I remember having to write a presentation about Stuxnet while at Uni, it was insane.
At the time they reckoned the authors had a functioning QA environment to ensure it actually worked (broke) the Siemens PLCs they were targeting.
At the time they reckoned the authors had a functioning QA environment to ensure it actually worked (broke) the Siemens PLCs they were targeting.
I was working in industrial control and automation at the time, there were sweeping changes to what could and could not be done and by whom at every level.
Old drives of all manufacturers that sat unused were audited and had to be brought up-to-date before any sale or change of hands could occur, serials were noted etc etc.
Never felt like a manufacturer decision since it occurred in unison almost globally.
I think that project was way beyond the "really need" stage.
one was to spin it far faster than it should, then stop abruptly in an attempt to damage the centrifuge
one was to run it at the wrong RPM to spoil the product of the centrifuge
in either mode, it would replay 'good' data to make the centrifuge look functional to an administrator
the way I understood, a 'bonus goal' was to keep the Iranians unable to diagnose what was going wrong, both with their production process (producing bad stock) and the failures (promoting distrust in their engineers) - i can't find an article right now, but I remember reading they were churning through site engineers at the time - presumably firing them for the on-site failures of centrifuges or their inability to stop them