a cyberweapon's best trick was 21 seconds of normal

June 2010. A small antivirus company in Belarus called VirusBlokAda gets a support ticket from a customer in Iran. Their Windows machines keep rebooting, in a loop, for no reason the customer can find. An analyst pulls the thing apart and finds a worm unlike anything on file.

It carries four zero-days, flaws in Windows that nobody outside its authors has ever seen, when a single one would have been worth a fortune on the open market. It signs its drivers with certificates stolen from two Taiwanese hardware companies so Windows will wave it through. And it isn't after passwords or credit cards. It checks each computer it lands on for one thing, a particular Siemens controller running a particular configuration, and if it doesn't find it, it does nothing at all. It just moves on to the next USB stick.

The configuration it wanted belonged to Natanz, the enrichment plant south of Tehran. Natanz is cut off from the internet. The worm is believed to have crossed that gap the slow way, on a thumb drive carried in by someone who may have had no idea.

What it did inside is the part that stays with you. Ralph Langner, the German engineer who did more than anyone to decode the payload, found that the first version of the attack targeted the valves. Centrifuges at Natanz run in cascades of 164 machines each, with isolation valves at every stage. Stuxnet closed the valves on the first two and last two stages. Gas kept coming in and had nowhere to go. Pressure climbed inside rotors spinning at 63,000 rpm, rotors made of aluminum tube that do not tolerate much.

Before it touched a single valve, though, it recorded. For 21 seconds it listened to the cascade's protection sensors, the readings that go to the control room and to the automatic alarms, and saved them. Then, while the pressure rose, it played those 21 seconds back. On a loop. On the screens, every needle sat where it belonged. Langner's phrase for the control room was that all appears to be normal, both to the human operators and to any software-implemented alarm routines. The alarms were watching a recording.

It ran about once a month, and it was never meant to blow anything up on the spot. The idea was to stress the rotors so they'd fail later, on their own, at some random hour when nobody would connect it to anything. A later version changed tactics and went after speed instead: 63,000 rpm pushed to 84,600 for fifteen minutes, then on another run dropped to 120 rpm and brought back up, fifty minutes of it, once a month, with the same replay covering the dashboards the whole time.

Between November 2009 and February 2010, Iran pulled about a thousand IR-1 centrifuges out of Natanz. An IAEA report dated February 18, 2010 showed 11 of the 18 cascades in module A26, the plant's second module, disconnected and no longer under vacuum. The Institute for Science and International Security, which read the inspection data cascade by cascade, could not say for certain it was Stuxnet, and neither could anyone else. Its report walks through the ordinary explanations first, like a bad batch of rotors in A26, and notes that none of them explain why it took so long for that module to fail. Langner's cold summary was that if those engineers hadn't looked incompetent before, they did now, in their own plant, in front of their own management.

Nobody has ever claimed it. The program is widely reported to have been a joint American and Israeli operation code-named Olympic Games, begun under Bush and continued under Obama, and both governments have declined to confirm a word of that for sixteen years.

Now the other loop.

Somebody asks how you've been. You hit play. Good, busy, can't complain, work's a lot but it's fine. It's a solid recording. The timing is natural, the laugh is in the right place, and you've been running it since March.

these days, replays got me feelin better

The people who love you are the control room. They are watching the readings you send them, and the readings say normal, and the readings are from spring. Everyone checks whether the number is in range, and almost nobody checks whether it's live. Stuxnet was built on that gap. A needle sitting in the green is the most reassuring object in the world, and it will sit there for as long as the loop runs.

What the loop can't fake is the floor. The vibration gets into the concrete. A thousand machines don't leave a building without anyone noticing, no matter what the screens said while they were failing, and the engineers who have to haul them out are the ones who end up looking like they didn't know their own plant.

Twenty-one seconds was enough, because twenty-one seconds of normal, repeated, is indistinguishable from normal. Until you look at the date.

They'll believe the loop. The floor won't.

The painting: Joseph Wright of Derby, An Experiment on a Bird in the Air Pump (1768), National Gallery, London. Public domain.

Sources