A researcher has reconstructed the source code of the Stuxnet worm, publishing it on GitHub for educational purposes. The malware was designed to target Siemens industrial controllers used at the Iranian Natanz nuclear enrichment plant, manipulating centrifuge frequency converters to damage rotors while reporting normal operation to staff.
The worm utilized three primary infection vectors: USB sticks with Windows shortcuts and autorun.inf files via a zero-day vulnerability, a zero-day Windows Print Spooler vulnerability for network spreading, and accessible network shares. To bypass Windows driver signature checks, it used stolen digital certificates from Realtek and JMicron.
The malware also injected itself into Siemens software through the WinCC SQL Server database and Step 7 project files. It eventually took control of the DLL that communicated with centrifuges and injected malicious code into the Programmable Logic Controllers (PLCs) to sabotage the rotors.
Stuxnet was part of Operation Olympic Games, a coordinated effort between the U.S. and Israel, developed by the Pentagon and Israel's Unit 8200. The operation aimed to curb Iran's nuclear progress at Natanz, reportedly damaging about 10% of the centrifuges. The worm had a hard-coded self-destruct date of June 24, 2012.
