THE internet is abuzz this week with speculation about Stuxnet, a "groundbreaking" computer worm that attacks industrial-control systems. Put that way, it doesn't sound very exciting. But the possibility that it might have been aimed at one set of industrial-control systems in particular—those inside Iranian nuclear facilities—has prompted one security expert to describe Stuxnet as a "cyber-missile", designed to seek out and destroy a particular target. Its unusual sophistication, meanwhile, has prompted speculation that it is the work of a well-financed team working for a nation state, rather than a group of rogue hackers trying to steal industrial secrets or cause trouble. This, in turn, has led to suggestions that Israel, known for its high-tech prowess and (ahem) deep suspicion of Iran's nuclear programme, might be behind it. But it is difficult to say how much truth there is in this juicy theory.

The facts are these. Stuxnet first came to light in June, when it was identified by VirusBlokAda, a security firm based in Belarus. The following month Siemens, a German industrial giant, warned its customers that their "supervisory control and data acquisition" (SCADA) management systems were vulnerable to the worm. Specifically, it targets a piece of Siemens software, called WinCC, which runs on Microsoft Windows. For security reasons such systems are usually not connected to the internet. But Stuxnet spreads via USB memory sticks, or key drives. When an infected memory stick is plugged into a computer, the Stuxnet software checks to see if WinCC is running. If it is, it tries to log in, install a backdoor control system and contact a server in Malaysia for instructions. If it cannot find a copy of WinCC, it looks for other USB devices and tries to copy itself onto them. It can also spread across local networks via shared folders and print spoolers. (Here are the gory details.)

At first it was assumed that Stuxnet was designed to conduct industrial espionage or allow hackers to hold companies to ransom by threatening to shut down vital systems. But it has some unusual characteristics. WinCC is a reasonably obscure SCADA management system. Hackers hoping to target as many companies as possible would have focused on other, more popular, control systems. And according to Ralph Langner, a German security expert who published his own analysis last week, Stuxnet examines the system it is running on and, only if certain very specific characteristics are found, shuts down specific processes. All this suggests that a particular system was being targeted.

Moreover, Stuxnet uses the combination of two compromised security certificates (stolen from companies in Taiwan) and a previously unknown security hole in Windows to launch itself automatically when a user tries to access a memory stick on which it is installed. The use of previously unknown security holes (known in the trade as "zero-day vulnerabilities") by viruses is not unusual. But Stuxnet can exploit four entirely different ones in order to worm its way into a system. Normally, anyone who discovers a new zero-day exploit can expect to sell it for a handsome fee to hackers who can then make use of it. Whoever built Stuxnet, however, was prepared to pay for four such exploits, which cannot have been cheap, to boost its chances of success. They also had deep knowledge of particular control systems. So it seems to be an expensive piece of software aimed at one specific facility.

But which one? Microsoft said in August that more than 45,000 computers around the world had been infected by Stuxnet. An analysis by Symantec, a computer-security firm, found that 60% of infected machines were in Iran, 18% in Indonesia and 8% in India. It could be just a coincidence that Iran has been hardest hit. But if Stuxnet has been deliberately aimed at Iran, one possible target is its Bushehr nuclear reactor, though there is no specific evidence for this. It is true that according to this screenshot from UPI, the Bushehr reactor is controlled by Siemens systems, including the WinCC software that Stuxnet targets. Dr Langner speculates that it could have been infected via AtomStroyExport, the Russian firm that is building the plant. Bushehr has been dogged by problems for years and its opening was recently delayed once again. But given the long history of delays, there is no need to invoke a computer worm to explain the latest one. A rival theory is that the target was Iran's uranium-enrichment plant at Natanz, and that Stuxnet successfully shut down some of its centrifuges in early 2009.

We are deep into the realm of speculation here. Readers are invited to follow the links in this post to wade as far as they like into the various conspiracy theories floating around (such as this one, which spots a Biblical reference in a project name buried in the Stuxnet code). Two further reports on the worm are due be released at a computer-security conference starting in Vancouver on September 29th. They may clear up some of the mysteries surrounding Stuxnet—but they may simply prompt further speculation.