Exploring Fukushima Plant - Stuxnet Connections

Afternoon fellow ATSers.

I've had my eye on the Fukushima Nuclear Plant crisis since it began, my eyes glued to news reports, but the most reliable info seems to be coming via ATS.

And I thought I could trust the Mainstream Media.


One thing that is a bit scary is the nature of the emergency and its similarity to the way the Stuxnet worm can be utilized on PLC's (Programmable Logic Controllers). The worm was used on a plant in Iran to sabotage its centrifuges

"These are small embedded industrial control systems that run all sorts of automated processes: on factory floors, in chemical plants, in oil refineries, at pipelines--and, yes, in nuclear power plants. These PLCs are often controlled by computers, and Stuxnet looks for Siemens SIMATIC WinCC/Step 7 controller software."
-Schnier on Security (full article link at bottom of post)

Essentially, the worm allows someone to remotely control these infected PLC's. Below is a video demo of what Stuxnet can do, using an air pump and a balloon as an example.

www.youtube.com...

This is a discussion thread. This could be caused by the earthquake alone. I am not saying with any certainty there is a connection, but the circumstances leading to the meltdown led me to infer Stuxnet could do something like this (Maybe with a water pump's PLC??)

Hypothetical: Stuxnet infects water cooling pump PLC, earthquake strikes and Stuxnet is activated, disabling cooling systems. I can say with near certainty that this plant utilized PLC's that can be infected by the worm.

So what do you guys think? Could this be a viable explanation? If so, who is behind it and what would they stand to gain? Is this another attempt at constructed Disaster Capitalism?

If the plant does not use PLC's, could something similar to Stuxnet be used to overheat the reactors?

Tell me what's on your mind.

you forgot to paste the link you mention;

if you could elaborate more also, like about origins&past attacks (that'd save me some work also because my paranoid intellect is telling me that you are unto something)

the stuxnet worm was the one used to attack the iranian plant ?

All safety related systems at Fukushima are controlled by relay based logic. In other words, its impossible to modify the programming short of rewiring the relays.

reply to post by SirMike


So you would have to physically rewire it to make any changes to how it works?

edit: Second line?

reply to post by BadMagician


Yes. Basically, once the initial hardware design and control scheme was approved in the 1970’s operators thought it wasn’t worth the time and effort to upgrade to more modern SCADA controllers. That’s not to say that data from instruments isnt monitored on SCADA systems, just that SCADA systems dont control nuclear plants except for one built more recently.

reply to post by SirMike


Could you post me a link with this information? I would like to read up on it.

And what is your experience in nuclear power plants and their controller systems? You only started sharing your scientific expertise just recently, when Japan became a trendy issue.

I went through your posts - I may just be looking at it from a skewed perspective, but you seem to be following all the hot topics, giving your little debunk, and leaving.

You have started Islamophobic threads that generated 4 replies and a flag because the general public of ATS has good judgement. You reply in Islam-related threads with bigotry, however much you try to mask it with logic.

You said Anonymous' only objective was to defend Wikileaks, which is a complete untruth and proven by looking at a number of their press releases and actions.

You've insulted protesters in the EU/Mid. East with the typical lazy-slob-welfare-child-crybaby arguement that doesn't go deep AT ALL into why we have the problems we do in our global society.

All of this you have done, and if it was not your thread, it was only the threads opposed to the ideas of TPTB and only when those threads were gaining popularity.

So I am skeptical of your answers.

Anyone else care to comment?

reply to post by BadMagician


Well, I have worked in the power industry for over a decade including nuclear plants, so I know how they work. If you are looking for a Wikipedia link, I cant help you.

As for the rest, I dont really know how to answer it other than to say theres alot of BS around here and I like to debunk it.

(hello world of ats)

badmagician, that was masterfully executed. a pleasure. i joined to pay you that compliment -- and to call your attention to this page as it may be of interest.

an excerpt from the webmaster's commentary:

Here is a nightmare scenario for you.

1. Israel and the US create Stuxnet.

2. Stuxnet is deployed to wreck Iran's nuclear power station.

3. But Stuxnet escapes from its intended target and spreads across Asia!

4. As the above article documents, Stuxnet was in Japan last October, presumably still spreading and intended to wreck nuclear power plants.

5. Stuxnet targets the Siemens controller.

6. Fukushima uses the Seimens controllers Stuxnet was designed interfere with!

So now the difficulty the Fukushima nuclear plant operators faced in recovering control over their runaway reactors takes on a darker significance. Remember that the first problem following the quake was that the automated shutdown systems failed to operate at some of the reactors, because pumps failed and valves would not open even while running on batteries; the very sorts of mischief Stuxnet supposedly was designed to cause at Iran's power station.

i reposted with the original links. i think the webmaster may be on to something. i tried to do some research and dug up nothing new.


thought you would like to know.

ps note the contradiction to the relay remark, above. still i would like to see more corroboration....

reply to post by BadMagician

I noticed that you never got the link you requested.

As for SirMike and his newfound interest in ATS, this post says it all:

Originally posted by SirMike
"Some" people think low levels (higher than background) can have postive effects. Its called radiation hormesis and the theory is low levels of ionizing radiation stimulates the bodys DNA repair mechanims making other forms of cancer less likely.

So there's two possibilities:

1) "Someone" who claims to have worked in the nuclear industry for 10 years actually has the knowledge and expertise of Anne Coulter, or

2) You've discovered and exposed a really bad magician.

Since I haven't seen most of the usual suspects around here recently -- which is a bit disconcerting in itself -- I'd guess the latter.

reply to post by BadMagician

Interesting hypothesis.

Here's the part I don't understand. In this timeline of events:

FRIDAY, MARCH 11
(All Japan local times, when reported by Reuters)
19:46 – The government reveals a cooling problem at TEPCO’s Fukushima Daiichi nuclear plant on the northeast coast, which bore the brunt of the quake and tsunami. Chief Cabinet Secretary Yukio Edano says the government has declared an emergency as a precaution but he says there is no radioactive leak.
21:34 - TEPCO confirms water levels falling inside reactors at the plant, and says it is trying to avert the exposure of nuclear fuel rods by restoring power to its emergency power system so that it can pump water inside the reactors.
21:49 – Jiji news agency says evacuation area around the plant is extended to 3 km from 2 km and quotes authorities as saying no radioactive leak has been confirmed.
21:55 – The government says radiation has leaked from one of the plant’s reactors.
22:45 – Vienna-based International Atomic Energy Agency (IAEA) says Japan advised that a heightened state of alert has been declared but no release of radiation had been detected.
It says Japanese authorities also reported a fire at the Onagawa nuclear power plant, which has since been extinguished.
“They say Onagawa, Fukushima Daini and Tokai nuclear power plants were also shut down automatically, and no radiation release has been detected,” the statement says.

SATURDAY, MARCH 12
00:38 – The World Nuclear Association, the main nuclear industry body, says it understands the situation is under control, and water is being pumped into the reactor’s cooling system. An analyst at the association says he understood a back-up battery power system had been brought online after about an hour, and begun pumping water back into the cooling system.
00:40 - U.S. Secretary of State Hillary Clinton says the United States has transported coolant to the stricken nuclear plant. “We just had our Air Force assets in Japan transport some really important coolant to one of the nuclear plants,” Clinton says at a meeting of the President’s Export Council.
01:27 – Jiji says Fukushima prefecture expects cooling function at the plant to be restored by 1630 GMT (0130 local)
01:46 – Jiji quotes TEPCO as saying pressure inside the No. 1 reactor at the plant has been rising, with the risk of a radiation leak. It plans to take measures to release the pressure, the report says.
02:00 – Kyodo news agency quotes TEPCO as saying pressure inside the No. 1 reactor rose to 1.5 times designed capacity.
03:04 – Japan’s nuclear safety watchdog confirms TEPCO is considering steps to lower the pressure in a container in the No. 1 reactor. A spokesman for the Nuclear and Industrial Safety Agency says it is unknown whether radiation levels are high in the container, which is inside a turbine building.
03:13 – Kyodo news agency quotes Japan’s trade minister as saying a radiation leak could take place at the plant.
03:14 – Cabinet Secretary Edano says TEPCO realises the need to release pressure inside the plant, that this could cause a small radiation leak.
06:37 - U.S. officials say the U.S. military did not provide any coolant for the Japanese nuclear plant, despite Clinton’s earlier remarks. They say U.S. Air Force “assets” in Japan delivered coolant to a nuclear plant. One U.S. official says Japan had asked the United States for the coolant but ultimately handled the matter on its own.
07:19 – TEPCO says it has lost its ability to control pressure in some reactors of a second nuclear power plant at its Fukushima facility. Pressure is stable inside the reactors but rising in the containment vessels, a spokesman says, although he did not know if there would be a need to release pressure at the plant at this point, which would involve a release of radiation
09:34 - Kyodo news agency says Japan has begun evacuating about 20,000 people from vicinity of the nuclear plants.
10:07 - TEPCO has begun releasing pressure from No. 1 reactor at Fukushima Daiichi nuclear plant, the Trade Ministry says. TEPCO says it will prepare for the release of pressure from the second nuclear plant, the Fukushima Daini plant, as pressure mounts. TEPCO and the authorities battle to contain rising pressure at the plants. They say thousands of residents in the area have been evacuated.
17:47 - Cabinet Secretary Edano confirms an explosion and radiation leak at Fukushima Daiichi. "We are looking into the cause and the situation and we'll make that public when we have further information," Edano says. "At present, we think 10 km evacuation is appropriate."

As of 00:38 on March 12, the World Nuclear Association says "the situation is under control, and water is being pumped into the reactor’s cooling system" using a backup battery system.

Two minutes later, U.S. Secretary of State Hillary Clinton says: “We just had our Air Force assets in Japan transport some really important coolant to one of the nuclear plants,” Clinton says at a meeting of the President’s Export Council.

I'm curious, what kind of "really important coolant" did U.S. Air Force "assets" transport to one of the nuclear plants? Sparkling mineral water?

And why was this denied six hours later?

Between the last report on March 12 at 10:07 when TEPCO is in a "battle to contain rising pressure at the plants" and the first explosion that was reported about seven hours later, I can't find anything that says backup battery power to the reactors was lost.

Is it possible that the widely reported loss of power from swamped generators wasn't the real reason for TEPCO's inability to release pressure?

thank you thank you. hmmm. still looking for info, here -- found a good new scientist write up of exactly how stuxnet works (for me, as background, and despite its unwillingness to name the US or Israel as suspected originators, it was well worth the read in toto:

The Stuxnet worm is different. It is the first piece of malware so far able to break into the types of computer that control machinery at the heart of industry, allowing an attacker to assume control of critical systems like pumps, motors, alarms and valves in an industrial plant.

In the worst case scenarios, safety systems could be switched off at a nuclear power plant; fresh water contaminated with effluent at a sewage treatment plant, or the valves in an oil pipeline opened, contaminating the land or sea.

"Giving an attacker control of industrial systems like a dam, a sewage plant or a power station is extremely unusual and makes this a serious threat with huge real world implications," says Patrick Fitzgerald, senior threat intelligence officer with Symantec. "It has changed everything."

Why is a different type of worm needed to attack an industrial plant?

Industrial machinery is not controlled directly by the kind of computers we all use. Instead, the equipment used in an industrial process is controlled by a separate, dedicated system called a programmable logic controller (PLC) which runs supervisory control and data acquisition software (SCADA).

Running the SCADA software, the PLC controls the process at hand within strict safety limits, switching motors on and off, say, and emptying vessels, and feeding back data which may safely modify the process without the need for human intervention – the whole point of industrial automation.

So how does a worm get into the system?

It is not easy because they do not run regular PC, Mac or Linux software. Instead, the firms who sell PLCs each have their own programming language – and that has made it tricky for hackers to break it.

However there is a way in via the Windows PC that oversees the PLC's operations. Stuxnet exploited four vulnerabilities in Microsoft Windows to give a remote hacker the ability to inject malicious code into a market-leading PLC made by German electronics conglomerate Siemens.

That's possible because PLCs are not well-defended devices. They operate for many years in situ and electronic access to them is granted via well-known passwords that are rarely changed. Even when Stuxnet was identified, Siemens opposed password changes on the grounds that it could cause chaos as older systems tried to communicate using old passwords.

from
Why the Stuxnet Worm is Like Nothing Seen Before

[font=Georgia]Here's something -- enough of a something that I just blogged about it:

Fukushima Daiichi

Similar problems occurred at the Daiichi plant. Units 1, 2 and 3 were operating at full power but shut down on the earthquake. They too were flooded by the tsunami and lost their sea water pumps - but this was exacerbated by the loss of emergency diesels as well. One factor in this could be that the Daiichi plant is at a slightly lower altitude than Daini, making the tsunami relatively more powerful.

This meant that heat was building up in the power plant in the same way as at Daini 1, 2 and 4, but that core cooling sprays could not be powered.

At Daiichi 1, 2 and 3, the steam-driven HPCIs were left as the only cooling system, which eventually heated the units' toruses to the point that they stopped working. Pressure from the reactor vessels built several times to the point that it required release. Separately, gas in the containment vessel was vented and this was enough to raise radiation levels at the site boundary to 0.5 millisieverts per hour.

Japanese officials reported that for each unit, "The behaviour of the pressure of the reactor vessel and the containment vessel, and the behaviour of the water level of the reactor were complicated. Some measurements were not possible because of failures of measuring equipment. As a result, a detailed estimate cannot be done." However, they said, the radiation signature of the releases matched a theory that a few percent of each reactor core had suffered damage.

Enough hydrogen was also produced within the reactor vessel by the interaction between water and hot fuel to cause an explosion at each unit when this was vented to the secondary containment. For units 1 and 3 this removed the top part of the reactor building. At unit 2 this may have taken place in the torus, causing damage there.

Core damage is rated at Level 5 on the INES scale, an 'accident with wider consequences'. This is applied to units 2 and 3, while unit 1's INES Level 5 rating is attributed to the abnormal rise of radiation dose at the site boundary.

After the total failure of plant cooling systems, seawater is being pumped into the reactor cores of units 1, 2 and 3 to prevent overheating and further core damage. This will likely continue for some time, although plant cooling systems may come back into operation once external power is restored.

I brought up the already cited coolant anomaly, then asked:

What were they delivering, and why?

Could it have been code? Code to address a virus related problem with Siemens made PLCs that, having become infected, were failing to behave normally? Code that the developers of the virus would have?
More specifically, were the components responsible for an inability to obtain useful information about water/pressure/temperature levels, cited by the World Nuclear Association, controlled by Siemens PLCs?

hmmm..

[/font]

reply to post by femalefaust

Great blog. What happened to Bad Magician? I think the both of you have discovered something quite significant.

And thank you for calling me "perspicacious."

reply to post by BadMagician


These controllers and plcs were specifically designer to be used in centrifuge tech. Siemens product line. This was were the attacking codes was focusing on and had nothing to do with Fukashima controls. The controls used in Fukashima are old devices.

The stuff for centrifuges is newer tech. Big difference in tech.

reply to post by BadMagician


Form what I heard the manipulated the speed controls of the spin cycles and increased the speed way above the operating capacity of the bearings. These thing have tight tolerances and balance. If you drive above the spec speed then catastrophic failure is the result. The problem is most of the stuff was taken off line via EMO. If you kill the power to the device it cannot spin up. The other problem is they need to remove all pc's modems, wireless and systems and start from scratch but the biggest problem is it is all infected even the gov servers. So once this stuff comes on line again. Backl to square on..


My biggest fear is that rogue nations are no in possession of this virus and once they play around with it and try to decode the functionality of it. 2-3 years they could unleash a virus of epic proportions sending us all to our graves or back to the stone age.

reply to post by GoldenFleece


Reading comprehension isnt your strong suit is it. My explanation of radiation hormesis was just that, an explanation not an endorsement. This would have been clear had you pasted the rest of my post.

I can promise you after working in the automation industry for a while dealing with PLC's

that no critical PLC will be connected to A) the Internet (LoL) b) the owning companys Corprate network

The worm doesnt allow remote control either? rather sits and waits on the SCADA networking waiting to interupt comms



One thing i will give is that the Industrial industry was quite neive they thought they had protection though obscitcy IE were not important to attack and no one can touch us, this all changed and there as been a hevey drive since 2006 to firewall up scada networks

though a worrying factor is a lot of the machines on a bog stanard plant will be NT4

Sorry for leaving this topic alone for so long, I think I need to bring it back to the ATS eye...Thought I was alone in thinking SirMike was an unreliable source of that information.


And on the note that the PLC is newer and only works in Iran's centrifuges - I think we have all seen how full of crap the media is with pretty much everything.

Even if Stuxnet specifically does not work with the GE designed plants in Fukushima, how can we not question there could be a form of sabotage?

So the numerous backup generators for each of the reactor cooling devices, all of those failed at the same time? Keep in mind they have more than one backup gen for each reactor.

Stuxnet infection is more complicated than a computer with an internet connection. You need someone to physically go to the device or the non-internet-connected controlling PC and install it yourself.

Controlling Stuxnet is done over the internet, but seems to me you could have an older build or the precursor to Stuxnet which is manually installed on a controller terminal and hidden as a "time bomb" of sorts, or to detonate when a certain condition is met, aka seismic activity/emergency.

Originally posted by BadMagician
Sorry for leaving this topic alone for so long, I think I need to bring it back to the ATS eye...Thought I was alone in thinking SirMike ...is done over the internet, but seems to me you could have an older build or the precursor to Stuxnet which is manually installed on a controller terminal and hidden as a "time bomb" of sorts, or to detonate when a certain condition is met, aka seismic activity/emergency.

..or they could just have it pre-keyed to safety overrides, so that it need no control in the event of any emergency , it would simply feed false information to the gauges and continuously turn-off any safety measures.

A poster by the name of Hellhound604,left this interesting link (although some of his photo interpretations are not thourogh ) , and after spending a great deal of time closely studying the evidence here: www.abovetopsecret.com... about Fukushima

I hate to say it , but this scenario seems to be extremely likely however it was pulled off , the evidence is quite compelling when taken as a whole

Originally posted by Silverlok

Originally posted by BadMagician
Sorry for leaving this topic alone for so long, I think I need to bring it back to the ATS eye...Thought I was alone in thinking SirMike ...is done over the internet, but seems to me you could have an older build or the precursor to Stuxnet which is manually installed on a controller terminal and hidden as a "time bomb" of sorts, or to detonate when a certain condition is met, aka seismic activity/emergency.

..or they could just have it pre-keyed to safety overrides, so that it need no control in the event of any emergency , it would simply feed false information to the gauges and continuously turn-off any safety measures.

A poster by the name of Hellhound604,left this interesting link (although some of his photo interpretations are not thourogh ) , and after spending a great deal of time closely studying the evidence here: www.abovetopsecret.com... about Fukushima

I hate to say it , but this scenario seems to be extremely likely however it was pulled off , the evidence is quite compelling when taken as a whole

You don’t understand how these controllers work. Its not that sabotage is impossible, its that sabotage via computer virus or compromising the control system is near impossible as the OP has laid it out. Relay based controls are not programmable in the traditional sense. If you want it to perform differently, you physically have to rewire it and change relays/timers/loop controllers/etcetera to accomplish this. None of these modes of failure or sabotage you speak of are even physically possible.