Nicolas Falliere
More info
- Known for
- Analysis of Stuxnet's PLC payload
- Affiliation
- Symantec
French malware analyst at Symantec who worked out what Stuxnet actually did to the industrial controllers it went looking for.
Most people who looked at Stuxnet in 2010 got stuck on the Windows side, with its four zero-days and stolen signing certificates. Falliere, working from Symantec's Paris office, took on the less glamorous part: the code it loaded onto Siemens PLCs. With no background in industrial control, he had to learn Siemens' programming environment from scratch.
By November 2010 he could show that the payload only activated when the PLC was driving frequency converters from two specific vendors, one Finnish and one Iranian, running motors within a narrow band of speeds. That pointed squarely at uranium enrichment centrifuges. The findings became the core of the W32.Stuxnet Dossier, written with Liam O Murchu and Eric Chien.