Stuxnet Variant Origins May Stretch Back to 2005, Symantec Says
The notorious malware at the center of the cyber-sabotage campaign that targeted Iran's nuclear program is several years older than researchers once thought.Researchers at Symantec have uncovered another phase in the evolution of Stuxnet, an early variant of the malware that may have been developed as early as 2005. In the more than two years that has passed since Stuxnet was discovered during the summer of 2010, the malware's complexity and goal of causing damage in the physical world has led to multiple efforts to peel back all of the layers of Stuxnet's existence. But while it was previously believed to have first appeared in 2009, Symantec researchers have uncovered an older variant that they have traced back to years before. Dubbed Stuxnet version 0.5, the variant was submitted to a public malware scanning service during 2007, but may have been in operation as early as 2005, according to Symantec. This particular version is designed to stop compromising computers on July 4, 2009, and to stop communicating with its command and control (C&C) servers on Jan. 11, 2009. It replicates through the infection of Siemens Step 7 project files and does not exploit any Microsoft vulnerabilities as later versions did. "When Symantec first disclosed details about how Stuxnet affected the programmable logic controllers (PLCs) used for uranium enrichment in Natanz, Iran, we documented two attack strategies," according to Symantec's Security Response Team. "We also noted that the one targeting 417 PLC devices was disabled. We have now obtained an earlier version of Stuxnet that contains the fully operational 417 PLC device attack code."
"After painstaking analysis, we can now confirm that the 417 PLC device attack code modifies the state of the valves used to feed UF6 (uranium hexafluoride gas) into the uranium enrichment centrifuges," according to Symantec. "The attack essentially closes the valves causing disruption to the flow and possibly destruction of the centrifuges and related systems."