Zero Days Page #4

But in stuxnet

there were actually

a few hints left behind.

One was that, in order to

get low-level access

to Microsoft windows,

stuxnet needed to use

a digital certificate,

which certifies that

this piece of code

came from

a particular company.

Now, those attackers obviously

couldn't go to Microsoft

and say,

"hey, test our code out for us.

And give us

a digital certificate."

So they essentially

stole them...

From two companies

in Taiwan.

And these two companies have

nothing to do with each other

except for

their close proximity

in the exact same

business park.

Digital certificates

are guarded very, very closely

behind multiple doors

and they require multiple

people to unlock.

Security:
...To the camera.

Chien:
And they need to provide

both biometrics

- and, as well, pass phrases.

It wasn't like

those certificates were

just sitting on some machine

connected to the Internet.

Some human assets

had to be involved, spies.

O'murchu:
Like a cleaner who

comes in at night

and has stolen

these certificates

from these companies.

It did feel like walking

onto the set

of this James Bond movie

and you...

You've been embroiled

in this thing that,

you know, you...

You never expected.

We continued to search,

and we continued

to search in code,

and eventually we found some

other bread crumbs left

we were able to follow.

It was doing something

with Siemens,

Siemens software,

possibly Siemens hardware.

We'd never ever seen that

in any malware before,

something targeting Siemens.

We didn't even know why

they would be doing that.

But after googling,

very quickly we understood

it was targeting

Siemens plcs.

Stuxnet was targeting

a very specific hardware device,

something called a plc or

a programmable logic controller.

Langner:
The plc is kind of

a very small computer

attached to

physical equipment,

like pumps,

like valves, like motors.

So this little box is

running a digital program

and the actions

of this program

turns that motor on, off,

or sets a specific speed.

Chien:
Those program

module controllers

control things like

power plants, power grids.

O'murchu:

This is used in factories,

it's used in

critical infrastructure.

Critical infrastructure,

it's everywhere around us,

transportation,

telecommunications,

financial services,

health care.

So the payload of stuxnet

was designed

to attack some

very important part

of our world.

The payload is gonna be

important.

What happens there could be

very dangerous.

Langner:
The next

very big surprise came

when it infected

our lab system.

We figured out that

the malware was probing

for controllers.

Rate this script:0.0 / 0 votes