Thread by @KimZetter

I think you all gave me a homework assignment. I'll watch and livetweet tonight at 8pm PST.

https://twitter.com/KimZetter/status/1364955854651416587

Ok as I open Episode 7 of @Netflix's Spycraft, I realize it's not a whole episode about Stuxnet; it's called The Codebreakers and is about a lot of other things - Jefferson's cipher wheel, Enigma, etc, with only a few minutes about Stuxnet. That's probably a good thing.

This is going to be a mercilessly short thread because I'm just going to skip ahead to the part about Stuxnet so I don't have to watch the whole episode. Looks like the Stuxnet portion is just 3 minutes long. Woohoo

Already this is looking bad because they don't identify the people who are speaking. People, haha. I mean men of course. The Stuxnet part begins at around the 11-minute mark. Turn on subtitles to see if the man is identified there. No, he's just called "Man 1". This is good.

I meant mercifully of course.

Talking man [Man 1] says Stuxnet was written "to attack the Siemens7 operating system." Hm. I'll let that pass. It wasn't really. It was written to attack centrifuges but I won't be pedantic about it. Except to say it's wrong. Also, can you call Siemens7 an op system? I think not

Oh no. Man 1 is in trouble. He doesn't know how Stuxnet got onto the air-gapped systems in Iran but he's heard some rumors and he's going to cite those rumors even though we actually do know how Stuxnet got onto the systems and it's not via any method he describes.

Rumor 1 - "I heard remote maintenance access." Uhm, he's just said the systems weren't connected to the internet.
Rumor 2 - "They walked in with a laptop and connected it." Who is they? And did he see those armed men and anti-aircraft guns outside?

Now we see a sinister image of someone (another man of course) typing on a computer wearing black padded leather gloves as he types on the keyboard to unleash his sinister attack. I'm guessing the attacker didn't suffer a fat-finger typo as he unleashed his digital weapon.

Rumor 3 - This is a good one. "A popular theory is that the Stuxnet virus was introduced to the system through infected thumb drives placed around the nuclear facility in Iran.” Oh no. He's actually suggesting that the attackers scattered thumb drives around the nuclear facility.

"If you had a very high-grade thumb drive and you drop them selectively in parking lots or you dropped them from the air or you somehow introduced them, someone’s going to finally take and put that into the machine to see who it belongs to"

Ok, whew. He's not actually committing to that scattered thumb drive theory. "The exact method of how the thumb drives were introduced has never been revealed but the plan worked." Actually it has been revealed. Here (amazon.com/Countdown-Zero…). And here: yahoo.com/news/revealed-…

Oh no. Now he's completely lost the plot.

"What the system (?) did is it went to the Siemens controller and it sent a signal then, to the operator who's manning the speed of the centrifuges, that says 'this centrifuge is slowing down.' Which would mean the operator would want to turn up the speed to increase it working."

No, no, no. This didn't happen at all.

"But that was a fake signal. And the more [the operator] turned it up the more it appeared to slow down. And so the operators kept turning up the speed of the centrifuges and in effect they tore themselves apart.." This is an entirely fictional account of what occurred @netflix

Oh. That's it. No more on Stuxnet. Oh well. That was relatively painless. Except he stated that the Iranian operators themselves destroyed the centrifuges by manually increasing the speed. Where is a *shakes head* emoji when you need one?

How did Stuxnet really destroy the centrifuges? It sat silently on the PLCs that controlled the spinning centrifuges for about 2 wks, recording the normal operation of the centrifuges (speed/temperature/ pressure) and stored that info. At end of 2 weeks, the sabotage began...

Stuxnet increased the speed of the centrifuges from 1,064 Hz (their normal operating frequency) to 1,410 Hz for 15 minutes. 1,410 Hz was close to the max speed this particular model of centrifuge could withstand. Then Stuxnet would restore the centrifuges to their normal 1,064 Hz

The centrifuges would then operate normally for 26 days, while Stuxnet again recorded/stored the normal operation data, and then a second round of sabotage would begin. This time the centrifuges would slow to 2Hz for 50 minutes.

While the sabotage was occurring, Stuxnet took that data it had recorded and stored when the centrifuges were operating at normal speed and fed that now false data back to the monitoring stations so the operators would think the centrifuges were still spinning at normal speed.

Stuxnet also disabled the automatic safety mechanism on the centrifuges that was designed to detect if they started spinning out of control and shut them down - thus preventing the safety system from stopping the centrifuges.

And that is how you kill a centrifuge. (Stuxnet did other things as well, but the documentary didn't address those so I won't either.)

Photo of Iranian technicians trying to figure out what happened to their centrifuges 👇 (not really; but it is a photo at the nuclear facility)

Based on ?? I see I should note the sabotage occurred in cycles. The centrifuges sped up, then returned to normal, slowed down, then returned to normal, sped up and so on. This would do 3 things - 1) when the centrifuges would speed up to the max speed they could withstand...

repeatedly, some would become unmoored from cascade and crash into one another. 2) The constant change of speed would also wear down the motors. 3) To enrich uranium centrifuges have to spin at uniform speed; by increasing and slowing speed, the gas would not become enriched