Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

by Kim Zetter

The attackers had no doubt assumed, even counted on, the Iranians not having the skills to uncover or decipher the malicious attacks on their own. But they clearly hadn’t anticipated that the crowdsourced wisdom of the hive—courtesy of the global cybersecurity community—would handle the detection and analysis for them.

Marcus Ranum, one of the early innovators of the computer firewall, called Stuxnet “a stone thrown by people who live in a glass house.”

“If you come out with a policy that subverts Microsoft certificates, subverts Windows Updates to spread malware, it’s difficult to get yourself to a position where cyberspace is safer, more secure and resilient,” he says. “In some ways I feel like the Fort Meade crowd are the Israeli settlers of cyberspace—it doesn’t matter what the official policy is, they can go out and they can grab these hills, and they’re changing the facts on the ground.… If we’re ever going to get defense better than offense, some things should be more sacrosanct than others.…[But] if we have a norm that it’s OK to go after these things, if we’re creating this crisis of confidence … that’s just going to bounce back at us.”