Schneier on Security

Clive Robinson • November 22, 2010 10:04 AM

Although I’m fairly convinced (and have been for some time) that the target of Stuxnet is the controlers for the centrifuge cascade for enrichment, I’m less certain who the real target is.

That is there are other candidates other than Iran…

One of whom is North Korea.

Unlike the design of the yet to be commisioned Nuke power plant in Iran the design of the centrifuge cascade is well known to the US and many other countries due to a series of technology sales of Pakistani nuclear technology.

Suposadly something like 24 countries purchased the designs of AQ Khan on of which was Libya. Unfortunatly for them the shipment of technology got empounded and thus became very known further since Pakistan cosied up to the US further information became available.

Now the US has an issue with North Korea and it’s nuclear weapons and rocket technology. North Korea is a very very closed country and has little or no contact with the outside world so attacking it with malware is going to be difficult.

That is unlees you can get at it through a trusted third party.

It has been said that there is a two way flow of info between Iran and North Korea over nuclear technology for some time.

What better way for the US to spike North Korea’s guns than through Iran or one of the other countries that it does technology swaps with?

But who ever get’s hit by stuxnet is actually not important, as it sends out a loud and clear message to anybody using AQ Khan technology that they are vulnerable and there is little they can do about it.

Which raises the question of if stuxnet is a political or business weapon. That is it may have been designed and built not by a state player like the US but by an organisation with replacment technology for sale.

Now there are a lot of ex-Russian nuclear physics bods down on their uppers as it where with skills that although highly valuable are not very marketable.

So don’t automaticaly assume it is a state actor such as the US hand behind stuxnet (although the probability is high).

Clive Robinson • November 23, 2010 1:23 PM

@ Robert T, Nick P,

Both Nick P and myself thought the unfinished nuclear reactor was an unlikley target.

My reasoning was that the reactor plant had to many unknowns to be an effective target for PLC malware.

Nick beat me on the draw to the enrichment plant because although I had thought of it I actually knew very little about the specific plant and was doing some research to see what was known.

Meanwhile another person on another blog preceaded us both, however it is unclear if they came up with the idea or as has been suggested it was thought up by somebody else.

For those more famliar wth the UN 5 permanent security council members cascade designs most of them don’t use that sort of arangment to control their centrifuges (the issues being historicaly reliability and flexibility whic Greg can probably tell you more than I can).

And if I was responsable for designing a cascade myself I would certainly consider doing it the way you suggested and not the PLC route (it would be more responsive, flexible and reliable that way and above a thousand units certainly cheaper).

So why have the Iranians gone down the PLC route…

Well it is a mater of pragmatism and timing.

When AQ Khan designed his cascade custom electronics usually ment involving a company in a country such as the US, so not a good idea from the security asspect.

Also off the shelf parts are usually better for peripheral activities in prototype designs even though the parts may be ten or twenty times more expensive than they need be. They are readily available debuged and have most of the hard work taken out thus alowing you to concentrate on the actual core design.

So once AQ Khan had his design up and running he had no incentive to refine the electronics it was not his field of endevor and would have been carried out by others if required.

But if you think further about it when “illicitly” selling on the design to third parties custom electronics would effectivly have his name written all over it, which would not be a bright idea. Also he would have to support the product which would further put a noose around his neck.

However since the original design custom parts using field programable arrays are now quite cheap to design and manufacture, and with a little thought in the design can be made considerably more general purpose and thus worthwile developing as a sellable product in their own right.

Which might account for why Iran had it’s own outlet for the high frequency drivers.

Unfortunatly it did not occur to them to use different firmware on the motor drivers in their cascade, an oversight that is easy to make and may have proved costly for them.

As for Stuxnet what convinced me it was aimed at the enrichment cascade was that it was the AQ Khan design (obvious from photos on the net).

It is this design that was sold to various “Axis of evil” countries and many others. It is just to big a target not to have a go at the effective ROI imense. Where as the incompleate Nuclear reactor was not.

It was the follow on think with regards to “who else” that made me think “What if the target is actually North Korea” and Iran just a usefull stepping stone in the path or even the first step of the journy…

In the case of Stuxnet I suspect that many of us are a bit right and a bit wrong in our reasoning and thus our tentative conclusions. However that is not to say we are incorect just that those paying for the development might not have thought it up (well I guess they don’t have to think for Sux II as we’ve do it for them 😉