I've highly recommended the documentary Zero Days by Alex Gibney in the past, as the interviews with cybersecurity experts and military personnel are gold. Within a few hours of the film, the interviewed individuals refute many of the assertions made about securing the digital world. Alex interviews people who have an inherent incentive to report accurate information, so even aside from the information, he considered who would be sources of rich information. One of the people in the film that Alex interviews is Ralph Langner, who provides great information about the digital world, security and Stuxnet. Recently he's created a documentary of his own which covers some information about Stuxnet that highlight the two major versions of it ("campaigns" to use his term). In his video The Stuxnet Story: What really happened at Natanz, he explains these two major campaigns of Stuxnet with extremely detailed information. This video is worth watching a few times to take notes on his information, along with understanding Stuxnet in more depth than Alex's film (Alex's film ends up covering more about how we want to think about cyber warfare than Stuxnet).
Some chapters in the video, all of which are worth watching and some quick notes why you should watch them:
- Introduction
- Backstory: this is key to understanding the history of the program from outside Iran that would later introduce challenges.
- Technical difficulties: useful for understanding how this applies to anything in the digital world and the challenges that will open the door to hackers, especially when we have to account for technical difficulties.
- The first campaign: a good question to ask while you watch this is what do you notice about the attackers in this campaign?
- The second campaign: in comparison with the first compaign, what shift do you see in the attack during the second campaign?
- Afterstory: Ralph Langner provides a sensible afterstory to Stuxnet while calling for some calm compared to some media stating that this is the end of the world (unhelpful to say the least).
- Final credits
As a note, I would say that the first campaign type is the worst type of attacker to be up against, as the entire attack was "silent" - it didn't destroy anything, it didn't communicate externally, it kept a low profile, etc. Sophisticated hackers build these type of viruses, while unsophisticated hackers build noisy viruses that easily get caught. Noisy hacks can be the best friend of a company because they're easy to catch: they communicate externally, they want a ransom, they attack infrastructure, or other types of activity that make it clear we've been compromised. By contrast, imagine an attack that makes no noise and silently and slowly undermines what we're doing, but without being obvious. We dismiss failures as part of the process without considering that these failures are part of an attack. In addition to that type of an attack, an attack that obtains information, such as intellectual property, without making noise is also dangerous. What's especially fascinating about the first campaign is that it didn't have zero days, stolen certificates, and kept an extremely low profile. Consider the timeline in Ralph's video and how quickly Stuxnet was discovered starting in the second campaign.
Check out Ralph Langner's YouTube channel at Langner Group. If your personal security concerns you, my course Consumer Guide To Digital Security teaches key principles to protecting your security.