Stuxnet, gone rogue, hit Russian nuke plant, space station

Butifldrm · November 12, 2013

Stuxnet, gone rogue, hit Russian nuke plant, space station A cyber-security expert says several ostensibly secure facilities became victims of the virus that struck Iran’s nuclear program

BY DAVID SHAMAH November 11, 2013, 4:21 pm 5

Eugene Kaspersky (Photo credit: Courtesy Tel Aviv University)

A Russian nuclear power plant was reportedly “badly infected” by the rogue Stuxnet virus, the same malware that reportedly disrupted Iran’s nuclear program several years ago. The virus then spread to the International Space Station via a Stuxnet-infected USB stick transported by Russian cosmonauts.

Speaking to journalists in Canberra, Australia, last week, Eugene Kaspersky, head of the anti-virus and cyber protection firm that bears his name, said he had been tipped off about the damage by a friend who works at the Russian plant.

Kaspersky did not say when the attacks took place, but implied that they occurred around the same time the Iranian infection was reported. He also did not comment on the impact of the infections on either the nuclear plant or the space station, but did say that the latter facility had been attacked several times.

The revelation came during a question-and-answer period after a presentation on cyber-security. The point, Kaspersky told reporters at Australia’s National Press Club last week, was that not being connected to the Internet — the public web cannot be accessed at either the nuclear plant or on the ISS — is a guarantee that systems will remain safe. The identity of the entity that released Stuxnet into the “wild” is still unknown (although media speculation insists it was developed by Israel and the United States), but those who think they can control a released virus are mistaken, Kaspersky warned. “What goes around comes around,” Kaspersky said. “Everything you do will boomerang.”

The Stuxnet virus came to light in 2010, having attacked Iranian nuclear facilities by hitting the programmable logic control automation systems that control them. The PLC system, manufactured by German conglomerate Siemens, runs the centrifuges used to enrich uranium at Iran’s Natanz facility. Variants of Stuxnet have affected the facility’s centrifuges in various ways, mostly by changing the activity of valves controlled by the PLC software that feed the uranium to centrifuges at a specific rate required for enrichment, Kaspersky said in several presentations last year.

It’s not known when Stuxnet began its activities, but researchers at anti-virus company Symantec said that they had gathered evidence that earlier versions of the code were already seen “in the wild” in 2005, although it wasn’t yet operational as a virus. Stuxnet, said Symantec, was the first virus known to attack national infrastructure projects, and according to the company, the groups behind Stuxnet were already seeking to compromise Iran’s nuclear program in 2007 — the year Iran’s Natanz nuclear facility, where much of the country’s uranium enrichment is taking place, went online.

Now that the plague has been unleashed, said Kaspersky, no one is immune — and that includes its originators, who are no longer in control of it. “There are no borders” in cyberspace, and no one should be surprised at any reports of a virus attack, no matter how ostensibly secure the facility, he said.