Add Stuxnet to utility industry vocabulary

According to a recent article in major newspapers [see Washington Post, Oct 1], a sophisticated worm designed to infiltrate industrial control systems could be used as a blueprint to sabotage machines that are critical to U.S. power plants, electrical grids and other infrastructure. The malware goes by the name of Stuxnet and so far, nobody seems to know or willing to say where this virus originated from. It was first discovered couple of months ago when it infected several computers in Iran in locations close to some nuclear facilities. According to security experts, the virus looks to be designed to infect industrial controls using Siemens software and to take over an unknown process at a time to be triggered by the author of the virus.

Not surprisingly, the Israelis are not saying whether Stuxnet has any connection to the secretive cyberwar unit it has built inside Israel’s intelligence service. Nor is the Obama administration, which while talking about cyberdefenses has also rapidly ramped up a broad covert program, inherited from the Bush administration, to undermine Iran’s nuclear program. [See article in NYT, Sep 29]. 

Several weeks ago, a control system monitoring pressure in a natural gas pipeline in San Bruno, Calif., malfunctioned, resulting in an explosion and fire that killed eight people. The cause of this incident was an accident, but the scary part is that a virus like Stuxnet could cause even worse accidents on purpose. According to an expert from the North American Electric Reliability Corp., also known as NERC, Stuxnet was built to take advantage of weaknesses in industrial systems. For instance, the worm banked most industrial plants' reliance on third parties to perform maintenance and assist in troubleshooting, and these outsiders often plug thumb drives or other removable media into the systems. The irony, he said, is that industry has long known about these gaps and high-risk practices.