O'MURCHU: We continued to search, and we continued to search in code, and eventually we found some other bread crumbs left we were able to follow. It was doing something with Siemens, Siemens software, possibly Siemens hardware. We'd never even seen that in any malware before, something targeting Siemens. We didn't even know why they would be doing that. But after Googling, very quickly we understood, it was targeting Siemens PLCs.
CHIEN:Stuxnet was targeting a very specific hardware device, something called a PLC or a programmable logic controller.
LANGER: The PLC is a kind of very small computer attached to physical equipment, like pumps, like valves, like motors. So this little box is running a digital program, and the actions of this program turns that motor on, off, or sets a specific speed.
CHIEN: Those program module controllers control things like power plants, power grids.
[...]
O'MURCHU: And of course we did notice that at the time there had been assassinations of nuclear scientists. So that was worrying. We knew that there was something bad happening.
CHIEN: We'd been publishing information about stuxnet all through that summer. And then in November, the industrial control system sort of expert in Holland contacted us, and he said all of these devices that would be inside of an industrial control system hold a unique identifier number that identified the make and model of that device. And we actully had a couple of these number in the code that we didn't know what they were. So we realized that maybe what he was referring to was the magic numbers we had. Then when we searched for those magic numbers in that context, we saw that what had to be connected to this industrial control system that was being targeted were something called frequency converters from two specific manufacturers, one of which was in Iran. So at this time, we absolutely knew that the facility that was being targeted had to be in Iran and had equipment made from Irania manufacturers.When we looked up those frequency converters, we immediately found out that they were actually export controlled by the [US] Nuclear Regulatory Commission [USC DOCUMENT OVERLAY: Specific license required when exported to embargoed destinations listed in 10 CFR 110.28] And that immediately led us then to some nuclear facility.