold. So,
Speaker 1: for example, when wiki leaks was under um under fire
Speaker 1: and was starting to get uh support yanked out from
Speaker 1: under it financial support from from various companies, then Anonymous
Speaker 1: began to target those companies and really hit them hard. Well,
Speaker 1: in this case, they target targeted a security company called
Speaker 1: HB Gary and they stole a decrypted version of the
Speaker 1: stuck net virus. Now this means that you could actually
Speaker 1: study the stuck s neet virus. It's not it's not
Speaker 1: a kind version of the virus where you would be
Speaker 1: able to actually infect a computer. It's more so that
Speaker 1: you can study it and see how it um it
Speaker 1: took advantage of these vulnerabilities, and uh, it was really
Speaker 1: meant for academic purposes, and hp Gary actually points out
Speaker 1: the company points out that if you want a truly
Speaker 1: dangerous version of stuck net, it's already out there. You
Speaker 1: don't have to steal it from a security company. You
Speaker 1: just have to find a computer infected with it, and
Speaker 1: then you reverse engineer it. You get the binary code,
Speaker 1: you get the raw code for stuckx net. You don't
Speaker 1: get a translated version. So you may have heard about
Speaker 1: this anonymous attack. It's definitely a embarrassing story for HP
Speaker 1: Gary because that's a you know, it's a computer security
Speaker 1: firm and they had their system compromised. So that's that's part.
Speaker 1: That's the real, big part of the story is the
Speaker 1: fact that something that was on their systems was able
Speaker 1: to to you know, Anonymous was able to get access
Speaker 1: to it and spread it around the world. Um, but
Speaker 1: the actual version of stuck's net that Anonymous distributed was
Speaker 1: not the kind that's going to plunge the world into
Speaker 1: some sort of virtual warfare. Now we're probably seeing the
Speaker 1: end of of stucks nets true effectiveness in the field.
Speaker 1: As long as companies realize the dangers of stocks nets
Speaker 1: and they update their systems, you know, they make sure
Speaker 1: they have the latest security patches that plug those holes
Speaker 1: that stucks net took advantage of. So I mean there
Speaker 1: is definitely some measures they have to these companies have
Speaker 1: to take in order of companies and governments have to
Speaker 1: take in order to remain safe. It's not like you
Speaker 1: automatically become safe just because this this hole was patched.
Speaker 1: You have to install the patch, right. Um, but stucks
Speaker 1: net is probably starting to wind down for the most part,
Speaker 1: just because everyone's aware of it. However, it probably also
Speaker 1: marks the beginning of some serious cyber warfare stuff that
Speaker 1: goes beyond the level of a small group of hackers
Speaker 1: who share a particular philosophy and they all you know,
Speaker 1: aim the aim their efforts at a single target. This
Speaker 1: may be the mark of some pretty serious UH warfare tactics,
Speaker 1: not out and out warfare either, but you know, subversion
Speaker 1: tactics to to really take advantage and UH and cripple
Speaker 1: companies are countries, infrastructures. Well, it is interesting too that um,
Speaker 1: something that appears to have been so targeted for specific purpose,
Speaker 1: it did leak over and damage other systems too. I mean,
Speaker 1: there is the possibility I read that India's insight four
Speaker 1: B which failed UH in July, may have been due
Speaker 1: to a Stuxnet infection UM and you know, it did
Speaker 1: spread around the world, so it is possible um that
Speaker 1: that it caused a lot of collateral damage in the
Speaker 1: process of taking out its original target. And their estimates
Speaker 1: do suggest that Iran's nuclear program has been set back
Speaker 1: for years as a result of the ducks Net infection.
Speaker 1: It's interesting assuming that it was the intended target, which
Speaker 1: it seems to have been, right, it all depends on
Speaker 1: the source you look at, because I looked at several
Speaker 1: where there were some sources that said, yeah, this problem
Speaker 1: has really set the Iranian program back by a few years,
Speaker 1: but that all seemed to be statements from other governments representatives,
Speaker 1: whereas I I also saw claims that said that Iran
Speaker 1: managed to produce the same amount of uranium essentially weapons
Speaker 1: grade uranium UM by at the end of the year
Speaker 1: as it had the year previous. And so it didn't
Speaker 1: it didn't ramp up production. Production had not increased year year,
Speaker 1: but it hadn't set it back to the point where
Speaker 1: it was making less than it had before. So that
Speaker 1: suggests that you know, any setbacks that Iran encountered were
Speaker 1: temporary in nature. So it all depends on who you
Speaker 1: ask and you know who you believe, And it may
Speaker 1: be difficult to know because Iran is not known for
Speaker 1: being completely transparent with its nuclear program, and other governments
Speaker 1: aren't known for um you know, giving shooting straight when
Speaker 1: talking about that. It may pay politically to underplay something.
Speaker 1: So what's the truth? Difficult to know, but um, it is.
Speaker 1: It is a fascinating subject. Yes, I mean, just because
Speaker 1: we've talked about viruses and worms and all kinds of
Speaker 1: other malware and this is this is a different kind
Speaker 1: of malware. Yeah, and we may we may see more
Speaker 1: attempts at that hackers try and take two um, to
Speaker 1: try and and take advantage of multiple vulnerabilities within the
Speaker 1: same operating system environment, just because it's been proven to
Speaker 1: be really effective. You know, using that multi pronged attack
Speaker 1: means that you're your your attack is gonna be much
Speaker 1: more efficient and it's gonna be harder to prevent just
Speaker 1: through a single patch. So yeah, that's it's kind of scary. Um. Fortunately,
Speaker 1: like I said, the stucks net virus itself is not
Speaker 1: going to directly impact you unless the worst should happen.
Speaker 1: Let's hope that doesn't come to pass. And again this
Speaker 1: is a reminder always to patch your computer with the
Speaker 1: later security latest security updates, no matter what what operating
Speaker 1: system you're running, and back up your hard drive because
Speaker 1: eventually something will come after you. Right, Yeah, like my wife.
Speaker 1: See that's what happens when you're in order. Yeah, she'll
Speaker 1: come back. I would ignore the misses woman scorned. All right,
Speaker 1: So we're gonna wrap this up. Guys. If you have
Speaker 1: any other questions about stuck snet, or you have any
Speaker 1: topic suggestions you would like to shoot us, let us
Speaker 1: know on Twitter and Facebook that handle it is tech
Speaker 1: Stuff hs W, or you can email us that emailoge
Speaker 1: uses tech stuff at how stuff works dot com and
Speaker 1: Chris and I will talk to you again really soon.
Speaker 1: For more on this and thousands of other topics. Is
Speaker 1: it how stuff works dot com. To learn more about
Speaker 1: the podcast, clock on the podcast icon in the upper
Speaker 1: right corner of our homepage. The How Stuff Works iPhone
Speaker 1: app has arrived. Download it today on iTunes. Brought to
Speaker 1: you by the reinvented two thousand twelve camera. It's ready,
Speaker 1: are you