A decade ago, the landscape of war changed forever.
On July 15, 2010, researchers discovered a massive malware worm installed in the industrial control systems of Iran’s nuclear development sites, where uranium was being enriched. The worm, more complex than any malware seen before, came to be known as Stuxnet.
But the prohibitive cost and manpower of developing dangerous targeted malware like Stuxnet means that many nation-states have started leaning on a new cyberweapon of choice: Social media.
A complex and dangerous tool
At the time, Stuxnet was revolutionary. It bridged the gap between the digital and physical worlds in a way that hadn’t been done up to that point, said Ryan Olson, vice president of threat intelligence at Palo Alto Networks. “This was a significant event,” he said.
Kim Zetter, a journalist and one of the foremost experts on the Stuxnet virus, said that it wasn’t just the virus’s complexity or sophistication that was impressive, it was what virus targeted and how. “It targeted systems that weren’t connected to the internet,” she told Digital Trends. “And it introduced to the security community, and the world, vulnerabilities that exist in critical infrastructure systems.”
“Stuxnet was a totally new paradigm in terms of what could now be accomplished,” said Axel Wirth, chief security strategist at MedCrypt, a cybersecurity company specializing in medical devices. “The methodology used to penetrate its target environment was much better planned than any other piece of malware used before.”
It’s thought that the virus found its way into Iran nuclear facilities via a thumb drive. From there, the virus was able to make a copy of itself and hide in an encrypted folder. It then lay dormant, Wirth told Digital Trends. The worm would activate when a specific configuration of systems only found in Iran was turned on. Ultimately, experts believed the virus caused significant damage to the Natanz nuclear enrichment site in Iran.
Strong evidence points to Stuxnet’s development being a joint effort between the U.S. and Israel, according to the Washington Post, although neither country has ever claimed responsibility.
Cyberweapons, however, always have an unintended side effect when they’re discovered.
“The difference between an offensive cyberweapon and, say, the Manhattan Project, is that a nuclear bomb doesn’t leave defensive schematics scattered all over the landscape,” said Chris Kennedy, former director of cyberdefense at both the Department of Defense and the U.S. Treasury. “Cyberweapons do.”
In other words, once Stuxnet was discovered, it was hard to contain. Experts and hackers could look at the code, dissect the worm, and take out parts of it to use for themselves. Many cyberweapons found since Stuxnet have had parts of the Stuxnet code in them, although these new tools aren’t nearly as sophisticated, Kennedy said.
“Billions of dollars went into creating Stuxnet and became publicly consumable information,” said Kennedy, who is currently the chief information security officer at cybersecurity firm AttackIQ. “That kind of screws with the value of the investment.”
A better return on investment
Social media manipulation can also be effective at destabilizing or attacking foes — and is much cheaper.
“Social media is a lower form of attack,” said Kennedy, “but it’s easier to do. You just get a bunch of not-as-smart people to pump false information into Facebook and the analytics take it away. Now, attacks like Stuxnet will be reserved for specialized goals because they’re so expensive and challenging to create.”
Kennedy said that whatever buzzword could be used to talk about the Russian influence in the 2016 elections, “that’s the new Stuxnet.”
“Rather than attacks on systems or on individual computers, these are attacks on societies and economies.”
“It’s easier, cheaper, and has a much more brand effect,” he said.
Wirth told Digital Trends that cyberattacks are now “broader” in scope.
“Rather than attacks on systems or on individual computers, these are attacks on societies and economies,” he said. “Traditional tools have been augmented by social media attacks and misinformation campaigns.”
“The future is combined,” said Kennedy, in terms of what cyber warfare could look like. “You use a social media campaign for propaganda and influence to shape local populations, then you use cyberweapons to affect specific targets. And if that doesn’t work, then we bring in the troops and start blowing stuff up.”
