Stuxnet: the program does not want your files, it wants to deregulate a machine

When it was discovered in 2010, Stuxnet did not look like a common password thief. Its functions reveal a very precise industrial target. It can circulate on computers, but only triggers its most special part when it recognizes the desired control environment.

The Symantec file describes a program capable of modifying the logic of Siemens industrial controllers. These devices give instructions to physical equipment. In the case studied, the analyses bring the malicious sequences closer to the centrifuges used to enrich uranium in Natanz, Iran.

The attack is not limited to sending a bad order. It also seeks to conceal certain changes from operators. A reassuring screen can thus coexist with real behavior that no longer corresponds to the expected orders.

The dissemination of the program beyond its target allows its examination by specialists. The dismantling of its components reveals unusual capacities and activation conditions. Defense teams publish identification tools and recommendations for industrial environments.

Journalistic investigations, including that of the New York Times in 2012, attribute the operation to the United States and Israel. This attribution must not be presented as a conclusion of identity contained in the technical file alone. The precise number of damaged machines also remains difficult to isolate from other causes of failure.

Stuxnet’s historical interest lies in this crossed border: a hidden code can target not what a computer keeps, but what a machine does in the physical world.