Computer worm ‘designed to blow up nuclear power stations’

[bananas]

http://www.thisislondon.co.uk/standard/article-23881749-computer-worm-designed-to-blow-up-nuclear-power-stations.do

Computer worm ‘designed to blow up nuclear power stations’
Mark Prigg, Science and Technology Editor Mark Prigg, Science and Technology Editor
24.09.10

A computer worm designed to blow up nuclear power stations has been uncovered by IT security experts.

<snip>

“Stuxnet is a 100 per cent directed cyber attack aimed at destroying an industrial process in the physical world,” said Ralph Langner, an industrial computer expert.

“Until a few days ago, people did not believe a directed attack like this was possible.”

Unlike most viruses, the worm targets systems that are traditionally not connected to the internet for security reasons.

Instead it infects Windows machines via USB keys, which are commonly used to move files around in secure systems.

<snip>

“After the original code is executed, we can expect that something will blow up soon,” Mr Langner wrote in his analysis. “Something big.”

Experts have speculated that the worm is likely to have been created by a foreign government to target the Bushehr nuclear plant.

<snip>

Additional info in LBN yesterday: "Stuxnet worm 'targeted high-value Iranian assets'" http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=102x4550344

[leveymg]

1. You'd have to have physical access to the hardware. Also, wouldn't be difficult to do a clean and

reinstall of the OS software to clear out any potential bugs.

[bananas]

4. It reprograms the PLCs.

You'd have to do a lot more than reinstall the OS software.
edit to add: see the LBN thread: http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=102x4550344

[leveymg]

5. Change out the PLC logic cards - same thing as "clean and reinstall".

The most credible, informative post, reply #12, on that string tells us:

I've worked with PLC's for years, I'm what you might call an expert. Maybe, just maybe a worm could be written to infect a PLC as claimed. But even after that, you'd have to know the I/O address of each piece of equpment controlled by the PLC to actually do anything. Someone would either need access to the PLC program itself, or at least electrical drawings showing the I/O addresses to really do much.

Having said all that, it is possible a worm could just go in and crash the PLC, in which case the processor card would be removed and a new processor put in it's place (which was sitting on the shelf and likely not infected).

I just really can't see this worm being much of a threat without some serious insider information.

PLCs are generally not that complex and difficult to check for changes to circuitry and programming. I don't think this is as big a problem as some would want us to think. More psyops.

[Ian David]

2. Stuxnet is a terrible name. They should have named it Pepsi Syndrome. n/t

[kenny blankenship]

3. What kind of fucking moron would use Windows to manage a nuke plant?

I thought they had to run on a real-time OS, anyway.

[Kablooie]

6. Our government, that's who.

But I seriously doubt they have the level of hackers working for them that could accomplish something like this anyway.

[Throckmorton]

12. We don't

Most US plants don't even have processor based plant protective systems, but rely on older discrete digital logic or analog based systems (SSPS, RPS, ESFAS, ATWS, LSELS, AAFW ...).

All of the processor based systems that my Plants use are in secondary systems and are UNIX based, or they in "simple" stand alone applications using machine code.

These stand alone applications are mostly digital recorders and single point digital controllers, that are not networked, but linked together using analog loops.

[DrGregory]

14. EXACTLY!!!

Most US plants don't even have processor based plant protective systems, but rely on older discrete digital logic or analog based systems (SSPS, RPS, ESFAS, ATWS, LSELS, AAFW ...).
=============================================================

Exactly as I stated in another post. The logic is
"old fashioned" but "bullet proof" discrete digital
or analog logic.

Most of the logic is the same logic that conventional
plants have used to control the Rankine steam cycle
for decades. The safety systems of the reactor are
all discrete digital or analog.

PWR reactors are designed to inherently adjust their
power output to the demands of the Rankine steam cycle.
The saying for a PWR is "the reactor follows the turbine".

When the load on the plant is increased, the increased
current flow in the generator increases the backward
torque due to the Lorentz forces. This would tend to
make the turbine-generator set slow down if nothing were
done. However, all generators in the grid have to turn
in synchrony, so a simple feedback circuit opens the
turbine throttle valve when the generator begins to slow.

The increased demand for steam by the now wider open
throttle means more energy is extracted by the secondary
coolant loop from the primary coolant loop in the
steam generator / heat exchanger. Therefore, the primary
coolant going back to the reactor is a little cooler than
it was at equilibrium conditions.

This slightly cooler coolant feeds back via the reactor's
moderator temperature feedback coefficient. That is a
cooler, denser coolant, aka moderator; increases moderation
of neutrons, and hence increases reactivity of the reactor.

The reactor will naturally increase in power until the new
power level matches the new demand level. No electronic or
computer controlled actions are necessary. The physics
of the reactor itself takes care of the reactor control
function.

The only control needed in this case is the generator
speed feedback control of the turbine throttle. However,
power plants have had that control mechanism a LONG LONG
time before there were nuclear power plants, or microchips
for that matter.

Dr. Greg

[zeaper]

7. The only device the virus affects is a “Siemens” Brand PLC

And typically PLCs are only used to operate non-critical auxiliary equipment.

This virus appears to be nothing more than a great fear monger.

[DrGregory]

10. That's correct

And typically PLCs are only used to operate non-critical auxiliary equipment.
----------------------------------------------

That's correct. Under NRC regulations, all logic used in
the actual operation of the reactor has to be non-programmable
hardwired logic.

The NRC doesn't allow anything reprogrammable to control the
reactor.

Dr. Greg

[joshcryer]

11. Nice to know, got a source for that?

Re: no reprogrammable devices control reactor.

[pscot]

8. Does the "foreign government"

have enough information on Bushehr to pull this off? And who could it be?

[One_Life_To_Give]

9. Nuke would have redundant hot standby system

Such as a 2oo3 voting system, with redundant I/O. Alarms should be going off when even one CPU starts giving different results/signals from the other two. The thought some years ago was that to make it work properly the PLC's also needed to be "diverse" such as One Siemens, One Rockwell and one Schneider Electric, As they all use their own proprietary RTOS. And as pointed out up thread. One would have to have some idea of what the non-Safe state of the I/O would need to be commanded to. As PLC's I/O firmware (stored in Flash or Prom) will automatically revert the I/O to Safe State should the PLC just stop talking to it by name/address.

Plenty of systems not linked to Nukes are single with no redundancy. Such as manufacturing plants, conveyor lines, warehouse distribution systems etc. If the payload is that bad I would of expected stories in industry about all of these systems malfunctioning already.

[Kolesar]

13. Plants have redundant PLCs that will switch processors if one fails

But the processors are not voting with each other, as far as I know.

You are correct about the "safe state".

There are also PLCs for safety applications that have circuits to test the actual state of the outputs. They have other features to ensure that the outputs are in the state they should be in.

[One_Life_To_Give]

15. SIL 2 and 3 Systems require voting

Take a look at the "Safety PLC's" that are 61508/61511 compliant at SIL 2 and 3. They all go beyond Hot Standby to actual multiple processors with a voting architecture.

[Kolesar]

16. thanks...eom