Released in 2008 but discovered in 2010, Stuxnet is a computer worm that was designed to attack
programmable logic controllers.
Stuxnet reportedly compromised Iranian PLCs, collecting information on industrial systems
and damaging infrastructure.
According to a November 2013 report from businessinsider.com, Stuxnet was responsible for destroying one-fifth
of Iran’s nuclear centrifuges by causing them to spin out of control.
The worm exploits four, zero-day flaws that are present in some SCADA systems.
A zero-day flaw is a vulnerability in an application or operation system that is unknown or developers
have not had time to patch.
In the case of Stuxnet, the worm targets systems using the Microsoft Windows operating system
and networks, then it begins searching for Siemens Step7 software.
If it is able to find the proper vulnerabilities in a given system, then it carries out its
exploits.
Stuxnet is typically introduced in to a system via an infected USB flash drive and then propagates
throughout the network.
However, with the growing attachment to networked infrastructure and the “internet of things”
there are more access points for individuals who are interested in gaining control of SCADA
systems by using worms and viruses like Stuxnet.
A good mission critical operator should be able to run security maintenance and apply
best practices to make sure SCADA systems are not compromised in order for the company
to continue to run smoothly.