All language subtitles for cyberwar.s01e06.720p.hdtv.x264-w4f_Track02

BEN: A secret facility
in Iran renews fears

of a nuclear threat.

The nations of the world must
not permit the Iranian regime

to gain nuclear weapons.

A computer virus that has
never been seen before.

This isn't two kids
in a basement in Kansas

throwing some code together.

The virus sabotages
that secret facility.

It used very advanced
capabilities to cover itself

or obfuscate itself.

Who built it and
why is a mystery.

This was an act of war.

It was an act of war
without there being a war.

Stuxnet is the world's
first known cyberweapon.

♪

There are conflicts
being waged all around us,

ones we can't see.

Hackers are poised to
dominate the 21st century,

reshaping
geopolitical landscapes.

Sometimes on behalf of
terrorists, but often

for governments, or just
because they think it's right.

As a reporter, I've been
covering national security for

VICE, and increasingly my job is
to track these digital battles.

There's one computer virus
that really showed how far

everything had come.

In the early 2000s, the US
began to fear that Iran,

its sworn enemy since 1979,
was secretly developing

its own nuclear weapons.

The UN responded with sanctions.

The US and Israel
threatened war.

And then a mysterious
computer virus dubbed Stuxnet

appeared in June 2010.

We're headed to Symantec -
yes, the same company that's

protecting your desktop from
malware - to talk to an engineer

and expert who forensically took
apart Stuxnet and figured out

that it wasn't just some
run-of-the-mill Trojan virus.

I got in touch with Symantec
security researcher Eric Chien.

He did some of the most in-depth
analysis of the virus

when it first appeared.

The average threat that we look
at can take us 5 to 20 minutes

to look at, and we know
exactly what it does.

And Stuxnet took us months,
more than 3 months to look at.

So just-- can give you
a sense of how difficult,

how large and how
complicated the threat was.

So why don't you tell me
how you discovered Stuxnet.

So basically what happened was
another security company

that was based in Belarus
found this binary,

and it had something in it
that was called a zero-day.

Why don't you tell me
what a zero-day is.

A zero-day basically is
when you have what's called

a vulnerability, or you have a
hole sort of in your computer,

a bug of some sort
that allows someone to

execute code on your machine
without you knowing it.

Your computer just has to
be on and maybe even connected

to the internet, and that's it.

You don't have to be logged in,
you don't have to be browsing

the web, you don't have to
double click on any files,

and so that means you have
no way to protect yourself.

What about it had
you never seen before?

An average threat doesn't have

any sort of exploit
inside of it.

This thing had four
zero-days inside of it.

What sets a zero-day apart

is that it's a security flaw
that there's no fix for.

Zero-days are incredibly
rare, and for that reason,

incredibly valuable.

What was the specifics of it
that set off an alarm?

ERIC: There was these
SCADA strings inside.

SCADA basically is technology
that's controlling robots

and automation, or power
plants and things like that.

And we had never seen a threat

that mentioned anything
to do with SCADA.

This thing could actually be
attacking some sort of

national critical
infrastructure.

This isn't like two kids
in a basement in Kansas

throwing some code together.

This thing had a
full-on framework,

clearly had quality
assurance behind it.

We're talking about
something that is just

orders of magnitude greater
than we've ever seen before.

As their investigation deepened,
Eric and his team realized

Stuxnet was designed
to target computers

using Siemens' proprietary
software called STEP 7.

What first caught our eye
were all these strings like S7,

and we began to sort of
google those sorts of strings.

We saw "WinCC" and
we saw "STEP 7".

And when we looked those up,
we determined that this

was actually software
that would control PLCs.

PLCs are Programmable Logic
Controllers, computer systems

used for converting digital
code into physical commands

that automate everything
from factory machinery

to heating and cooling systems.

Eric now found himself

in unknown territory,
so he reached out to

the international
security community.

We were sending out blogs all
throughout that summer

telling people if you are a PLC
expert, if you're an expert

in critical national
infrastructure, contact us.

Because we didn't even know
what a PLC was at that time.

Eric and his team learned that

PLCs are extremely
vulnerable to cyber attacks,

but he still didn't know which
machines were the targets.

This sophisticated malware, or
malicious code, was detected

on industrial control
systems around the world.

Cybersecurity analysts
were puzzled.

At the same time, Homeland
Security was also trying

to understand the virus.

Sean McGurk was the
director of NCCIC,

the cyber branch of the
Department of Homeland Security,

when Stuxnet was identified.

What did your team see
when they took it apart?

Well, the first thing we saw was
that it was very sophisticated

in its communications
capability.

So if you think of
Stuxnet like a kinetic device,

like a missile, you had
the delivery vehicle,

that which put the payload
on target if you will,

and then the payload itself.

And there were very unique
characteristics to both.

Stuxnet's ability to do digital
reconnaissance without control,

it was essentially
a digital, you know,

fire and forget
type of approach.

The fact that it used four
zero-day vulnerabilities

to gain access to the
network is something that

you had not seen in code before,
someone willing to risk

that many zero-days
in order to get it on place.

And then when we saw the payload
part, which was actually

specifically targeting an
industrial control environment,

that really for us became
a very significant event.

Because normal malware doesn't
go after control systems,

and this was specifically
focused on control systems.

ERIC: It was non-stop for weeks.

This was all we thought
about, all we worked on.

And you can imagine,
it was a really big shift

from what we had done before.

The average threat we would
finish in 5 to 20 minutes.

And here we were,
sitting on the same threat,

day after day, hour after
hour, night after night.

And, you know, we
weren't getting bored.

Every single day,
every single week,

we were discovering
new little clues,

new little breadcrumbs
that kept us going,

and kept us digging, and kept us
looking until basically November

when we finally figured out
that this thing was indeed

sabotage on Natanz.

In what was
basically an accident,

Eric and his team found
themselves embroiled

in a real life
international spy thriller.

Complex malicious code
had been written specifically

to take out Iran's
nuclear facilities,

while its authors
remained in the shadows.

BEN: In 2002, the world
discovered that Iran

had been building a secret
uranium enrichment facility

near the town of Natanz.

The Stuxnet computer virus

has a direct link to
this controversial plant.

The fact that Iran
never declared the plant

made it suspicious.

That was a breach of
Iran's obligations.

James Acton knows
nuclear policy inside out.

He also keeps tabs on
the work of the IAEA,

or the International
Atomic Energy Agency,

the world's nuclear watchdog.

Can you tell me
what the climate was

around the discovery of Natanz?

You know, Iran's a member of
the Non-Proliferation Treaty.

And one of the requirements of
that is that you're allowed to

do pretty much anything you'd
like in the nuclear field

short of building a bomb,
but you have to declare it.

And not declaring
nuclear facilities

is a violation of your
agreement with the IAEA.

They found activities
that looked very much like

what you want to do if
you build a nuclear weapon.

And why were they so
interested in Natanz?

Like why was it the straw
that broke the camel's back?

Natanz was a controversial
plant because... you know,

firstly, any enrichment
is inherently sensitive.

It's inherently dual use.

You can use it for
fuel production,

or you can use it for
nuclear weapons production.

The size of the
plant was suspicious.

The plant's actually too small
for a civilian plant.

Military plants don't need to
be as large as civilian plants.

So it was scaled as though
it was right for making

enriched uranium for weapons,
but wasn't the right size

for enriched uranium
for nuclear reactors.

The discovery of
the uranium program

did cause a lot of concern.

I mean, there were a lot of
countries who were genuinely

and are genuinely very fearful
that Iran would get the bomb,

and fearful of the
consequences of it doing so.

Iran aggressively pursues these
weapons and exports terror.

States like these and their
terrorist allies constitute

an axis of evil, arming to
threaten the peace of the world.

Iran denied that
Natanz was being used

to produce nuclear weapons.

Still, its government bowed to
pressure in 2003 and temporarily

suspended uranium enrichment and
processing activities at Natanz.

Then in 2005, newly elected
president Mahmoud Ahmadinejad

defiantly restarted the program.

Within months, the facility
at Natanz was up and running,

and enriching uranium
all over again.

Concerned, the UN
imposed sanctions.

By 2009, Israeli Prime Minister
Benjamin Netanyahu

challenged the US to stop
Iran's nuclear program.

The most urgent challenge facing
this body today is to prevent

the tyrants of Tehran from
acquiring nuclear weapons.

Netanyahu was privately
considering air strikes

on Natanz.

It's during this high-stakes
political stand-off

that Stuxnet is
detected in June 2010.

In fact, Stuxnet was found in
countries around the world,

but infection rates in
Iran were off the charts.

And at the plant at Natanz,
centrifuges were breaking down

at unprecedented rates.

Stuxnet's design is complex,

but its operation
is deceptively simple.

Like a security camera,
the virus records 30 days

of normal centrifuge operation
while it hides in the system.

Then, when Stuxnet
attacks the centrifuges,

it plays back the pre-recorded
data so operators on the outside

can't see the infection
raging within the centrifuges.

ERIC: And those 30 days
were not a coincidence.

That's how long it takes
basically for a cascade

of centrifuges to basically get
fully loaded with uranium gas.

So they wanted to basically have
their sabotage effects happen

right at the peak moment
and causing the most damage.

So the centrifuges at Natanz
normally will spin at 1,000 Hz,

and what the threat did
was spin up the centrifuges

to either 1,400 Hz,
to be really fast,

or slow them down to 2 Hz,
to be really slow.

And what would happen
is when they spin up

really, really fast, the
centrifuge will basically

vibrate uncontrollably
and just shatter.

And you would have literally
shards of aluminum flying

across the room, maybe a domino
effect of centrifuges falling

and toppling on each other, and
uranium gas leaking everywhere.

Eventually they would
hit the big red button

to cause shutdown.

Stuxnet was smart enough
to also hijack that.

That big red button went
through a computer as well.

And they hijacked that code,
and basically would ignore it

and allow their
payload to take effect.

Once it was inside,
it was unstoppable.

They were doomed, yeah.

The operators were doomed,
the plant was doomed.

Stuxnet was the first
digital weapon known

to have physically
destroyed its targets.

But the computer
systems at Natanz

weren't connected
to the internet.

So how did Stuxnet
get inside the system?

BEN: By 2010, it became evident
that someone had decided

that measures more
drastic than sanctions

- and less spectacular
than air strikes -

were needed to slow down
Iran's nuclear program.

Because out of nowhere, a
mysterious super virus named

Stuxnet was sabotaging an
Iranian nuclear facility.

But the computers in the
facility weren't online,

so the question remained how
the virus got inside the system.

I went to find Darknet J,
an operational security expert,

to understand how Stuxnet
could've infected them.

So how did Stuxnet jump
the air gap and infect Natanz?

It jumped the air gap by
traveling on a USB stick

that was placed into
the computer from someone.

Darknet J replicated
the USB exploit to show me

how Stuxnet infected
the computers at Natanz.

Alright, so what happens
is you put in the USB.

You open up the folder.

Windows looks for an icon,
which is a malicious payload

that can write to system.

I have it opening Calculator.

So once the intended target
opens the folder with Stuxnet

inside of it, what happens next?

Essentially it can have complete
control over your computer,

meaning that it can write
anything to the hard disk,

it can grab credentials
from the internet

if you put them in at the time.

It can also propagate itself

inside of your
local area network.

Wow.
(Laughing)

It's keys to the kingdom.

That meant someone physically
walked Stuxnet into the Iranian

facility, likely an unwitting
engineer with an infected USB.

Inside, the virus wreaked havoc.

Centrifuges were destroyed,
and the Iranians were clueless.

But then Eric Chien
and his team at Symantec

announced the details of Stuxnet
to the world in a blog post.

Then Natanz shut down.

Most assumed Iranian authorities
finally understood the mess

they were in, and were
trying to clean it up.

After that, two Iranian nuclear
scientists were targeted

by motorcycle-riding assailants,

who slipped a sticky bomb
onto one of their cars.

One was killed, the
other seriously injured.

It appeared whoever was
behind Stuxnet went to Plan B.

Soon after, the Iranian
President admitted a virus

caused the shutdown at Natanz.

He blamed Israel,
but couldn't back it up

with any hard evidence.

The assassination
sent a chill through

the cybersecurity community.

Did it make you a
little bit nervous?

We would look in our
rearview mirrors all the time.

And you know, I would
see a motorcycle

and watch them closely.

It definitely wasn't lost on us
that we were in the middle

of some big geopolitical affair.

Iran openly accused
Israel and the US of being

the masterminds of Stuxnet.

(Thundering)

I went to talk to someone who
was trying to stop the crisis

from escalating further.

BEN: Beautiful day.

(Chattering)

Jamal Abdi is a
foreign policy analyst

for the National Iranian
American Council,

and has advised congressional
members on relations with Iran.

People like myself who
were trying to broker

a diplomatic solution,
trying to figure out

an off-ramp from
these escalatory moves,

I really thought this is
an extremely bad turn.

What was the reception
of Stuxnet in Iran?

How did people feel about it?

I think the Iranians
very credibly believed

that Israel was behind this.

And then there was
also just the fact that

there were all these
other sabotage efforts

that they believed
Israel was connected to.

Israel was in many regards

the driving force against
Iran's nuclear program.

And then you have a hardline
government like Ahmadinejad

that's essentially
enflaming the issue.

It was: How do we slow that
down as much as possible?

Because we know
we can't stop it.

But it wasn't until
two years later

that The New York Times
published an explosive story,

revealing the US
was behind Stuxnet.

Unnamed officials told the paper

the US created the virus
with help from Israel.

It was part of a covert
operation dubbed Olympic Games.

The allegations set off
a political firestorm,

so a federal probe was launched
to investigate the leak.

But in 2015, the investigation
was put on ice over US fears

of what might come out in court.

For me, it always comes down
to the leak investigation.

You don't launch a
leak investigation

for a covert operation
you didn't do.

Kim Zetter has been covering
the Stuxnet story for Wired

since the virus was
first discovered.

The United States
likely did Stuxnet.

I don't think that
there's a question that

the US is behind it.

I mean, it's not even
something that I think that we,

you know, have to
sort of debate.

Stuxnet was a precision weapon,

so it would never
destroy anything except

what matched this very
specific configuration.

And you can see
lawyers' fingerprints

are all over Stuxnet.

I think that's the first time
I've heard someone say

that lawyers' fingerprints
were all over Stuxnet.

Yeah, you can see that as
they were designing this,

the lawyers would've had
very tight restrictions

for controlling this.

They would've
told the developers,

"This can only affect the
systems that are targeted.

You have to write
this in such a way."

It likely blocks out
two major nation states

that could've done it,
China and Russia.

I'm not sure they
were scared too much

about the legal implications!

Exactly, so this was
one of the reasons

that people were so
certain it was the US.

All of the available clues
suggested that Stuxnet was

a joint US/Israeli operation,
but government officials

have gone to great lengths
not to acknowledge it.

So the evidence is lacking?

I think that there is no
clear, complete evidence

or even complete indication

that it was one
country or another.

To this day, the US government
will not confirm or deny

its role in Stuxnet.

Stuxnet's architects might
want to stay in the shadows,

but around the world other
governments took notice

of the cyberweapon
they'd unleashed.

BEN: When security
researchers found Stuxnet

and publicized the discovery
of the destructive malware,

they inadvertently
brought a covert operation

to a premature end.

By the time we discovered
Stuxnet, it's believed that

it already had delivered
its payload at least once.

So I'm sure the attackers would
prefer that it wasn't uncovered,

because maybe they could've
continued or continued further

operations, but it at least
accomplished its goal.

At least according to the
IEA documents that showed that

a few thousand centrifuges were
destroyed just before 2010.

But what effect did it have
on its nuclear standoff

between Iran, Israel
and the West?

You know, looking back on this,

there's no question that
it slowed down the program.

Was it a successful
attack in that sense?

It kind of partially depends
what you mean by "success".

I think Stuxnet probably played
a role in convincing Israel

not to attack Iran and giving
diplomacy more of a chance.

Stuxnet may have just slowed
down Iran's nuclear weapons

program by 6 months to 2 years,
buying time for diplomacy,

but it didn't exactly stop
Iran from pursuing the bomb.

Do you think it was effective?

It was, you know, one step
forward, two steps back.

It delayed Iran's
program certainly, I think,

by several months, maybe a year,
but it also politically...

it convinced Iran that
they were under siege.

It made an argument, a case
for why Iran needed to have

capabilities to counter
cyberwarfare as well as

capabilities to
defend the country.

If Iran wants to
develop nuclear weapons,

they can develop
nuclear weapons.

This is not a
technical decision,

it's a political decision.

And Stuxnet was a technical
response that maybe on a

technical level slowed
the program down, but on a

political level actually helped
to accelerate the program.

So I think in that regard,
if you're looking at actually

preventing Iran from developing
nuclear weapons or convincing

them to not go down that
route, Stuxnet was a failure.

Finally, after years of
crippling UN sanctions,

Iran agreed to limit their
nuclear program in 2015

in exchange for a partial
lifting of sanctions.

But by deploying Stuxnet,
the US and Israel had triggered

a different kind of arms race.

This was an act of war,
and it was an act of war

without... without
there being a war.

If you drop a bomb on someone,

they know that they've
been attacked, right?

But in digital warfare,

you may never know that
you're under attack.

The US opened a door

that everyone is going
to walk through now.

In Iran, was Stuxnet
seen as an act of war?

In Iran it was, it was
seen as an act of war.

And there was sort of a
question that was opened up:

did the United States
just declare war on Iran?

It's such a grey area though.

So I think that even now people
are still kind of trying to

figure out whether this
constitutes war or not,

but technically...
technically it was.

And I think inside of Iran
it was really viewed that way.

And I think it really
opened a lot of eyes inside

the establishment of Iran
that they needed to get savvy

in this field to be able to
defend as well as attack.

And so you've got, you know,
the formation of the cyber army

inside of Iran that
was initially really...

really aimed at activists
inside the country.

But then after Stuxnet, it
became even more formalized,

all kinds of money was poured
into it because this was now

not just an internal threat
but an external threat.

BEN: It spurred Iran
to be more offensive?

It spurred everyone
to be more offensive.

That's the thing, it's not Iran.

There are other people to
be worried about than Iran.

All of that together has
created this arms race

of other countries.

Would you agree that it was
the dawn of a new chapter

in cyberwarfare?

The expected response is that
a lot of other countries now

are establishing
offensive cyber operations.

They don't wanna be left behind.

Stuxnet had launched the
race to militarize cyberspace.

And the more the
world is connected,

the more targets
there are for attack.

Countries around the world are
racing to design new malware

for the next
generation of warfare.

Do you think it's going
to become another tool

in the toolbox of war?

Absolutely.

Stuxnet to me was
a Trinity moment,

and by that I mean the
first Trinity explosion,

demonstration of a nuclear
detonation in New Mexico.

We demonstrated a capability
that you could have

devastating physical
impacts by cyber means.

It was a bit like the bomb.

Once the secret was
out, people started

getting it for themselves.

We started recognizing that
there's no putting this back.

You know, the key was
turned, the lid was opened,

and everything in Pandora's
Box was now out in the open,

and there was no way
to get it back in.

Stuxnet was the world's
first known cyberweapon.

It set the stage for
a new kind of war,

one that will play out
on a digital battlefield.