Stuxnet is way older than we thought

Think you knew all there was to know about Stuxnet, the worm that was discovered in 2010 to have destroyed thousands of uranium enrichment centrifuges at Iran’s Natanz nuclear facility? Think again. It appears that an early version of the worm was attacking Iran’s nuclear program years before the version that made headlines in 2010 was unleashed, according to a new report by the IT Security firm Symantec.

Dubbed Stuxnet 0.5, the early version of the worm attacked Iran’s nuclear program by closing valves that allowed uranium hexafloride gas (UF6) to flow into the centrifuges at Natanz, according to Symantec. Cutting off the flow of UF6 would, in theory, damage the centrifuges. (Click here for a primer on gas centrifuges.)

This apparently didn’t work as well as Stuxnet’s designers wanted it to and we saw later versions of the worm that famously caused the centrifuges to spin out of control — thereby destroying them. Stuxnet 0.5 was under development as early as November 2005 and in the wild by November 2007 with orders to shut down by July 2009 — the year that the version aimed at causing the centrifuges to spin out of control was developed, according to Symantec.

"The earliest known variant of Stuxnet was version 1.001 created in 2009. That is, until now," reads a Symantec blog post accompanying the report.

Remember, Stuxnet was reportedly the work of a U.S.-led cyber campaign against Iran known as Operation Olympic Games. At the time of its discovery the worm was considered to be one of the most advanced cyber weapons ever fielded. The worm reportedly took an unprecedented amount of time, expertise, and money to create.

As a Symantec blog post says, "Stuxnet proved that malicious programs executing in the cyber world could successfully impact critical national infrastructure."

The malware was designed to worm its way (See what I did there?) harmlessly around the globe until it found its precise target, the Siemens-made programmable logic control (PLC) computers that ran the centrifuges at Natanz. Once there, it attacked. You know the rest.

Some cybersecurity experts fear that cyberweapons like Stuxnet can be revers- engineered and used against their creators or sold on the ever-growing black market for cyber weapons.

"The difference between traditional weapons and cyber weapons is that it’s not possible to [re]assemble a cruise missile after it has been used," said cyber security expert Eugene Kaspersky last September in Washington. "Cyber weapons are different" because the victims "can learn from" weapons used against them.

As another cyber security expert told Killer Apps last fall:

Because uranium centrifuges and power turbines are both spinning machines, "the attack is identical — the one to take out the centrifuges and the one to take out our power systems is the same attack."

"If a centrifuge running at the wrong speed can blow apart" so can a power generator, said the expert. "If you do, in fact, spin them at the wrong speeds, you can blow up any rotating device."

These new revelations are unlikely to assuage such fears.