Stuxnet and attacks on industrial systems

In July 2010 Symantec gave a name to a piece of Windows malware that security vendors had started to pick apart: W32.Stuxnet. The oldest sample anyone could find dated from June 2009. By the end of September 2010 it had been seen on about 100,000 computers, and roughly 60% of them were in Iran.

It was unlike anything analysts had seen. It used four Windows vulnerabilities that had no patch yet. Its drivers were signed with certificates stolen from two Taiwanese hardware companies, Realtek and JMicron. And its real target was not Windows at all, but Siemens industrial controllers driving motors at very specific speeds.

In December 2010 the Institute for Science and International Security reported that Iran had replaced about 1,000 centrifuges at its Natanz enrichment plant in late 2009 or early 2010, and called Stuxnet a reasonable explanation, while noting that questions remained. Who built it has never been officially confirmed.