The Stuxnet Worm: Possible Developers and Future Users

In attempting to assess the Stuxnet worm's potential targets and ascertain how best to identify and slow progress of its spread to other ICSs, numerous researchers have speculated as to the identity of the software code's developer. The Stuxnet code itself is now freely available on the Internet, as are the particular vulnerabilities it exploits, as well as the web addresses of unsecured SCADA systems. Early reports indicated that the intended target of Stuxnet may have been SCADA-controlled nuclear facilities in Iran that used the Siemens product. Iranian officials have indicated that the worm infected computers associated with the country's nuclear power plant under construction near Bushehr. The advent of the Stuxnet virus has raised questions on the vulnerabilities of national critical infrastructure. Many observers fear that a successful infiltration and attack could degrade or stop the operation of a critical infrastructure facility that delivers water, gas, or other essential utility, or affect multiple facilities due to the interdependent nature of the nation's infrastructure sectors responsible for providing essential services. SCADA systems can be accessed and managed directly at computer terminals, either from remote locations that are connected to the control system, or through the emerging trend of controlling these systems from mobile wireless devices. Another option is to enhance the protection of the physical aspects of the nation's critical infrastructure, thus mitigating possible damage from a Stuxnet worm type of attack and also better preparing facilities to respond to natural or man-made threats. Should the ICS of a critical infrastructure facility become affected by a Stuxnet worm or similar malicious code, disruptions could hamper the government's ability to provide domestic and international security, safety, and essential services for lengthy periods of time. The predominant view of many security observers appears to be that the recent emergence of the worm may be a new type of threat that could potentially lead to short- and long-term adverse global security consequences. Although the full extent of damage caused by Stuxnet is unknown, the potential implications of such a capability are numerous in that the worm's ability to identify specific ICSs and wait for an opportune time to launch an attack could have catastrophic consequences on nations' critical infrastructures. What authorities should be in place if such an attack were deemed to warrant an immediate response from the affected nation? Is an international treaty or convention necessary to curb proliferation and use of cyber-based weapons? Another issue raised by Stuxnet is the government's role in protecting critical infrastructure.
In September 2010, media reports emerged about a new form of cyber attack that appeared to target Iran, although the actual target, if any, is unknown. Through the use of thumb drives in computers that were not connected to the Internet, a malicious software program known as Stuxnet infected computer systems that were used to control the functioning of a nuclear power plant. Once inside the system, Stuxnet had the ability to degrade or destroy the software on which it operated. Although early reports focused on the impact on facilities in Iran, researchers discovered that the program had spread throughout multiple countries worldwide.
From the perspective of many national security and technology observers, the emergence of the Stuxnet worm is the type of risk that threatens to cause harm to many activities deemed critical to the basic functioning of modern society. The Stuxnet worm covertly attempts to identify and exploit equipment that controls a nation's critical infrastructure. A successful attack by a software application such as the Stuxnet worm could result in manipulation of control system code to the point of inoperability or long-term damage. Should such an incident occur, recovery from the damage to the computer systems programmed to monitor and manage a facility and the physical equipment producing goods or services could be significantly delayed. Depending on the severity of the attack, the interconnected nature of the affected critical infrastructure facilities, and government preparation and response plans, entities and individuals relying on these facilities could be without life sustaining or comforting services for a long period of time. The resulting damage to the nation's critical infrastructure could threaten many aspects of life, including the government's ability to safeguard national security interests.
Iranian officials have claimed that Stuxnet caused only minor damage to its nuclear program, yet the potential impact of this type of malicious software could be far-reaching. The discovery of the Stuxnet worm has raised several issues for Congress, including the effect on national security, what the government's response should be, whether an international treaty to curb the use of malicious software is necessary, and how such a treaty could be implemented. Congress may also consider the government's role in protecting critical infrastructure and whether new authorities may be required for oversight.
This report will be updated as events warrant.