Table Of ContentCopyright © 2014 by Kim Zetter All rights reserved.
Published in the United States by Crown Publishers, an imprint of the Crown Publishing Group, a
division of Random House LLC, a Penguin Random House Company, New York.
www.crownpublishing.com
CROWN and the Crown colophon are registered trademarks of Random House LLC.
Portions of this work were originally published in different form in “How Digital Detectives
Deciphered Stuxnet, the Most Menacing Malware in History” copyright © Wired.com. Used with
permission. First published July 2011.
Cataloging-in-Publication data is on file with the Library of Congress.
ISBN 978-0-7704-3617-9
eBook ISBN 978-0-77043618-6
PRINTED IN THE UNITED STATES OF AMERICA Jacket design by Oliver Munday
Jacket photograph: DigitalGlobe/Getty Images
v3.1
For SC and for my parents—with love and great gratitude,
though gratitude is insufficient for all that you’ve done.
CONTENTS
Cover
Title Page
Copyright
Dedication
Prologue: The Case of the Centrifuges
1. Early Warning
2. 500 Kilobytes of Mystery
3. Natanz
4. Stuxnet Deconstructed
5. Springtime for Ahmadinejad
6. Digging for Zero Days
7. Zero-Day Paydays
8. The Payload
9. Industrial Controls Out of Control
10. Precision Weapon
11. A Digital Plot Is Hatched
12. A New Fighting Domain
13. Digital Warheads
14. Son of Stuxnet
15. Flame
16. Olympic Games
17. The Mystery of the Centrifuges
18. Qualified Success
19. Digital Pandora
Acknowledgments
PROLOGUE
THE CASE OF THE CENTRIFUGES
It was January 2010 when officials with the International Atomic Energy
Agency (IAEA), the United Nations body charged with monitoring Iran’s
nuclear program, first began to notice something unusual happening at
the uranium enrichment plant outside Natanz in central Iran.
Inside the facility’s large centrifuge hall, buried like a bunker more
than fifty feet beneath the desert surface, thousands of gleaming
aluminum centrifuges were spinning at supersonic speed, enriching
uranium hexafluoride gas as they had been for nearly two years. But
over the last weeks, workers at the plant had been removing batches of
centrifuges and replacing them with new ones. And they were doing so
at a startling rate.
At Natanz each centrifuge, known as an IR-1, has a life expectancy of
about ten years. But the devices are fragile and prone to break easily.
Even under normal conditions, Iran has to replace up to 10 percent of
the centrifuges each year due to material defects, maintenance issues,
and worker accidents.
In November 2009, Iran had about 8,700 centrifuges installed at
Natanz, so it would have been perfectly normal to see technicians
decommission about 800 of them over the course of the year as the
devices failed for one reason or another. But as IAEA officials added up
the centrifuges removed over several weeks in December 2009 and early
January, they realized that Iran was plowing through them at an unusual
rate.
Inspectors with the IAEA’s Department of Safeguards visited Natanz an
average of twice a month—sometimes by appointment, sometimes
unannounced—to track Iran’s enrichment activity and progress.1
Anytime workers at the plant decommissioned damaged or otherwise
unusable centrifuges, they were required to line them up in a control
area just inside the door of the centrifuge rooms until IAEA inspectors
arrived at their next visit to examine them. The inspectors would run a
handheld gamma spectrometer around each centrifuge to ensure that no
nuclear material was being smuggled out in them, then approve the
centrifuges for removal, making note in reports sent back to IAEA
headquarters in Vienna of the number that were decommissioned each
time.
IAEA digital surveillance cameras, installed outside the door of each
centrifuge room to monitor Iran’s enrichment activity, captured the
technicians scurrying about in their white lab coats, blue plastic booties
on their feet, as they trotted out the shiny cylinders one by one, each
about six feet long and about half a foot in diameter. The workers, by
agreement with the IAEA, had to cradle the delicate devices in their
arms, wrapped in plastic sleeves or in open boxes, so the cameras could
register each item as it was removed from the room.
The surveillance cameras, which weren’t allowed inside the centrifuge
rooms, stored the images for later perusal. Each time inspectors visited
Natanz, they examined the recorded images to ensure that Iran hadn’t
removed additional centrifuges or done anything else prohibited during
their absence.2 But as weeks passed and the inspectors sent their reports
back to Vienna, officials there realized that the number of centrifuges
being removed far exceeded what was normal.3
Officially, the IAEA won’t say how many centrifuges Iran replaced
during this period. But news reports quoting European “diplomats” put
the number at 900 to 1,000. A former top IAEA official, however, thinks
the actual number was much higher. “My educated guess is that 2,000
were damaged,” says Olli Heinonen, who was deputy director of the
Safeguards Division until he resigned in October 2010.
Whatever the number, it was clear that something was wrong with the
devices. Unfortunately, Iran wasn’t required to tell inspectors why they
had replaced them, and, officially, the IAEA inspectors had no right to
ask. The agency’s mandate was to monitor what happened to uranium at
the enrichment plant, not keep track of failed equipment.
What the inspectors didn’t know was that the answer to their question
was right beneath their noses, buried in the bits and memory of the
computers in Natanz’s industrial control room. Months earlier, in June
2009, someone had quietly unleashed a destructive digital warhead on
computers in Iran, where it had silently slithered its way into critical
systems at Natanz, all with a single goal in mind—to sabotage Iran’s
uranium enrichment program and prevent President Mahmoud
Ahmadinejad from building a nuclear bomb.
The answer was there at Natanz, but it would be nearly a year before
the inspectors would obtain it, and even then it would come only after
more than a dozen computer security experts around the world spent
months deconstructing what would ultimately become known as one of
the most sophisticated viruses ever discovered—a piece of software so
unique it would make history as the world’s first digital weapon and the
first shot across the bow announcing the age of digital warfare.
1 The number of inspection visits to Natanz has increased since this period. Beginning in 2010,
inspections increased to once a week, and after a new agreement with Iran in late 2013,
inspectors are now on-site at Natanz every day.
2 IAEA inspectors are not allowed to remove the recorded images from Natanz and can only view
them on-site, where they are stored.
3 Inspectors visiting Natanz and other nuclear facilities around the world rotate on a regular
basis, so the same IAEA inspectors don’t visit every time. This is why the large number of
decommissioned centrifuges didn’t get noticed until after several reports of changing numbers
arrived in Vienna and got viewed in the aggregate by analysts and officials there.
