Stuxnet: The Cyber Weapon That Destroyed Iran's Nuclear Program 

One thing that was touched on really needs emphasis: The Iranian nuclear program managers had wisely adopted one of the most effective defenses against cyberattack: Their systems were not connected to the Internet, and it required what is effectively inside assistance to even begin to attack that system. Whenever I read about a security breach of any system, my first question is always, "Why was this connected to the Internet at all?" Many compromised systems did not require Internet connectivity in order to accomplish their official purposes.

Been studying cybersecurity for several years and working as a Security Analyst some of that time as well, so I'm all too familiar with Stuxnet, but I will never get tired of hearing this story. Stuxnet was truly a monumental achievement (for someone at least) and a total game changer in terms of how offensive cyber operations were viewed. One of my favorite case studies that I constantly return to in my career, I still gain new insights every time I do so. Happy to say that Warographics did the story justice! And the crazy part is this video is just the tip of the "Stuxnet lore" iceberg.🤯

The virus didn't just require a USB stick, it could embed itself on devices that used the USB port. Seriously one of the smartest weapons I've ever seen.

I learned about Stuxnet back in 2011 when I was taking a Cybercrimes course in Ireland. I remember being blown away by how smart of a program it was.

For the ones asking. Stuxnet dit copy itself on usb drives. Once the plc are updated, the virus send files to the drive, and if that drive is connected to a computer that is connected to the internet it sends data back. No plant is compledley airgapped. Just the most importand machines

As a computer science student, this stuff is fascinating to me. I found a video about Stuxnet recently and had been wanting a video from you breaking it down ever since!

I remember being told about this as a cautionary tale of the dangers of picking up random USB sticks

Beware of the USB stick in the parking lot.

I highly recomment reading "To kill a centrifuge" by Langner, it is their version of the Stuxnet analysis and covers the whole operation in a lot of detail.

Thjis is a very simplistic account. Firstly, it seems to ignore entirely the straightforward point that the Natanz centrigues were entirely interconnected by a pressure detection system, also controlled by PLCs, which would take individual centriguges offline if they were found to be an issue (bear in mind that we are talking about very small pressure differences). This probably required not only the possession of P1 centrifuges, but a much higher level of testing in which multiple P1s were actually connected by an automated overpressure system, which may actually have used uranium hexafluouride. This pressure system was how the first attack probably damaged the centrigues; and was actually quite difficult to detect. This first attack may not have involved Israel. And secondly this account also seemingly ignores the point that there was distinctly more than one attack - using differnt techniques, in which different actors were involved. The second, for example, was the one that actually went after the rotor PLCs. And the "leak" referred to may have been the worm looking for serial numbers of specific Siemens PLCs.

Countdown to zero day is a great book about Stuxnet.

If Natanz was truly airgap, how could the virus send information back to the US?

The script is usually very tight on here. 'An existential crisis to their existence' The exception that proves the rule.

I think $300M/year of delay is actually decent. In comparison to a "new bomb" which would need its own research and development and a bespoke production line for a limited number of bombs and it looks like maybe a wash.

Not to be confused with Suxnet, the.... other way to make things blow.

I'd heard part of this before, but this video put it all together. Good job.

The story I had originally heard about how Stuxnet infiltrated the facility was a usb drive dropped in the parking lot. Had no idea it was a long-term program with two-way communication rather than a single attack destroying the centrifuges. The description I was aware of had claimed that the worm cloned parts of itself onto more usb drives to carry it back out of the facility in order to reach an internet-connected device it could deliver a "job complete" message through, but if it was able to receive updates regularly, there was clearly a more reliable communication method established that breached the air-gapped nature of the network.

Stuxnet is gonna need a sequel soon.

I remember when this happened. I also vividly remember, how at the time, my work place was full of PLC's. I was very tech minded and a lot of access to things that I probably shouldn't have. Stuxnet was some scary stuff, for the potential havoc it could wreak on just about any company, anywhere with a PLC. It just made me realize how exposed we are when it comes to hardware security.

I had to write a report on this when I was taking cybersecurity classes. Definition of a watershed moment.

Fascinating video. Please do more on cybersecurity

Zero Days is a nice documentary about this. Some NSA whistleblowers say their part too, undercover ofc. Strongly recommend it.

aaaaah I love the 80's action movie one liners at the end of your videos.

Worth noting that we actually don't know just how effective the Stuxnet development was, since it's possible that many techniques and maybe other zero-days are still in use in other attacks around the world.

1:45 - Chapter 1 - The timeline 18:55 - Chapter 2 - The unsolvable equation ; fanny , flame & flowershop 22:00 - Chapter 3 - The future

Yes thank you was watching old video on this the other day

I absolutely love how Simon uses his voice to keep everyone on the edge of their seat.

The most scary part, most maleare is sitting dormant waiting for an action command to start attacking. We haven't even had the first real spark yet.

Love the content.. always! But give me longer to sit up and like the video/check that I have when it finishes!!! ahah

Thanks for sharing.

Keep up with these informative and entertaining videos.

I remember when news of Stuxnet first appeared. I was studying IT at the time and didn't really grasp the enormous possible consequences. Some people I studied with, and who had a lot more experience, were terrified. Some thought it might spell the end of the internet.

Amazing Episode Simon 👏

I remember all the talk about Russia's cyber warfare capabilities on the lead up to its invasion of Ukraine. Ended up falling flat. As much as the complexity of viruses are growing, it seems our capabilities in fighting them are as well. Or, Russia just sucks at cyber warfare.

Check out Zero Days. It's a documentary style movie about Stuxnet. And there is also a book: Countdown to Zero Day

What a throwback! Clicked as soon as i saw that name!!!

Fantastic job

Much as there was once an age of pike and shot, we are now in the age of drones and hackers. It would be wise to be the first to adopt them skillfully.

Has this ever been made into a movie? Because it should be.

There's a great documentary by Alex Gibney called "Zero Days" about it, that looks at it more as the story of discovery and reverse engineering what it actually does. This was a wild time blowing everyones minds about what is really out there. Also, te fact that they found and essentially burned 4 Windows zero days is wild, a no interaction Windows zero day is incredibly hard to find, and worth millions on the open market for these kind of things. Though it probably helped that Windows licensing deals for the military and the likes have included access to the source code for years.

Cool stuff Simon

British V sauce man never stops bringing the content

Simon, you're an incredibly great presenter! While watching this video I thought of the work and dedication of the author/writer! You have a great staff! They deserve more attention! Thank you for your great work!

Low key reassurance in regards to thier current situation

Wow. I had no idea about any of this. Neat.

I love Business Blaze and probably watch those video's the most but it's video's like this that brought me into Simon's orbit in the first place and I'll always be a fan of. 🎉

very well laid out wish I could share more about the late 90's early 00s but you guys are so over target wonderful video

The Stuxnet operation crosses the line into art. So elegant and clever.

So I have watched a few of your videos, and while I have liked them, I also didn’t really know the subject matter. This one I did, and out of curiosity, I looked and noticed you followed the Wikipedia page on this subject pretty closely/exactly. You have good presentation, and for those unfamiliar with the various subjects you cover, these are great videos. It would be cool to see deeper dives with some independent research, alternate sources, etc.

Do you know what I’d pay to hear a deep dive, TED talk from the programmers of this? That would be incredible!

These videos are top notch

TIL "specialisms" is a word. Excellent writing and presentation as always!

Wasn't just Stuxnet, a whole slew of malware based on the Tilded platform , include Duqu and the star of the show, Stuxnet.

This man has like 1 million channels and is pumping out videos on all of them almost everyday. He is everywhere

Working with PLC's daily I can assure you they are some of the biggest cybersecurity nightmares. Because uptime is very much preferred over cybersecurity. Even if you know about issues, you cant deploy them cause uptime.

I've seen a few videos about stuxnet and I can tell you this is by far the one with the most work put in. Great job researchers.

Honestly it's incredible this operation was pulled off. It's refreshing to see the US protrayed so competent. Fu*k anyone who was against this. This is truly bad ass.

0d exploit when a normal third party found it = Remarkable investigation and skills used to find it 😎 "0d" exploit when the government finds it in big tech software = They just asked microshoft for their backdoors 😅

22:48 Holy shit! The algorithm just randomly dropped this in my feed last night. And the Iranian president goes down in a chopper this morning?!? WTF? 😮

excellent presentation

How did it phone home if the facility was air gapped?

lawrence of arabia might have been bumped off too riding his motorbike ... just syaing

So glad my country is extremely involved in the hypothetical nuclear programs of foreign nations and not our own dying economy

Incredible video. Very comprehensive in terms of political involvement.

10:50 how the heck did the program contact it's creators if the facility's system was totally isolated? If it broadcasted a signal, how come the Iranians didn't pick up on it?

I actually requested a deep dive into this on Simons reddit. I'm so happy someone took it up!!! I was thinking Casual Criminalist or Dark Shadows, but it actually makes more sense in Warographics. It is truly shocking to me how little people know about this, much less how under reported it was. I feel like cyber warfare took such a huge leap forward from this event, and I can only find a little content related to it. It's shocking. Scary. The future of cyber warfare is terrifying to me. Hope this video helps to spread awareness. I would have liked to hear this in a free format though. Still, awesome video. Great content!!!!!!!!!!!

Great vid thank you.

If the centrifuges were air-gapped to the rest of the Internet, how was Stuxnet able to communicate and update itself?

I feel like Simon & Team is fast becoming my Walter Cronkite

10:58 wait wait wait, how did this virus send the map of operations back us/israel if this plant was in isolation from world internet?

Simon you are a master of speech delivery and hats off to your deserved success! I have started noticing something that troubles me though... In the "early" days your speech was bright and crisp! These days I'm picking up something slightly more slurred. I pray that your health is good but if this is news to you please have it checked out.

Absolutely......good job

If Iran's nuclear facilities were air gap, how did the virus communicate with the US and israel? I'm not calling Simon into question, just curious

If the facility was air gapped, how did they get data and updates back and forth? Your explanation is critically flawed.

I live 45min from INL (Idaho National Labs) had zero clue they were involved in this operation. That is pretty neat, I'll have to let a friend of mine who works there know.

Love the glasses Simon 😎

Simonverse spy stories continue 🎉🎉🎉

"An existential threat to its existence" I see 😅 IIRC it was also Dutch nuclear technology that was stolen by AQ Kahn, the world's most prolific illegal nuclear proliferator and guy who gave Pakistan the bomb.

Usually a religious Warographics listener, but rolled my eyes on the release of this stuxnet episode. So didn't listen to it immediately but I'm grateful for "the algorithm" sneaking it into the autoplay-list. I thought I already knew everything there was to know but then Mr. Whistler's team goes and unearthed the Dutch connection. Well done, well done 👏

i would love to work with those guys some day. the equation group is such an awesome name too.

Umm, how can it be updated remotely? Let alone get the data back If it was physically disconnected from the interwebs?

Darknet Diaries covered this one I think, due to it being about hacking and what not. Good episode.

There are some inconsistencies in what is being told here, specially the air gap argument and the program being able to communicate back with its creators. There is a 2016 documentary called Zero Days, produced by Alex Gibney that goes deep into Stuxnet, although it is interesting that the Dutch engineer is not mentioned in it.

mfs out here hacking nuclear powerplants meanwhile i cant remember how to unlock my phone

Did they try switching it off and then switching it back on?

Watch the movie "Zero Days" years ago, and definitely got intrigue about this one.

Stuxnet was introduced into the network by simply infecting many USB sticks that were sold at electronics stores nearest the plant. Eventually someone from the plant bought and used one of the infected sticks.

11:00 I don't quite get that. If the network was airgapped, how would the virus exfiltrate information to the US or get updates?

Everyone likes to think only China or Russia has high quality hackers, the truth is the US has the best hackers in the world(TOA)... to go along with the best military equipment in the world

It was introduced by encoding every single hard disk manufactured by western digital and seagate at the point of manufacture. That’s how I’d do it

Good report.

Yeah, I wrote a paper on it. Shit is utterly insane

It was elegant

I love recommending the book Sandworm to people that are curious about this stuff. It largely covers this same story but with more little details

Get a DeEsser plugin for your editor. Please.

Thank God for nerds!!!

WTF!?!? I thought I knew all of Simon’s channels yet, somehow, here we are learning about war things, with Simon, on a new channel.

Your voice has way too much reverb on it. Love your content!

11:00 hang on. If the systems were airgapped, how did they get reports back from the first installed virus?

At the small price of starting the first global cyberwar.