Can a computer virus be good?
Do you remember the Stuxnet virus that last year attacked the Iranian nuclear program and made several parts of the industries and government commissions around the world tremble?
Now it seems that the infamous computer virus – apart from the attack on Iran´s upcoming nuclear power – had more lasting effects than just making the newspaper headlines for a while. It has thus been reported by New Scientist and The Register that the virus has prompted several international security researchers to recently publish the analysis of the vulnerabilities of the software in question, the so called SCADA programs, with the intention to urge the producers of the software to close the security holes in the programs as soon as possible.
Some of these researchers claim that they have found at least 34 holes in the programs, and that they are likely to find even more. Among the most vulnerable software programs are those of Iconics of Foxborough in Massachusetts, the well known German company Siemens, as well as of the company 7-Technologies in Denmark.
The SCADA programs
SCADA is an acronym for supervisory control and data acquisition and consists (mostly) of Windows-based programs that act as front ends to computers (called programmable logic controllers, or PLC) controlling equipment on the factory floor in the industries.
This makes it possible for the SCADA programs to monitor and control industrial processes (such as power generation and fabrication), facility processes (for example in public buildings, airports and space stations) and infrastructure processes (for example oil and gas pipelines, electrical power transmission and large communication systems).
The possible threat against civic society
Stuxnet was a new computer virus in the sense that it was the first virus to include a programmable logic controller rootkit designed specifically to infect the PLC by subverting a specific software application (Step-7 application) used to reprogram the devices of the PLC. By this subversion, combined with the attack on the Windows operating system, the Stuxnet virus is able to manipulate processes facilitated by the SCADA program.
One easily understands the concern among several government commissions around the world: If succeeding to obtain remote control over the SCADA programs, Stuxnet attackers could not only bring some disturbance into the Iranian nuclear ambitions, but also damage severely the infrastructures of the civic society in other parts of the world if the virus comes into the wrong hands.
A political virus?
However, the civic approach was not the most prominent one when the virus was first being reported in mid June 2010 by the security company VirusBlokAda and became known in the broad international public about a month later. Among the most affected countries were United Kingdom, USA, Indonesia, India and Australia, but the country that took all the attention was Iran.
This was not only due to the fact that 60% of all attacks were perpetrated against Iran, as reported by Symantec Corporation, but primarily because of the objects of the attacks. For it appeared that the attacks were not perpetrated against pipelines, wind farms, communication systems or public buildings, i.e. against civic targets. No, the attacks were apparently perpetrated directly against Iranian organizations working on the enrichment of uranium that can be used to produce a nuclear bomb.
As it turned out, this was enough to create the first suspicion among security experts that the virus was not the work of individuals, but the work of an uttermost capable and powerful institution, such as a whole state. It soon became clear that – regardless of who was the mastermind behind the virus – it was in no way an ordinary malware.
The state connection
There is a remarkable thing about how the virus is made.
Not only is it unusually sophisticated and complex, written in different programming languages, including CC and CC+, and attacking its object on three levels: The Windows operation system, the PLC and the 7-step application. It is also made in a way that does not harm other computers to the same extent that other malwares would normally do. It contains, for example, safeguards to prevent that the virus spreads to more than three computers from the computer infected, and it contains a self destructive code that makes it erase itself in 2012.
Such carefulness is unusual in the malware world, where destructiveness is normally only privileged the target, not the malware, and this combined with the fact that the virus has required more work and more resources than any other malware in history, with estimated up to 30 highly specialized people working on it for at least half a year, has given some experts a reason more to think that the virus can only be powered by a very strong institution in the size of a state.
The question is, of course, which possible state has produced the virus – if we presume that it is a state.
The American connection
It is almost impossible to think of a complex intelligence operation perpetrated against an Arab country which does not include the United States among the usual suspects. However, the reason why some researchers have pointed out the United States as a possible mastermind of the Stuxnet virus is not because of geopolitical paranoia, but because of the self destructive code in the malware. The fact that the virus contains a self destructive code could be an indication of the juridical ramifications that intelligence agencies have to live with when they operate within the frameworks of the Western democracies. Furthermore, it is presumed that the United States already have experiences with sabotaging SCADA programs since they apparently sabotaged a SCADA program in the former Soviet Union under the cold war. Not to mention an otherwise secret document released to the public by the controversial organization WikiLeaks which allegedly shows that the United States was advised to reduce Iran´s nuclear capacity through so called “covert sabotage” which is commonly interpreted to be an attack perpetrated with malware.
The Israeli connection
From a geopolitical point of view, Israel would be a natural guess when searching for the Stuxnet mastermind, and therefore it is no surprise that another commonly held theory points to the state of Israel as the perpetrator of the cyber attack. But there is less agreement on how Israel could be involved. Some think Israel made the virus with technical support from the United States and possibly tested the virus on P-1 centrifuges facilitated by the United States which – allegedly – received the P-1 centrifuges form Libya´s former nuclear program. Others claim that the State of Israel did the job themselves. Among the experts supporting the latter theory, it is considered likely that Israel is technically capable of producing a virus of the quality and complexity which characterizes the Stuxnet without any help from the outside – and the theory is added an esoteric charm when it is claimed that two codes in the virus, MYRTUS and 24 September 2007, allegedly point to Israeli contexts, as well as the number 19790509 that could point to a historically traumatic murder of a Jew in Tehran. However, there is no agreement about how to interpret these codes and the overall picture does not get any simpler when not only the United States and Israel, but also Russia, France and Jordan are mentioned as possible creators of the Stuxnet virus.
The mark of an intelligence agency mission
Personally, I am quite sure there is a state involved in this affair, which also means there is an intelligence agency involved. And – as we all know – this makes it increasingly difficult, if not impossible, to find the origin of the virus, since an important part of the job of any decent intelligence agency is to create false traces and misleading signs. So, in the end it all boils down to three premises:
- Who has most motives for trying to destroy the Iranian nuclear program
- Who has the capability (technologically and financially)
- Who is willing to take the several risks that come with an operation like this
An operation like this does not only include a risk for the possible reveal of the origin of the virus, but also – as we have seen – the risk that the virus would be misused to cause severe damages on civic facilities. However, I think that the self destructive code in the virus is a good argument for the theory that a Western country is involved, even though it has to be said that – in theory – it could as well be a precausive way to try to prevent the virus from getting out of control (even if it is impossible). I would also expect both Israel and the United States to be involved in some way or another.
The future cyber war
Whatever may be the origin of the Stuxnet, the fact is that the virus so far only managed to reduce the capacity for enrichment of uranium with 30% in one of the central Iranian production facilities during the last year, and apparently the overall capacity of the centrifuges in Iran has increased with about 60% in 2010, compared with year before. So if the goal was to obstruct the Iranian enrichment of uranium, the mission failed. If the mission was to slow it down, and experiment with a sophisticated way of controlling and manipulating with industrial processes for political purposes, the mission was a success.
However, I think the case is interesting, not only because of its technical uniqueness, which involves malware of – until now – unknown complexity, but also because it indicates how the battle field in cyber space between nation states will look like in the future. In fact, the cyber war already started long ago, and the only reason we do not receive more news about it in the public is due to its invisibility in our everyday life, the strong influence of the intelligence agencies, and the fact that the cyber weapons reach far beyond the well known frames of conventional war.
It is well known that China, for example, has perpetrated huge cyber attacks on the American military data systems as well as on NATO and EU for a long time. It is perhaps less known that American security experts are intensely trying to defend themselves against the apparently overwhelmingly capable Chinese cyber army, using – among other techniques – vulnerable programs that invite the aggressive Chinese internet soldiers into a kind of cyber ambush, following their path back to their own terrain. A fight that is increasingly difficult for Western nation states like USA and England as they use a proportionally much bigger part of their cyber resources trying to prevent terrorist attacks from Arab terrorists, while China – being less exposed to that kind of threat – has been able to put its enormous technological and economic powers into programs that launch a ceaseless chain of world class cyber attacks on Western institutions. In this respect, China also takes advantage of the former Chinese leader, Deng Xiaoping´s, development plan, launched in 1986, which aimed at giving China a technological boost and a future front position on the international cyber scene.
But the case is also interesting because we are now confronted with civic considerations in a way that we are not used to. Much similiar to the dilemma we are exposed to when it comes to conventional war, questioning the damage on civic institutions in order to defend values that are defined by the very same institutions, we now have to consider whether we can accept the civic consequences of a possible misuse of a complex and highly sophisticated virus like Stuxnet that is most likely developed to reduce a geopolitical threat.
Which leads us to the preliminary question in this post: Can a virus be good?
Personally, I believe it can, or better put: I think that a computer virus can be in the service of the good, just as any other humanly created weapon. But the Stuxnet virus confronts us with a problem that is as old as the axe or the knife and that has only grown bigger and more complex with the development of modern technologies, such as the nuclear facilities and the internet.
