page_title: Stuxnet
section_title: PLC infection
hierarchical_section_title: Stuxnet / Operation / PLC infection
caption_attribution_description: Siemens Simatic S7-300
context_page_description: Stuxnet is a malicious computer worm, first uncovered in 2010, thought to have been in development since at least 2005. Stuxnet targets supervisory control and data acquisition systems and is believed to be responsible for causing substantial damage to the nuclear program of Iran. Although neither country has openly admitted responsibility, the worm is widely understood to be a cyberweapon built jointly by the United States and Israel.
  Stuxnet specifically targets programmable logic controllers, which allow the automation of electromechanical processes such as those used to control machinery and industrial processes including gas centrifuges for separating nuclear material. Exploiting four zero-day flaws, Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software. Stuxnet reportedly compromised Iranian PLCs, collecting information on industrial systems and causing the fast-spinning centrifuges to tear themselves apart.
context_section_description: The entirety of the Stuxnet code has not yet been disclosed, but its payload targets only those SCADA configurations that meet criteria that it is programmed to identify.
  Stuxnet requires specific slave variable-frequency drives (frequency converter drives) to be attached to the targeted Siemens S7-300 system and its associated modules. It only attacks those PLC systems with variable-frequency drives from two specific vendors: Vacon based in Finland and Fararo Paya based in Iran. Furthermore, it monitors the frequency of the attached motors, and only attacks systems that spin between 807 Hz and 1,210 Hz. This is a much higher frequency than motors operate in most industrial applications, with the notable exception of  gas centrifuges. Stuxnet installs malware into memory block DB890 of the PLC that monitors the Profibus messaging bus of the system. When certain criteria are met, it periodically modifies the frequency to 1,410 Hz and then to 2 Hz and then to 1,064 Hz, and thus affects the operation of the connected motors by changing their rotational speed. It also installs a rootkit – the first such documented case on this platform – that hides the malware on the system and masks the changes in rotational speed from monitoring systems.
caption: Siemens Simatic S7-300 PLC CPU with three I/O modules attached
exif: {"Image Make": "NIKON CORPORATION", "Image Model": "NIKON D70s", "Image Software": "Ver.1.00", "Image DateTime": "2007:02:01 12:47:16", "Image YCbCrPositioning": "Co-sited", "Image ExifOffset": "146", "EXIF ExposureTime": "1/60", "EXIF FNumber": "28/5", "EXIF ExposureProgram": "Unidentified", "EXIF ExifVersion": "0221", "EXIF DateTimeOriginal": "2007:02:01 12:47:16", "EXIF DateTimeDigitized": "2007:02:01 12:47:16", "EXIF ComponentsConfiguration": "YCbCr", "EXIF CompressedBitsPerPixel": "2", "EXIF ExposureBiasValue": "0", "EXIF MaxApertureValue": "49/10", "EXIF MeteringMode": "Pattern", "EXIF LightSource": "Unknown", "EXIF Flash": "Flash fired, auto mode, return light detected", "EXIF FocalLength": "105", "EXIF SubSecTime": "80", "EXIF SubSecTimeOriginal": "80", "EXIF SubSecTimeDigitized": "80", "EXIF FlashPixVersion": "0100", "EXIF ColorSpace": "sRGB", "EXIF ExifImageWidth": "3008", "EXIF ExifImageLength": "2000", "EXIF SensingMethod": "One-chip color area", "EXIF FileSource": "Digital Camera", "EXIF SceneType": "Directly Photographed", "EXIF CVAPattern": "[0, 2, 0, 2, 2, 1, 1, 0]", "EXIF CustomRendered": "Normal", "EXIF ExposureMode": "Auto Exposure", "EXIF WhiteBalance": "Auto", "EXIF DigitalZoomRatio": "1", "EXIF FocalLengthIn35mmFilm": "157", "EXIF SceneCaptureType": "Standard", "EXIF GainControl": "Low gain up", "EXIF Contrast": "Normal", "EXIF Saturation": "Normal", "EXIF Sharpness": "Normal", "EXIF SubjectDistanceRange": "0"}