ICS/SCADA › Module 5 › Lesson 2
Stuxnet Named
Stuxnet history and defensive lessons — air gaps, USB hygiene, signed firmware, monitoring — not exploit replication on YOUR $OT_LAB — defensive OT literacy only; no real-plant attacks, unauthorized OT scans, or exploit cookbooks.
Visual · t38_stuxnet_named
Stuxnet Named literacy. $OT_LAB only. Original Cyberlium.
Opening
Stuxnet changed OT security thinking — Cyberlium teaches history and defense lessons, not weaponization steps against live Siemens environments.
Stuxnet (2010) demonstrated targeted ICS malware affecting centrifuge processes via compromised engineering paths and multiple zero-days. Literacy covers history timeline, lessons for air gaps, removable media control, code signing, and anomaly monitoring — explicitly not exploit replication or PLC attack cookbooks. Cyberlium Topic 38 practices on $OT_LAB — YOUR fictional OT templates, zone diagrams, and labeled checklists under $HOME/cyberlium-lab/t38-ot/ no real-plant attacks, unauthorized OT scans, or exploit cookbooks. Next: Defense Lessons.
1. What Stuxnet Named covers (named)
History literacy: targeted ICS malware, supply chain and USB paths, specific vendor context at time. Defense lessons: USB policy, engineering station hardening, firmware integrity, egress monitoring. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Write Stuxnet lesson row — historical fact, defensive takeaway, monitoring indicator. No exploit code or live target instructions. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Command guide
Try these commands — What Stuxnet Named covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA Stuxnet analysis — https://www.cisa.gov/news-events/analysis-reports/ar-12-2013 NIST SP 800-82 — https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export OT_LAB=${OT_LAB:-$HOME/cyberlium-lab/t38-ot}
cat > "$OT_LAB/notes/stuxnet-named.txt" <<'EOF'
Stuxnet — HISTORY + DEFENSE (NOT replication):
History: 2010 targeted ICS malware; USB/engineering path; process impact
Defense lessons: USB control, engineering station hardening, firmware integrity
Monitoring: anomalous logic changes, unexpected removable media
NEVER: replication tutorials or PLC weaponization steps
EOFCommand — copy this
grep -E 'HISTORY|Defense|NEVER' "$OT_LAB/notes/stuxnet-named.txt" curl -sS https://www.cisa.gov/news-events/analysis-reports/ar-12-2013 | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: CISA Stuxnet analysis (https://www.cisa.gov/news-events/analysis-reports/ar-12-2013); NIST SP 800-82 (https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Stuxnet Named matters for defenders
History informs budget for OT monitoring and media control. Replication against live PLCs is illegal and out of scope. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Students document history+defense cards on lab notes. Production applies lessons via governance and tooling. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
3. $OT_LAB boundary
Forbidden: Stuxnet replication tutorials, Step7 project weaponization against live PLCs. Allowed: Stuxnet history + defensive lessons card. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Ship: Stuxnet history/defense card. Next: Defense Lessons.
4. What you ship: stuxnet named card for $OT_LAB
Stuxnet history and defensive lessons — air gaps, USB hygiene, signed firmware, monitoring — not exploit replication. $OT_LAB named. NEVER real-plant attack steps. chmod 600.
5. What you record before the next lesson
Date (UTC). Stuxnet Named card. $OT_LAB named. File t38-m05-l02-stuxnet-named.txt chmod 600.
6. Wrong vs right: plant attacks vs YOUR OT lab sims
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Follow Stuxnet replication lab against employer Siemens PLC.
Right
Write stuxnet named card for YOUR $OT_LAB. Next: Defense Lessons.
Mission: document Stuxnet Named on YOUR OT lab
1) Name literacy rows on $OT_LAB. 2) Write NEVER list (no real-plant attacks, unauthorized OT scans, or exploit cookbooks). 3) chmod 600. Never scan or exploit real industrial networks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: literacy on $OT_LAB — not attack recipes against live plants.
Knowledge Check
APPLY: Stuxnet Named on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Topic 38 includes ICS attack cookbooks against real plants.
True or False
Knowledge Check
APPLY: Stuxnet Named literacy on Cyberlium uses:
Multiple choice