Thoughts and opinions on Stuxnet

October 9th, 2010

Stuxnet has been on of the biggest topics in InfoSec for a little while. I am not going to go into a whole lot of technical depth on it as I am more interested in the ramifications of it. There is a nice recap on Wikipedia if you need to catch up. Basically Stuxnet is the first confirmed (to the general public) attack on Supervisory Control and Data Acquisition (SCADA) systems. As it turns out, the systems that were attacked by Stuxnet had been infected for quite some time before being detected.

This scares me quite a bit as the writers of Stuxnet could have completely destroyed Nuclear Control Systems in any of the plants that it infected. I am not by any means an expert of anything but one of the first thoughts that come to my mind when I hear about this is the possibility of a remotely triggered nuclear accident to the extent of Chernobyl. If that does not scare anyone else, I am not sure what does.

I am sure there have been several controls put into place to prevent something like the Chernobyl accident happening again. We have had almost 25 years to learn from it and improve our technology and understanding of nuclear technology but one thing I have learned from the InfoSec world is to never say something can’t be done.

); ?