Page 1471 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Because of the lack of experience among law enforcement
authorities and the court system in dealing with computer crimes,

along with a lack of relevant laws, Morris received only a slap on
the wrist for his transgression. He was sentenced to three years’
probation, 400 hours of community service, and a $10,000 fine
under the Computer Fraud and Abuse Act of 1986. Ironically,
Morris’s father, Robert Morris, was serving as the director of the
National Security Agency’s National Computer Security Center
(NCSC) at the time of the incident.

Stuxnet

In mid-2010, a worm named Stuxnet surfaced on the internet. This

highly sophisticated worm uses a variety of advanced techniques to
spread, including multiple previously undocumented vulnerabilities.
Stuxnet uses the following propagation techniques:

Searching for unprotected administrative shares of systems on the
local network

Exploiting zero-day vulnerabilities in the Windows Server service
and Windows Print Spooler service

Connecting to systems using a default database password

Spreading by the use of shared infected USB drives

While Stuxnet spread from system to system with impunity, it was
actually searching for a very specific type of system—one using a
controller manufactured by Siemens and allegedly used in the
production of material for nuclear weapons. When it found such a
system, it executed a series of actions designed to destroy centrifuges
attached to the Siemens controller.

Stuxnet appeared to begin its spread in the Middle East, specifically on
systems located in Iran. It is alleged to have been designed by Western
nations with the intent of disrupting an Iranian nuclear weapons
program. According to a story in the New York Times, a facility in
Israel contained equipment used to test the worm. The story stated,
“Israel has spun nuclear centrifuges nearly identical to Iran’s” and