Speaker 1: Imagine a weapon, right, but one so quiet, so sneaky.
Speaker 1: It worked for months, maybe even years, before anyone really
Speaker 1: got what it was. A weapon that could just take
Speaker 1: apart critical systems without a single bullet being fired. It
Speaker 1: sort of opened up a whole new kind of conflict.
Speaker 1: Today we're diving into the story of the world's first
Speaker 1: really destructive digital weapon. Okay, let's unpack this.
Speaker 2: Yeah, and what's fascinating here is this isn't just about code, yeah,
Speaker 2: or like clever hackers in dark rooms. This story is
Speaker 2: really about geopolitics. The weakness is built into our industrial systems,
Speaker 2: and how the digital world can suddenly smash into the
Speaker 2: physical one affecting you. So our mission today is to
Speaker 2: get our heads around Stuck's Net, not just as this
Speaker 2: piece of amazing tech, but as a moment that really
Speaker 2: opened a kind of digital Pandora's box. We'll be looking
Speaker 2: at some deep investigations, stuff on cyber attacks, industrial security,
Speaker 2: national defense, the whole picture.
Speaker 1: Okay, so where did this all begin? I mean, who
Speaker 1: first noticed something was wrong? What did they even see?
Speaker 2: Well, a story really gets going into one. There was
Speaker 2: this pretty small security firm in Belarus, virus BLOCKAA and
Speaker 2: these researchers there, Sergey U. Lawson and Ola Kaprieve, they
Speaker 2: stumbled onto something well, really weird. They found malware spreading
Speaker 2: through USB drives. Now that happens, right, But how it
Speaker 2: was spreading it was totally new. See, usually malware used
Speaker 2: this auto un feature which you could disable. But this thing,
Speaker 2: he used a really clever trick with Windows l NK
Speaker 2: files shortcut files, much harder to stop, a new way in.
Speaker 1: So what was so scary about this lank thing?
Speaker 2: Ye, exactly, a new way in, you Leysen. He immediately
Speaker 2: thought this could be a zero day, you know, a
Speaker 2: vulnerability that the software maker Microsoft in this case doesn't
Speaker 2: even know exists. And he got really worried when he
Speaker 2: tested it. He tried it on a Windows seven machine,
Speaker 2: the latest version, totally up to date with patches, and
Speaker 2: the malicious files just appeared seamlessly. Nothing blocked it. And
Speaker 2: here's where it gets really interesting. The malicious drivers, the
Speaker 2: bad code. It was signed with a real digital certificate
Speaker 2: from real Tech Semiconductor, a legitimate hardware company that was
Speaker 2: just yeah, unheard of. It basically told Windows, hey, this
Speaker 2: code's legit. Let it run. It bypassed security warnings. How
Speaker 2: they got that key, stole it core someone big questions.
Speaker 2: This whole thing showed something chilling. Even if your system
Speaker 2: is fully patched, totally up to date, you could still
Speaker 2: be hit by these unknown flaws. A total shift in
Speaker 2: how we had to think about security, these tactics, the stealth,
Speaker 2: It was all designed so that you, or any normal
Speaker 2: use or any system adamant even would have almost no
Speaker 2: way of knowing your system was compromised.
Speaker 1: Wow, so the whole world was sort of exposed without
Speaker 1: knowing it. And then I guess bigger companies started looking
Speaker 1: into it, like Semantech.
Speaker 2: Right, Yeah. Soon after researchers like Lamo Merchu and Nicholas
Speaker 2: Fallier at Semantec really started digging deep into the code.
Speaker 2: Amrchu apparently was always taking things apart as a kid,
Speaker 2: and Fallier was a master at reverse engineering, turning that
Speaker 2: Messa computer code back into something a human could understand,
Speaker 2: skills he apparently picked up working on like puzzle files
Speaker 2: called crackmes.
Speaker 1: Okay, so these experts start digging and it became clear
Speaker 1: pretty fast this wasn't your typical virus, right. It wasn't
Speaker 1: trying to steal credit cards or anything.
Speaker 2: No, definitely not. Its target was much much more critical.
Speaker 2: It was going after industrial control systems. We're talking about
Speaker 2: plc's programmable logic controllers. Think of them as the automated
Speaker 2: brains and factories, power plants, water treatment facilities, all that
Speaker 2: critical infrastructure. They tell the machines what to do. Now,
Speaker 2: these things were mostly designed back in the sixties and seventies,
Speaker 2: built for reliability in like physically isolated environments. Security against
Speaker 2: hackers not really on the radar back then, so stick
Speaker 2: them on a network they become well, pretty soft targets.
Speaker 2: It exposed this dangerous legacy systems built for one world
Speaker 2: suddenly living in a very different, connected one, and with
Speaker 2: that level.
Speaker 1: Of sophistication going after PLCs, it must have had a
Speaker 1: very specific, very high value target in mind.
Speaker 2: Absolutely the ultimate target the Nintends uranium Enrichment facility in Iran.
Speaker 2: And interestingly, even before Stuck Snip became public knowledge, inspectors
Speaker 2: from the International Atomic Energy Agency the IAEA had seen
Speaker 2: weird things. Centrifuges weren't working right. They were running at
Speaker 2: lower capacities like forty five to sixty six percent, even
Speaker 2: when they weren't being fed as much Uranian gas. It
Speaker 2: just didn't add up. Nobody could figure out why. And remember,
Speaker 2: Neitan's itself had been under the microscope since about two
Speaker 2: thousand and two when satellite photos first really identified it.
Speaker 1: Right, a very sensitive sight. So how did stucksne actually
Speaker 1: do it? How did it mess with these centrifuges in
Speaker 1: such a secure place?
Speaker 2: What was the attack like, Okay, here's where it gets
Speaker 2: really interesting. The attack on the Siemens PLCs at Natan's.
Speaker 2: It was incredibly clever, multi stage. First, it pulled off
Speaker 2: what's called a man in the middle trick. For about
Speaker 2: thirteen days, stucksnet would just sit there and secretly record
Speaker 2: what normal operations looked like, the data coming from the centrifuges.
Speaker 2: Then when it decided to actually attack to sabotage, it
Speaker 2: would play back that recorded normal data to the control
Speaker 2: room operators. So the operators are looking at their screens thinking, yep,
Speaker 2: everything's running fine. Well, behind this scenes, stucksnet is actually
Speaker 2: damaging the centrifuges. Someone described it as the digital equivalent
Speaker 2: of a six ton circus elephant performing a one legged handstand.
Speaker 2: Just complete hidden deception, and it wasn't like one big
Speaker 2: explosion It was subtle. It would sabotage things for maybe
Speaker 2: fifteen minutes, then wait, then sabotage for fifteen minutes, then
Speaker 2: lie low for like twenty six days just watching. This
Speaker 2: went on for weeks months, designed to cause damage slowly
Speaker 2: avoid setting off alarms.
Speaker 1: That is incredibly patient and sneaky. How did this digital
Speaker 1: trickery actually break the machines? What was the physical damage?
Speaker 2: The physical impact was severe. Stucksnet specifically targeted the frequency converters.
Speaker 2: These are devices that control the speed of motors, like
Speaker 2: the one spinning the centrifuges. It targeted models made by Vacan,
Speaker 2: a finished company, and also Furropaya, which was thought to
Speaker 2: be an Iranian company, possibly making copies. Stucks Net would
Speaker 2: mess with the speeds, make the centrifuges spin too fast,
Speaker 2: then too slow, creating vibrations. These vibrations would literally destroy
Speaker 2: the rotors. Iran's own Atomic Energy organization later talked about
Speaker 2: centrifuge rotors turning into powder. That's what stucksnet was doing.
Speaker 2: And think about this. To pull that off, you don't
Speaker 2: just need amazing coders, the sources say, you needed like
Speaker 2: a team of material scientists and centrifuge experts, people who
Speaker 2: knew exactly how changing the speed would physically wreck those
Speaker 2: specific machines. That's the key thing here, digital code causing direct,
Speaker 2: calculated physical destruction, a totally new kind of warfare.
Speaker 1: Wow, so stucksnet wasn't just about Natan's. Then it kind
Speaker 1: of blew the lid off. How vulnerable these industrial systems
Speaker 1: are everywhere?
Speaker 2: Right? Oh? Absolutely? It showed these weren't just isolated problems
Speaker 2: at one facility. These were systemic flaws. Experts like Joe Weiss,
Speaker 2: they'd been warning about this for years, especially after the
Speaker 2: whole y two K thing. He pointed out that these
Speaker 2: control systems often didn't even have basic stuff like firewalls
Speaker 2: or ways to log network activity. They were built assuming
Speaker 2: they'd never be connected or attacked. And guys like Dylan
Speaker 2: BEBARSSD in twenty ten, he was just this twenty five
Speaker 2: year old researcher. He literally went online, bought some Siemens PLCs,
Speaker 2: the same kind used in Natanse, and working from his apartment,
Speaker 2: in just a few weeks, he found tons of security holes,
Speaker 2: like communications weren't encrypted. The PLCs would happily talk to
Speaker 2: any machine that knew their language. And get this Some
Speaker 2: had hard coded passwords like basisk built right in that
Speaker 2: could be changed. It was like leaving the front door
Speaker 2: wide open with a key tape to it.
Speaker 1: That's unbelievable. Hard coded passwords you can't change.
Speaker 2: Yeah, it just showed they weren't designed with network security
Speaker 2: in mind at all. It really highlights how vulnerable these
Speaker 2: systems were. And we'd seen hints of this before, like
Speaker 2: that incident in maruci Shire or Australia back in two thousand,
Speaker 2: an ex employee got mad. You stolen software and a
Speaker 2: radio link to hack into the sewage treatment system and
Speaker 2: deliberately caused massive spares. Hundreds of thousands of gallons of
Speaker 2: raw sewage flooded into parks and rivers, a real world
Speaker 2: impact from a digital intrusion.
Speaker 1: Grim reminder. We always here about critical systems being air gapped,
Speaker 1: you know, disconnected from the Internet for safety. Does stucksnet
Speaker 1: basically killed that idea.
Speaker 2: It certainly punched a huge hole in it.
Speaker 1: Yeah.
Speaker 2: Yeah, many of these control systems had similar design flaws.
Speaker 2: This legacy from before the Internet was everywhere. The whole
Speaker 2: air gap idea that these systems were safe because they
Speaker 2: were isolated, well, it turned out to be largely a myth.
Speaker 2: In twenty twelve, one researcher in the UK used this
Speaker 2: search engine called showdan, which specifically looks for Internet connected devices,
Speaker 2: and he found over ten thousand industrial control systems online,
Speaker 2: water plants, power grids, dams, train systems just sitting there
Speaker 2: connected to the Internet. Then there was that actor proof
Speaker 2: and twenty eleven he got into the controls of a
Speaker 2: water plant in South Houston. HOWATAI password? That was literally
Speaker 2: just three characters long. Kasprusio himself said, most HAXI saw
Speaker 2: weren't because of amazing skill, but just gross stupidity in
Speaker 2: security practices.
Speaker 1: Wow.
Speaker 2: Three Yeah. And maybe the most dramatic demonstration was the
Speaker 2: Aurora generator test. This is back in two thousand and seven.
Speaker 2: The Idaho National Lab researchers wanted to prove a point.
Speaker 2: They digitally hacked into a huge diesel generator, a Wartzelen model,
Speaker 2: and they manipulated its protective relays, the safety systems designed
Speaker 2: to stop damage from happening. They basically tricked the relays
Speaker 2: into rapidly opening and closing breakers out of sinc The
Speaker 2: physical forces were so violent the generator literally tore itself apart.
Speaker 2: Smoke flying debris. It was physically destroyed by a digital
Speaker 2: command and the thing that was supposed to prevent an
Speaker 2: attack like this was the very thing they used to
Speaker 2: conduct the attack.
Speaker 1: That's deeply unsettling.
Speaker 2: It is. And here's something crucial for you to consider.
Speaker 2: In the US, something like eighty five percent of critical
Speaker 2: infrastructure is owned and operated privately. That makes it incredibly
Speaker 2: hard to enforce consistent high level security across the board.
Speaker 2: Back in twenty thirteen, General Keith Alexander, who was head
Speaker 2: of the NSA then was asked how prepared the nation
Speaker 2: was for cyber attacks. He bluntly set at three on
Speaker 2: a scale of one to ten.
Speaker 1: A three out of ten.
Speaker 2: That's not comforting.
Speaker 1: So stecksnet wasn't just about finding holes. It really unleashed
Speaker 1: something new, didn't It changed the whole game of geopolitics
Speaker 1: and warfare. What was the thinking before stucksnet hit.
Speaker 2: The scene, Well, people were thinking about it way back
Speaker 2: in nineteen ninety three. Analysts at Ran Corporation actually coined
Speaker 2: the term cyber war. They predicted it could be the
Speaker 2: Blitzkrieg of the twenty first century. And there were early
Speaker 2: hacks that raised eyebrows like Marcus Hess in the eighties,
Speaker 2: apparently spying for the KGB through computer networks, where those
Speaker 2: Dutch teenagers who broke into US military systems right before
Speaker 2: the First Gulf War. Then the US military ran its
Speaker 2: own exercises in the late nineties like Eligible Receiver and
Speaker 2: Solar Sunrise, and the results were pretty shocking. They found
Speaker 2: their own networks were wide open to attack, and maybe
Speaker 2: even more worrying, they realized that basically no one was
Speaker 2: in charge of defending military networks effectively. So, yeah, the
Speaker 2: potential was recognized, but the actual defenses and strategy they
Speaker 2: were lagging way behind.
Speaker 1: Chilling to look back on those warnings. Now, Okay, so
Speaker 1: after those wake up calls, the US set up things
Speaker 1: like the Joint Task Force for Computer and Network Defense.
Speaker 1: But developing these kinds of weapons like STUCKSNT there's a
Speaker 1: hidden danger, isn't there a paradox.
Speaker 2: Huge paradox. Yeah. Andy Pennington used to be an Air
Speaker 2: Force weapons officer. He planted really well, he warned, the
Speaker 2: cyber weapon it doesn't die, it's just code. Somebody can
Speaker 2: pick it up and fire it right back at you. Ye,
Speaker 2: unlike a bomb that explodes once code can be copied analyzed, repurposed,
Speaker 2: and we saw that happen frighteningly with stucksnt itself. There
Speaker 2: was a version in twenty ten that somehow lost its
Speaker 2: precision targeting. It just started spreading like crazy, uncontrollably, infecting
Speaker 2: thousands and thousands of computers that weren't its intended target
Speaker 2: in Iran. It showed just how easily even a supposedly
Speaker 2: surgical weapon could escape control. And this also fueled the
Speaker 2: rise of this sort of gray market for exploits. Companies
Speaker 2: like VUP and Security in France were openly finding zero
Speaker 2: day flaws and then selling them to governments, sometimes for
Speaker 2: like one hundred thousand dollars a popp or more. The
Speaker 2: big takeaway once you let these digital weapons out, they're
Speaker 2: incredibly to control. They spread, they proliferate, and the consequence
Speaker 2: has become totally unpredictable.
Speaker 1: Right, So, looking back, President Obama gave this big speech
Speaker 1: about cybersecurity in two thousand and nine, really sounding the
Speaker 1: alarm right before stucksnet was deployed. The irony is pretty stark.
Speaker 1: Michael Hayden, the former CIA and NSA director, he famously
Speaker 1: said Stucksnet meant somebody had crossed the Rubicon, there was
Speaker 1: no going back. So what are the global consequences? Now?
Speaker 1: This new frontier is open. But how do you even
Speaker 1: fight a war when you might not know who fired
Speaker 1: the first shot.
Speaker 2: Well, if we connect this to the bigger picture, that
Speaker 2: Rubicon analogy is spot on. The immediate consequence was a
Speaker 2: kind of global cyber arms race. Suddenly everyone realized this
Speaker 2: was real. Nations like China, Russia, the UK, Israel, France, Germany,
Speaker 2: North Korea, even Iron itself. They all started pouring resources
Speaker 2: into developing their own cyber warfare capabilities, offensive and defensive.
Speaker 2: But maybe the trickiest part is what you just said, attribution,
Speaker 2: knowing who actually launched an attack. There was this simulation
Speaker 2: run at Televi University in twenty thirteen. It showed just
Speaker 2: how easily a cyber incident could spiral out of control
Speaker 2: in the real world conflict, especially the leaders aren't sure
Speaker 2: who's attacking them. Imagine Country AID attacks Country B but
Speaker 2: makes it look like country SE did it. These would
Speaker 2: get kinetic fast based on bad information. Stucks Net technically
Speaker 2: is still the only known case of cyber warfare on
Speaker 2: record where code was used by one nation to cause
Speaker 2: physical damage in another during peacetime, but that digital Pandora's box,
Speaker 2: it's wide open. Now. We live in a world where
Speaker 2: civilian infrastructure of power grids, water systems, hospitals is potentially
Speaker 2: on the front line, and maybe, just maybe defense is
Speaker 2: the only viable offense anymore.
Speaker 1: It's been quite a journey, hasn't it, From that small
Speaker 1: firm in Belarus finding something odd all the way to
Speaker 1: this global shift in security and warfare. Stucks Net really
Speaker 1: left us with two big things. It's sheer technical brilliance
Speaker 1: as a weapon, yes, but also how it ripped the
Speaker 1: veil off these deep, deep vulnerabilities in the systems we
Speaker 1: all rely on every single day.
Speaker 2: Absolutely, and this raises an important question for you, as
Speaker 2: we're now in this world where digital attacks can cause
Speaker 2: real physical harm, but figuring out who did it is
Speaker 2: incredibly difficult. So how do you think nations can even
Speaker 2: begin to set rules for this, clear rules of engagement
Speaker 2: for cyber conflict, And maybe closer to home, what responsibility
Speaker 2: do we all have to push for better security in
Speaker 2: this super connected world we've built?
Speaker 1: Definitely a lot. Tom all over there, thank you for
Speaker 1: joining us on this deep dive. We really hope you'll
Speaker 1: keep exploring this stuff. Until next time, stay curious,