Zero Days

<i>was attacking an array of six different groups 787 00:40:45,776 --> 00:40:49,611 <i>of, let's just say, thingies, physical objects, 788 00:40:49,613 --> 00:40:55,517 <i>and in those six groups, there were 164 elements. 789 00:40:59,221 --> 00:41:01,556 Gibney: Were you able to do any actual physical tests? 790 00:41:01,558 --> 00:41:03,792 Or it was all just code analysis? 791 00:41:03,794 --> 00:41:05,727 Yeah, so, you know, we obviously 792 00:41:05,729 --> 00:41:08,797 couldn't set up our own sort of nuclear enrichment facility. 793 00:41:08,965 --> 00:41:11,266 So... but what we did was we did obtain some PLCs, 794 00:41:11,268 --> 00:41:12,500 the exact models. 795 00:41:19,675 --> 00:41:22,077 <i>We then ordered an air pump, and that's what we used 796 00:41:22,079 --> 00:41:23,745 <i>sort of as our sort of proof of concept. 797 00:41:24,580 --> 00:41:26,314 O'Murchu: <i>We needed a visual demonstration 798 00:41:26,316 --> 00:41:28,516 <i>to show people what we discovered. 799 00:41:28,818 --> 00:41:30,852 So we thought of different things that we could do, 800 00:41:30,854 --> 00:41:32,988 and we... we settled on blowing up a balloon. 801 00:41:37,326 --> 00:41:39,294 <i>We were able to write a program that would inflate a balloon, 802 00:41:39,296 --> 00:41:42,197 <i>and it was set to stop after five seconds. 803 00:41:52,174 --> 00:41:53,942 <i>So it would inflate the balloon to a certain size 804 00:41:53,944 --> 00:41:55,443 <i>but it wouldn't burst the balloon 805 00:41:55,445 --> 00:41:56,878 <i>and it was all safe. 806 00:41:56,880 --> 00:41:58,980 And we showed everybody, this is the code 807 00:41:58,982 --> 00:42:00,215 that's on the PLC. 808 00:42:00,649 --> 00:42:02,617 <i>And the timer says, "stop after five seconds." 809 00:42:02,852 --> 00:42:04,412 <i>We know that's what's going to happen. 810 00:42:04,987 --> 00:42:07,255 And then we would infect the computer with STUXnet, 811 00:42:07,790 --> 00:42:10,058 <i>and we would run the test again. 812 00:42:41,257 --> 00:42:42,857 Here is a piece of software 813 00:42:42,859 --> 00:42:45,827 that should only exist in a cyber realm 814 00:42:45,829 --> 00:42:48,930 and it is able to affect physical equipment 815 00:42:48,932 --> 00:42:52,667 in a plant or factory and cause physical damage. 816 00:42:52,669 --> 00:42:54,736 Real-world physical destruction. 817 00:42:59,241 --> 00:43:01,910 <i>At that time, things became very scary to us. 818 00:43:01,912 --> 00:43:04,412 <i>Here you had malware potentially killing people 819 00:43:04,414 --> 00:43:06,714 and that was something that was always Hollywood-esque to us 820 00:43:06,716 --> 00:43:07,882 that we'd always laugh at 821 00:43:07,884 --> 00:43:09,918 when people made that kind of assertion. 822 00:43:15,524 --> 00:43:18,026 Gibney: <i>At this point, you had to have started developing 823 00:43:18,028 --> 00:43:20,795 <i>theories as to who had built STUXnet. 824 00:43:21,730 --> 00:43:23,298 It wasn't lost on us that 825 00:43:23,300 --> 00:43:26,534 there were probably only a few countries 826 00:43:26,536 --> 00:43:28,870 in the world that would want 827 00:43:28,872 --> 00:43:31,739 and have the motivation to sabotage 828 00:43:31,741 --> 00:43:33,875 Iran's nuclear enrichment facility. 829 00:43:33,877 --> 00:43:35,777 The U.S. government would be up there. 830 00:43:35,779 --> 00:43:37,946 Israeli government certainly would be... would be up there. 831 00:43:37,948 --> 00:43:40,048 You know, maybe U.K., France, Germany, 832 00:43:40,050 --> 00:43:41,483 those sorts of countries, 833 00:43:41,485 --> 00:43:43,785 but we never found any information that 834 00:43:43,787 --> 00:43:46,821 would tie it back 100 percent to... to those countries. 835 00:43:46,823 --> 00:43:48,756 There are no telltale signs. 836 00:43:48,758 --> 00:43:51,326 You know, the attackers don't leave a message inside 837 00:43:51,328 --> 00:43:53,495 saying, you know, "it was me." 838 00:43:54,396 --> 00:43:57,665 And even if they did, all of that stuff can be faked. 839 00:43:58,000 --> 00:44:00,668 So it's very, very difficult to do attribution 840 00:44:00,670 --> 00:44:02,403 when looking at computer code. 841 00:44:03,272 --> 00:44:04,806 Gibney: Subsequent work that's been done 842 00:44:04,808 --> 00:44:07,242 leads us to believe that this was the work of 843 00:44:07,244 --> 00:44:08,776 a collaboration between Israel and the United States. 844 00:44:08,778 --> 00:44:09,844 Yeah, yeah. 845 00:44:09,846 --> 00:44:10,979 Gibney: Did you have any evidence 846 00:44:10,981 --> 00:44:12,247 in terms of your analysis 847 00:44:12,249 --> 00:44:14,249 that would lead you to believe that 848 00:44:14,251 --> 00:44:15,583 that's correct also? 849 00:44:15,585 --> 00:44:17,685 Nothing that I could talk about on camera. 850