Episode 13 - Stuxnet, Trading Bombs and Bullets for Bits and Bytes!

In this episode Global Bob (Brian Varner) tells the general story of what lead up to the development and launch of Stuxnet and how it was used to destroy Iranian centrifuges.  The information for this podcast was aggregated from various sources online and the accuracy may vary due to the fact that the actors behind Stuxnet have not publicly acknowledged the existence of Stuxnet or took credit for it.

Transcripts are automatically generate.

Episode Transcript

(00:17):
All right. All right, here wego. It is that time of the week.
For the global Bob Show.
Globalbob show, we are thecrossroad of technology and
politics. This podcast episodenumber 13. is
about STUXnet, Stuxnet, tradingbombs

(00:40):
and bullets for bits and bytes.
As always, thank you, foreverybody that tunes in every
week. If you liked this podcast,and you get something out of it,
feel free to share it on socialmedia, or tell your friends
about it. You can reach meGlobalbob [e-mail],
Twitter at Globalbob Show orthrough the Facebook page, the

(01:04):
Globalbob show. Now this talkwas one that I've been waiting
to do for a while. But I neededto put it all together and
figure out exactly how I wasgoing to deliver the message.
There's just so much that goesinto the story of STUXnet. And
at the highest level, wheneverI'm asked, Why was Stuxnet so

(01:27):
significant, I draw a parallelbetween the dropping of the bomb
the atom bomb on Hiroshima andNagasaki, as the same as
deploying Stuxnet against theIranian nuclear enrichment
facility. And not just becauseboth have nucular subjects

(01:50):
involved. But because when wedropped the two bombs, fat boy
and little man on Hiroshima andNagasaki, that instantly
propelled us into the AtomicAge, and when STUXnet was
deployed against the Iranianfacility, then that, to me

(02:13):
instantly propelled us into thecyber war age. So before we go
too much further, please justkeep in mind that all of this
information I'm bestowing uponyou is generalized information.
If you would like to go deeperinto this, please do your own

(02:35):
research. And Please also keepin mind that the nation or
nations behind Stuxnet, havenever admitted to it publicly.
So as you listen to thispodcast, you'll probably draw
your own conclusion of who'sbehind it. But please just
understand that unless theyactually come out and admit to

(02:59):
being behind Stuxnet, then thisis all just speculation. So how
did we get to the point where weneeded a capability to stop the
Iranian enrichment process?
Well, it all kind of stems fromthe 1950s, when President

(03:24):
Eisenhower talked about Atomsfor Peace. So during that speech
that he gave to the UnitedNations, the Atoms for Peace,
basically, he offered to givenuclear material and nucular
technology to countries for themto develop their own peaceful

(03:47):
nuclear program. And I saypeaceful, it was supposed to be
used for energy. And then kindof the thought behind his speech
was, is that instead of all ofthese nations going out, to
enrich uranium, then if we wouldjust give them what they need
for generating nuclear power,then that would keep them from

(04:10):
having their own program thatwas in the 1950s. And you have
to also keep in mind in the 50s,and into the 60s 70s, even the
80s, Iran and the United Stateswere on pretty good terms. And
then once the Shah wasoverthrown, then that's when our

(04:38):
relationship with them kind ofturned sour. The Shah of Iran,
who was somewhat of a US ally,was overthrown. And the new
regime made it very public thatthey did not like the United
States, and they did not likeIsrael. To this day, there are

(05:00):
still some derogatory commentsthat get made on social media,
from the various Iranian newsoutlets. But that's something
that's important to remember is,is that they don't believe in
Israel's right to exist, theydid not like what the Israelis
are doing to the Palestinians.
So you can see why it would notbe a good idea for Iran to

(05:24):
possess such a weapon. So that'skind of the backstory with the
relationship between the US andIranians. Now, in the late
1990s, around 1998, I believe itwas, there's a new player on the

(05:44):
nucular front, and that isPakistan, Pakistan had a
scientist named a que con. Andthat is probably for another
podcast, we could talk a lotabout AQ Khan. But he is the one
that secretly helped Pakistandetonate their first nuclear

(06:08):
weapon. Now, AQ Khan was notcontent enough, I guess, just by
helping Pakistan. So he had anetwork that he put together.
And this is where a lot of theseother nations get their
knowledge. So AQ Khan isbelieved to help the North

(06:29):
Koreans and their efforts, he'salso believed to have helped
Iran and Libya. So in summary,AQ Khan was open for business to
whoever wanted to pay him togain access to this technology.
So in the early 2000s, Iran wasramping up its nuclear

(06:52):
enrichment. And one of the keycomponents and this is important
to know also, is thesecentrifuges. Now, the way this
uranium needed to be enriched,was using very specialized
centrifuges. And a centrifuge.

(07:15):
If you've seen them before,either on TV or maybe in your
doctor's office, basically, youput something into a centrifuge,
and it spins around in circlesvery, very fast. And it's the
spinning action that separatesvarious weights of liquid. Well,
this can also be used toseparate isotopes, which are

(07:41):
part of the atoms. And so thesecentrifuges were really special,
these aren't the ones that youwould just go buy from a medical
supply store. The centrifugesthey were, they would spin at
about 100,000 rpms. So this issupersonic. The centrifuges were

(08:05):
probably about 10 foot tall, andmaybe eight to 10 inches wide.
And what you had to do is put agas inside the centrifuge, and
the centrifuge would spin thisgas, and the gas contained
uranium 238. And uranium 235.
Uranium 238, is what can be usedfor the production of power by

(08:33):
having a nuclear core that heatsup water. And that's basically
how a nuclear power plant works.
It works like a big tea kettle,but it's that uranium 235 that
you need to have for a fissionbomb. Now the uranium 235 is

(08:56):
naturally occurring, and mostlyoccurs along with the uranium
238. But it's in very, verysmall doses. So if you take the
percentage of the gas going in,let's say maybe 98% of it is the
uranium 238. And about 2% or sois uranium 235. So the gas which

(09:23):
is the hydrofluoric gas goesinto the top, the centrifuges
very precisely spin atsupersonic speeds, and the
heavier isotopes, the 238 goesto the outside walls of the
centrifuge, then the 235 can beextracted through the bottom,

(09:45):
and this process repeats itselfover and over and over again,
until they get to what they needfor a nuclear bomb, which is
uranium 235 at about a 90% costcentration now, when they set up
this nuclear facility, it wasn'tlike they just needed one

(10:07):
centrifuge, they needed 1000s ofcentrifuges to be spinning. And
so the facility is a pretty goodsize. Now, when they put all of
these centrifuges together, oneleads to the next until finally,
at the end of it, you have thematerial that you need for a

(10:27):
nuclear bomb. So Westernintelligence agencies, and
Israel started to become alarmedthat AQ Khan was not only
teaching the Iranians how toenrich uranium, but also he was
selling them these specialcentrifuges. Now, Israel knows

(10:51):
that Iran, even to this day, haspublicly said that they don't
agree with their right to exist,and has said basically, in the
past that they would like towipe Israel off the face of the
earth, during all this time iswe have a president in office

(11:11):
named George Bush. So theIranians, you would have to
assume are getting increasinglynervous and wanting to do some
kind of military operation totake out this facility before
they can get access to thismaterial to create a bomb. At
this time, I think it's around2005 ish, you got to remember

(11:34):
the US we're in deep intoAfghanistan, we're in deep into
Iraq. And you can imagine thatopening up a another war front
and Iran would probablyoverstretch us. But Israel knows
that they have to do something.
So putting increased pressurefor a military option on the

(11:56):
table is something that thePresident Bush had to deal with.
Now, the Israelis are nostranger to war. The Israelis
found out back in the 90s, Ibelieve it was that Iraq was
also trying to enrich uranium.

(12:20):
And so they went into Iraq andbombed that facility. Now, you
got to imagine the cards thatare on the table in front of
President Bush, he's got theIsraelis that are pressuring
him, or basically asking him ifthey can go in and bomb this
facility, and us being allieswith Israel would put us on to a

(12:40):
third front of a war, or whatcan he do? So we started putting
sanctions on Iran, and basicallytrying to monitor them, monitor
them through the IA E A. Now,before Stuxnet, then really you
only had a couple of options.
And most of those options werekinetic. But there was some very

(13:03):
smart people understanding whatcyber war capable of, but they
needed to sell this to apresident and actually, to the
US military, that has never beendone before. I mean, they could
pontificate that they could puttogether something to cert

(13:24):
petition, Slee enter the Natanznuclear facility in Iran, and
destroy it. But it's like, comeback to the atom bomb. It's like
it all makes sense on paper, butwhat it really work. Now, what
you can find out throughresearch is that Western
intelligence agenciesintercepted a shipment from AQ

(13:46):
Khan going to Libya. And theyintercepted the shipment so they
could see exactly how thecentrifuges work, and what all
it takes to run thesecentrifuges. Now, I've been
involved with lots of physicalcyber simulations. And so I can
kind of tell you probably theway this worked, because I've

(14:10):
done this kind of thing beforewhere we've simulated SCADA
control systems or supervisorycontrol and data acquisition
systems, which is kind of thename that's given to these types
of computer systems that controlmachinery. So what I would
envision is, is that once theWestern intelligence agencies

(14:33):
intercepted the shipment, theywere able to catalogue exactly
the controls that were used thetypes of computers that were
used to control this, and theyfound that the centrifuges used
a SCADA module or SCADA systemfrom a company called Siemens,
and they use the Siemens stepseven SCADA system, and they

(14:58):
used a Windows based computer tointeract with those SCADA
modules. So then the shipmentcan go on to its final
destination. And back in thisus, they could replicate the
Natanz nuclear facility. So theycould start to vies different

(15:21):
tactics, techniques andprocedures to possibly sabotage
this through a cyber capability.
And allegedly, that's what theydid, they were able to figure
out a couple different ways thatthey could destroy the

(15:42):
centrifuges. And when they foundone, that they could close off
the valve at the exit of thecentrifuge, that pressure would
build up. And if the pressurebuilt up in the centrifuge, then
the gas would start to solidify.
Now, you all know that if youhit a bump in the road on your

(16:04):
car, and it knocks your willweight off, that tire starts to
wobble, well, when thecentrifuges are spinning at
supersonic speeds at 100,000revolutions per minute, if they
could build up a little bit ofpressure in there, that gas
would start to solidify. And thesolidification on the of the gas

(16:25):
on the centrifuge fins would beenough to make the centrifuge
start to wobble. And that'sexactly what it did. And it
actually happened prettyquickly. The centrifuge is
starting to wobble, and ittotally destroys itself. From
research that I've done that itbecame a like a heap of metal

(16:48):
and on the floor. So to prove tothe US military and to the
president, they took this metalfrom their top secret lab, they
put it in a box. And the storythat I heard was is that they
flew it to Washington, DC, anddumped it on the desk of the

(17:10):
Situation Room. And that's wherewe instantly knew that this was
a possibility of using bits andbytes, instead of bombs and
bullets, to have a kineticeffect on infrastructure. Now,
this is the same, there's somany parallels between this and

(17:34):
developing the atom bomb one,this would have been a highly
technical, very advanced neverbefore capability. And also the
people working on this wouldprobably be at the utmost
security clearance level. Noteverybody would know about this,

(17:55):
much like the Manhattan Project.
There was also another meansthey found to mess up the
centrifuges or destroy it. Andthat was varying the speed at
which the centrifuge spun, ithad to spin at a very precise
speed. And so they also figuredout that they could increase and

(18:17):
decrease the speed of thecentrifuges just enough to cause
damage to them. And like I said,the centrifuges you just don't
go buy from a medical supply.
These are very special built,custom built. So any of them
that they destroyed, would bedetrimental. Also, not only were

(18:40):
you destroying centrifuges, butyou're also wasting the gas,
that gas that goes into thecentrifuges. So this can be a
one two punch, and could delaythe Iranians research and
exploration and ultimatelydeveloping of a nuclear weapon.

(19:01):
So by that time, they had signedoff on it, supposedly, and
STUXnet was developed and readyto be launched. Now, you know
the back story, what led us upto the development of STUXnet.
And now we understand that thereare now cyber capabilities to

(19:24):
destroy centrifuges, however,that we still get a major
problem. As you can imagine, theNatanz nuclear facility was
probably one of the most heavilyguarded facilities. And you're
just not going to put on arubber nose and sunglasses and

(19:45):
have one of our Westernintelligence assets get in there
and put Stuxnet on the network.
Moreover, the network was aspecial network and a lot of
companies use this The type ofnetwork militaries use in
research facilities use it, it'scalled an air gapped network.
Now, air gap networks mean thatyou don't have the network

(20:10):
connected to the internet. So wecouldn't sit over here in the
States and try to Spearfish,someone to click on something
that then puts Stuxnet on thenetwork. We're not going to hand
somebody a thumb drive and say,Hey, go inside the facility and
put this on there. Now, but whatwe do know that devices, go on

(20:34):
air gapped networks and off. Sothis could be scientist with
laptops that they go home, andthey get on the internet, or
they go to, you know, maybetheir office and they get on the
internet. Then when they goinside the secured facilities,
they plug that same laptop in.

(20:56):
And also, they have thumbdrives. So there could be a
thumb drive that gets insertedinto the home computer or
computer that's on the internet.
And then it gets inserted intothis air gap network at the
Natanz facility was Stuxnet, itwas a very, very long game, this

(21:17):
did not happen in a couple ofdays, or even a couple years.
Now, what had to happen was isthat Western intelligence needed
to know what computers are onthose networks. And so they
started targeting folks thatthey thought would be going in
and out of the facility takentheir equipment in and out of

(21:40):
the facility. And so a specialvirus was written that was
designed to get on to air gappednetworks. And so essentially,
the way these air gapped viruseswork or air gap worms work is is
that it lands on a computer, soit knows that it's on a device
that could be connected to theinternet, and then it checks to

(22:03):
see if it's connected to theinternet. Then, when that device
or laptop is taken into anothernetwork, it's plugged in, and
the virus tries to get out tothe internet. If the virus can't
get out to the internet, it mayassume that it's on an air
gapped network. Now, the firstphase of this was collecting
reconnaissance. And so as thefolks went in and out of the

(22:30):
facility, then it would scan theinternal network and then take
and send all of its informationback when it had a way to the
internet. So that was kind ofthe first recon phase. Once they
confirmed that they were hadsome kind of device that was
being plugged into the Internetand then back into the air gap

(22:50):
network, then it was time tounleash Stuxnet. Now, around the
same time, there was somethingthat happened here in the United
States, and it happens everyfour years. And that is a new
president comes in. So GeorgeBush was on his way out, Barack
Obama comes in. And so thisprogram had to be reauthorized.

(23:15):
As you could imagine. Given allthe backstory and the
capabilities, it was probably ano brainer for Obama to say yes,
let's proceed on. Now, what wedidn't have is a capability to
understand if this was working.

(23:35):
But there were inspections goingon by the I AE A, which is the
agency that was doinginspections to make sure that
the Iranians and other nuclearnations are compliant with
international law. They would goin do their inspection, they
would view video cameras,because part of the the

(23:57):
agreement was is that anythingcoming in and out of this
facility had to be photographed.
Now, there was a report that waswritten talking about how 1000s
of centrifuges were being takenout of the Natanz facility. And
so the inspectors would write upthe report and send it back to
their headquarters in Vienna soit can be reviewed. And that's

(24:20):
when we knew that this wasworking. Now, the way Stuxnet
worked was is that it couldn'tjust get on to the network and
destroy all the centrifugesbecause that would be kind of
tipping the hat where peoplewould know hey, there's

(24:43):
something fishy going on here.
But STUXnet was very, veryclever. It took and lay dormant
inside the network and recordedwhat this normal network traffic
back and forth between thecentrifuges And the computers
and the SCADA system lookedlike. And it did that. So when

(25:06):
it got time to launch itsattack, then the folks that are
monitoring the centrifuges willnot be tipped off, you have to
understand that, you know, thisneat killer technology, there's
a lot of controls and safetyfeatures around it. So let's say
the centrifuges are supposed tospin at 100,000 rpms. Well, if

(25:28):
someone noticed that it jumpedto 115,000, or decreased to
90,000, then that would tip themoff, hey, there's something
going on. Let's stop everything.
But what would happen is, isthat STUXnet had the legitimate
traffic recorded. And so when itwould request these centrifuges
to spin faster and slower, thefolks that are monitoring it

(25:54):
never knew, because on theirmonitors, everything looked like
it was right. And so it was whenthe increase of the centrifuges
being replaced, that theythought something was on. Now,
let's go back to what happenedin current times. So the Stuxnet

(26:16):
is in the Iranian facilities,the Iranians think they have bad
centrifuges or something. Buteverything checks out. The US
and Western intelligenceagencies are monitoring the IAEA
reports. And they know there'san increase in the centrifuges
being decommissioned. While atthe same time, computers in Iran

(26:38):
started to randomly reboot. Andyou got to understand that in
anti virus, there's a couple ofbig companies out there, one of
which being Symantec, which is aUS company. So you could imagine
the Iranians don't want the USsecurity companies monitoring

(27:01):
their security. So they had acompany called virus block
Qaeda, which was from Bellaruse. So this folks and Bella
ruse had complaints that, hey,computers are randomly
rebooting, we don't know whythis is happening. And their
antivirus software, it wasn'tflagging anything. So what they

(27:26):
did was they took a remote imageof the computers and started to
look through it. And they arethe ones that found that there's
some kind of virus that's a zeroday virus that's not being
detected, and something's goingon. Now, Symantec at the time,
also was on to this Stuxnetvirus, but they didn't know it

(27:53):
as Stuxnet. At the time, thisresearch at the time was being
performed by some of the mostbrilliant people at Symantec.
And they quickly realize that,hey, we're not dealing with your
run of the mill, zero day virus.
For all intents and purposes,usually, these viruses are very

(28:15):
small, just a, you know, a fewkilobytes. But Symantec
researchers understood that,wow, this is like 500 kilobytes,
this is a monster in size. Andthen looking under the hood of
it, it really didn't do anythingunless certain parameters were
met. And those parametersincluded looking at computers

(28:39):
that had access to SCADAnetworks. More over, they
started to look at the otheraspects of this virus and
realize, hey, this did notcontain just one zero day
exploit this contained for zeroday exploits, which is really

(29:00):
kind of unheard of unpacking thevirus, the researchers quickly
knew that they were probablydealing with some kind of state
sponsored activity, but theydidn't quite know who the target
was or what the target was. Andthere was other reporting

(29:20):
starting to happen on this. Nowthey had an obligation to report
their findings. And so once thefindings got reported, the
Iranians came out and said, Hey,we realized that the some
Western intelligence agenciestried to infiltrate our network,

(29:45):
we caught them, we've erasedeverything and it really did not
affect us. Now, looking at thereports, and from what experts
have gathered that this reallywas detriment. Mental to the
Iranians that this set backthere nucular capabilities of

(30:07):
developing a bomb many years.
And so with this was really thefirst time that there were two
options on the table, we couldeither go in or the Israelis
could go in and bombed theNatanz nuclear facility, or for
the first time, we couldactually trade bombs and bullets

(30:29):
for bits and bytes, andessentially get the same
outcome. That's why I draw somany parallels between the
development of the nuclear bombthat we dropped on Japan, with
the development of Stuxnet, justan amazing capability, an

(30:55):
amazing demonstration of Westernintelligence, and the ingenuity
and engineering that we canaccomplish. Symantec researchers
would go even farther afterthis, to figure out that, hey,
there was previous versions ofthe Stuxnet. And that what we

(31:16):
had found was basically likeversion four. And really, there
were three other versions beforethis. So what we kind of did is
trip into the cyber age, andSymantec would later go on to
figure out that these earlierversions could have been as

(31:37):
early as 2005. Now, like I said,everything I give you here is
just the general story. Andplease, if you do want to quote
any of this, make sure you goout you find the actual sources
of this information are right,well, we're at the end of the

(31:58):
half hour. As always, thank youso much for those that listen
and tune in each week. As youknow, I do all of this for you
all. And without your support,then we would not have the
global show. So thank you somuch for sailing the Digital
Ocean andcruising the highways and byways

(32:20):
of cyberspace as we explore thecrossroads of politics and
technology. All right,everybody. I will see you next
week as we unpack our nexttopic. Until then,