Stuxnet

Amidst all the news of Wikileak exposure of US government documents (and I'd be much interested how all this data was obtained - the Guardian says it comes down to one lowly US army private - I cannot believe one lowly private leaked so many documents! ), much has been made in the last couple of weeks of the Stuxnet v¡rus which targets industrial control systems through Siemens Programmable Logic Controllers and its Windows Step 7 control software.

Conspiracy theories abound.The principal one being that the virus is an attempt by an unnamed government to subvert Iran's nuclear program which has backfired to lead other governments to get worried about their own industrial control systems - anything from power stations, electrical grids, water purification and distribution, factory automation etc etc.

I am sceptical but also surprised for a variety of reasons:

1. News of the Stuxnet virus has been around several months. Only now is the press picking up on it saying it is an attempt to subvert the timing on Iran's nuclear centrifuges.

2. It is only aimed at Siemens PLCs.

3. What the hell is Siemens doing exporting PLCs for use in Iranian nuclear centrifuges? I will admit that a bog standard PLC is hardly rocket science and could control the timing of many industrial processes. However, I thought there were export limitations on technologies that could be used in "rogue" nuclear states such as Iran and North Korea.

4. The Iranians deny that any of their nuclear powerplants have been infected by Stuxnet. So would the USA.

5. PLC software from my limited experience would seem to be very easy to hack. I have only very limited experience but in a previous job a one megawatt powerplant was controlled by simple GEFanuc PLC hard and software, the latter written in a generic form of Basic called MegaBasic.

6. Why would you use a Windows-based program to control your nuclear powerplant?

7. And leading on from 5) and 6) why hasn't PLC software been targeted before? I cannot quite believe that Stuxnet is the first given the importance of PLCs in the functioning of the modern world.

Complete technical report here.