How a simple USB stick sabotaged Iran’s nuclear plan in a ‘world-first’ showdown

Tensions between Iran and Israel are near a boiling point after the firing of hundreds of rockets into Israel and its latest military response.

But the conflict has brewed for years, including sabotage of Iran’s nuclear programme with the help of one spy and a single USB stick.

That same device contained the infamous Stuxnet worm.

It infiltrated the Iranian nuclear programme in 2010, marking the first time a country attacked the critical infrastructure of another state.

A cyber expert has shared how Stuxnet damaged an Iranian nuclear plant and if the UK is safe from similar malicious attacks.

Dr Gareth Mott, research fellow at the RUSI Royal United Services Institute think-tank in London, said that before 2010 similar attacks might have happened, but in the shadows.

However, with Stuxnet, researchers found ‘the code of the malware was way more advanced.’

He told Metro.co.uk: ‘They had years to develop it. It was no small-scale criminal developing it.’

Who was behind Stuxnet?

Signs point to Israel and the US to be responsible for the sophisticated worm.

He said: ‘Israel views Iran as a nemesis. In their view, Iran was developing uranium for nuclear weapons. Iran said it was for civilian systems.’

What Iran was doing was ‘not clandestine’.

The International Atomic Energy Agency (IAEA) monitors its programme and it is alerted ‘when the pod is opened.’

However, it is ‘hypothetically possible to abuse it,’ he said.

As an ally of Israel, the US got involved in the plan to target Iran’s nuclear facilities.

The development of Stuxnet began in 2005 years before it was smuggled into Natanz nuclear plant by a spy.

How Stuxnext caused a shutdown

Iranian nuclear sites, just like facilities in the UK, are carefully protected against attacks.

It means they are not connected to the Internet to avoid intrusions.

In the uranium enrichment facility, the radioactive chemical element spins around quickly in centrifuges to enrich it.

Dr Mott said: ‘The system is not connected to the Internet, it is air gapped. It is disconnected from the Internet. It is one of the best systems.’

But it has one weakness – USB ports.

He explains: ‘But you can put a USB drive in. You have to have a port to do any updates. That means an attack, if you can get malware on a USB drive and into the critical system, maybe you can disrupt it.’

When the top-secret tool was ready in 2009, Israelis and Americans wanted to use it.

But it did not work as intended so experts designing the worm went back to base and ‘worked what was wrong, in laboratory conditions.’

The US was hesitant and told their partners to wait, but the ‘Israelis went ahead and used it anyways,’ the expert said.

Uranium has to be spun around in a ‘very controlled manner,’ but the malware made the system ‘too quickly and slow down and too quickly again,’ he explained.

‘The system started to wobble and began to collapse.’

It also ‘tricked’ the control panel which would normally spot if the centrifuges were spinning at a risky speed and fix it, making it look like ‘things were fine, but it wasn’t’, Dr Mott said.

As a result of the worm, the Iranian uranium enrichment programme was ‘broken,’ he said.

It is thought to have been set back by several years, tech publication Dark Reading estimated.

Stuxnet highlights how something as innocent as a USB port compromise national security.

In the UK, a senior IT worker at the Sellafield nuclear plant was fired after she had downloaded sensitive data onto a USB stick and dropped it in a car park.

Stuxnet’s existence was revealed after it was found on thousands of infected computers across the world despite, on paper, the Iranian system had no internet connection.

‘Somehow it got released. Maybe one of the scientists took it home to research it.’

Cyber researchers saw it was ‘very advanced’ after ‘years in the making and a lot of money.’

Stuxnet was significant because at the time no country in the world had declared it had a cyber weapon.

‘In 2013 UK did it, and we now have an offensive [cyber] arsenal,’ the expert said.

‘We have always conducted espionage, but we are now doing it with cyber tools.’

Following Stuxnet, Iran grew its cyber offensive capabilities, making it a ‘regionally significant power but internationally it is not,’ he said.

However, in the cyber and Internet space ‘they punch above their weight,’ with hackers and researchers embedded in the cyber command of Iran’s Revolutionary Guards.

Israel has its own cyber force, Unit 8200, which is the country’s version of UK’s GCHQ and the American NSA.

Cyber attacks from Iran to Israel have ‘stepped up since October 7’ when Hamas launched its deadly attack in Israel, followed by destruction of Gaza in Palestine by the Israeli army, with more than 30,000 people killed and 70,000 injured in the unlawfully blockaded strip of land, according to the UN.

Last weekend, Israeli authorities said they have seen ‘no rise in cyber incidents, but researchers have observed cyber attacks have doubled or tripled,’ Dr Mott said.

He suspects they are ‘low-level attacks which Israel will respond to to ‘disrupt Iran.’

The spy who planted Stuxnet

An investigation by the Dutch newspaper Volkskrant alleged the malware cost a whopping $1,000,000,000 (£800 million) to develop, Dark Reading reports.

The worm had to be first planted by a human.

According to the newspaper, the Dutch government sources told a 36-year-old engineer Erik van Sabben was working to sabotage the Iranian nuclear programme, hired for the job by the Dutch intelligence services without the knowledge of the Dutch government at the time.

A report by the newspaper revealed how Van Stabben worked as an Iranian engineer, giving him access to the underground departments of Natanz nuclear facility.

This is where he planted the Stuxnet virus, most likely using a water pump he had installed, Dark Reading reports citing Volksrant’s investigation.

The spy left Iran immediately after the mission.

He died just two weeks later in a motorbike accident in Dubai, with nothing pointing to foul play, according to NL Times citing the investigation.

How safe is the UK from cyber attacks?

It is difficult to predict what the next cyber attack might look like.

The UK government is ‘accutely aware’ of risk of cyber breaches and their ability to damage vital facilities, he said.

Britain’s nuclear power stations and critical systems also use the air gap to keep it away from the Internet.

Dr Mott said he understands modern facilities in the UK have a ‘fail safe system’ built into them.

‘It could be an outage, earthquake or flood, the system will fail safe and safeguard itself irrespective of the breach. On paper they should not be at risk of a cyber breach,’ he assured.

Cyber tools are not ‘like a gun or a missile system,’ Dr Mott clarified.

A cyber exploit is ‘only as good as long as the vulnerability exists’ in the system.

This is why hackers tend to sit on the ‘really juicy stuff’ which is the most valuable as they can sell it to a company with a vulnerability and tell them to fix their systems.

‘But when you use it, you cannot control where it goes. Like a boomerang it can be used by your enemies,’ he warned.

When he was asked if UK nuclear facilities are at risk, he said the ‘biggest concern we see routinely is ransomware attacks’ motivated by money rather than political gain by a nation-state.

‘A couple of years ago a water company was attacked. The water systems were not affected.

‘Hackney Council was hit among others. That is a societal service. It’s not nuclear but in Hackney, people could not update or sell their homes as the land registry was impacted.’

The key for organisations providing critical infrastructure like education, councils and health care was the ability to ‘bounce back’ quickly from an attack, he stressed.

Dr Mott added: ‘There is an acceptance you cannot guarantee your cyber security – someone motivated enough can probably get into your system.

‘You need to be able to bounce back quickly, aim to prevent but you cannot always to prevent and need to respond when it happens.’

Get in touch with our news team by emailing us at webnews@metro.co.uk.

For more stories like this, check our news page.