Preview: Stuxnet - 60 Minutes - CBS News Steve Kroft: Here is the background for a question to ask Ralph Langner on March 4th. Langner has explained Stuxnet a hundred times, but never has explained the mechanism of the Stuxnet malware attack. Either he does not know the explanation, or he fears to state the explanation: The central heart of every industrial control system (ICS) is the module termed "programmable logic computer," or PLC. The PLC has a programmable memory. However, the memory of the PLC is "write-always," i.e., vulnerable to rewriting by "bad guys." ICSs were initiated in automobile production lines in 1959, where the memories of the PLCs were changed only for car model year changes, e.g., 3 years. Now, with corporate management of ICSs achieved through the corporation's network connectivity, the bad guys will find a path through the connectivity to the write-always memories of the PLCs. The advantage for fast change is afforded by write-always memories, they can be reprogrammed "on the fly." In today's milieu, it is also malware that will reprogram the memories "on the fly." The alternative type of memory is "write-once." Write-once is exemplified by music CDs and movie DVDs that are used around the world; these are storage media than cannot be rewritten. If a PLC were fitted with a write-once memory, malware would be blocked from reprogramming an already-programmed memory. Summary of the systems: ICS is a control system, controlling large electromechanical systems A network is exemplified by the internet; information is stored, and made retrievable. In mid-2010, Stuxnet malware reprogrammed the memories of the PLCs of the ICS of the Natanz nuclear enhancement plant in Iran, causing the destruction of 1,000 centrifuges. Symantec published on the web a report on Stuxnet entitled "Stuxnet Dossier." Studying that report, we uncovered the underlying problem and patented, as here can be concisely expressed, "write-once, monitored memory." Basically, the attendant installs the specific preprogrammed write-once memory into the specific PLC, and the control room monitors the specificity of memory. Example from a major vendor of ICS equipment DHS has a team in Idaho that publishes "ICS-ALERT." Schneider Electric is a major ICS equipment vendor. ICS-ALERT-346-01 references a Schneider vulnerability notice, and in that notice there is this admission about Schneider's write-always PLC memories: ...."allowing remote attackers to.....modify the memory of the module and execute arbitrary code." Sincerely, Alan Morris, P.E. Morris and Ward Consulting Engineers