spectrum.ieee.org Open in urlscan Pro
151.101.65.91  Public Scan

Form analysis
2 forms found in the DOM

/search/

<form action="/search/"><button type="submit" class="menu-global__submit fa fa-search" value="" aria-label="Submit"></button><input name="q" class="menu-global__text-input" type="text" placeholder="Search..." aria-label="Search"></form>

/search/

<form action="/search/"><label for="q" class="hide-text">Search: </label><input placeholder="Type to search" type="text" name="q" id="q" class="search-form__text-input"><button aria-label="Search" type="submit" class="search-form__submit"
    value="Search"><svg width="18px" height="19px" viewBox="0 0 18 19" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
      <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
        <g id="1376---Sample-Front-Page" transform="translate(-826.000000, -102.000000)" stroke="#0D0D0D" stroke-width="1.5">
          <g id="Light-/-Nav" transform="translate(816.857864, 96.000000)">
            <g id="Search-Icon" transform="translate(7.307612, 5.000000)">
              <path
                d="M11.631728,14.6819805 C15.2215789,14.6819805 18.131728,11.7718314 18.131728,8.18198052 C18.131728,4.59212964 15.2215789,1.68198052 11.631728,1.68198052 C8.04187711,1.68198052 5.13172798,4.59212964 5.13172798,8.18198052 C5.13172798,11.7718314 8.04187711,14.6819805 11.631728,14.6819805 Z M11.631728,14.5814755 L11.631728,21.5814755"
                id="Combined-Shape" transform="translate(11.631728, 11.631728) rotate(-45.000000) translate(-11.631728, -11.631728) "></path>
            </g>
          </g>
        </g>
      </g>
    </svg></button></form>

Text Content

IEEE.orgIEEE Xplore Digital LibraryIEEE StandardsMore Sites
Sign InJoin IEEE


The July 2024 issue of IEEE Spectrum is here!

Download PDF ↓
Close bar
The Real Story of Stuxnet
Share
FOR THE TECHNOLOGY INSIDER
Search:
Explore by topic
AerospaceArtificial IntelligenceBiomedicalClimate TechComputingConsumer
ElectronicsEnergyHistory of
TechnologyRoboticsSemiconductorsTelecommunicationsTransportation

IEEE Spectrum
FOR THE TECHNOLOGY INSIDER



TOPICS

AerospaceArtificial IntelligenceBiomedicalClimate TechComputingConsumer
ElectronicsEnergyHistory of
TechnologyRoboticsSemiconductorsTelecommunicationsTransportation


SECTIONS

FeaturesNewsOpinionCareersDIYEngineering Resources


MORE

NewslettersPodcastsSpecial ReportsCollectionsExplainersTop Programming
LanguagesRobots Guide ↗IEEE Job Site ↗


FOR IEEE MEMBERS

Current IssueMagazine ArchiveThe InstituteThe Institute Archive


FOR IEEE MEMBERS

Current IssueMagazine ArchiveThe InstituteThe Institute Archive


IEEE SPECTRUM

About UsContact UsReprints & Permissions ↗Advertising ↗


FOLLOW IEEE SPECTRUM




SUPPORT IEEE SPECTRUM

IEEE Spectrum is the flagship publication of the IEEE — the world’s largest
professional organization devoted to engineering and applied sciences. Our
articles, podcasts, and infographics inform our readers about developments in
technology, engineering, and science.
Join IEEE
Subscribe

About IEEEContact & SupportAccessibilityNondiscrimination PolicyTermsIEEE
Privacy PolicyCookie PreferencesAd Privacy Options
© Copyright 2024 IEEE — All rights reserved. A not-for-profit organization, IEEE
is the world's largest technical professional organization dedicated to
advancing technology for the benefit of humanity.



ENJOY MORE FREE CONTENT AND BENEFITS BY CREATING AN ACCOUNT


SAVING ARTICLES TO READ LATER REQUIRES AN IEEE SPECTRUM ACCOUNT


THE INSTITUTE CONTENT IS ONLY AVAILABLE FOR MEMBERS


DOWNLOADING FULL PDF ISSUES IS EXCLUSIVE FOR IEEE MEMBERS


DOWNLOADING THIS E-BOOK IS EXCLUSIVE FOR IEEE MEMBERS


ACCESS TO SPECTRUM 'S DIGITAL EDITION IS EXCLUSIVE FOR IEEE MEMBERS


FOLLOWING TOPICS IS A FEATURE EXCLUSIVE FOR IEEE MEMBERS


ADDING YOUR RESPONSE TO AN ARTICLE REQUIRES AN IEEE SPECTRUM ACCOUNT


CREATE AN ACCOUNT TO ACCESS MORE CONTENT AND FEATURES ON IEEE SPECTRUM ,
INCLUDING THE ABILITY TO SAVE ARTICLES TO READ LATER, DOWNLOAD SPECTRUM
COLLECTIONS, AND PARTICIPATE IN CONVERSATIONS WITH READERS AND EDITORS. FOR MORE
EXCLUSIVE CONTENT AND FEATURES, CONSIDER JOINING IEEE .


JOIN THE WORLD’S LARGEST PROFESSIONAL ORGANIZATION DEVOTED TO ENGINEERING AND
APPLIED SCIENCES AND GET ACCESS TO ALL OF SPECTRUM’S ARTICLES, ARCHIVES, PDF
DOWNLOADS, AND OTHER BENEFITS. LEARN MORE ABOUT IEEE →


JOIN THE WORLD’S LARGEST PROFESSIONAL ORGANIZATION DEVOTED TO ENGINEERING AND
APPLIED SCIENCES AND GET ACCESS TO THIS E-BOOK PLUS ALL OF IEEE SPECTRUM’S
ARTICLES, ARCHIVES, PDF DOWNLOADS, AND OTHER BENEFITS. LEARN MORE ABOUT IEEE →

CREATE AN ACCOUNTSIGN IN
JOIN IEEESIGN IN
Close


ACCESS THOUSANDS OF ARTICLES — COMPLETELY FREE


CREATE AN ACCOUNT AND GET EXCLUSIVE CONTENT AND FEATURES: SAVE ARTICLES,
DOWNLOAD COLLECTIONS, AND TALK TO TECH INSIDERS — ALL FREE! FOR FULL ACCESS AND
BENEFITS, JOIN IEEE AS A PAYING MEMBER.

CREATE AN ACCOUNTSIGN IN

TelecommunicationsFeature


THE REAL STORY OF STUXNET


HOW KASPERSKY LAB TRACKED DOWN THE MALWARE THAT STYMIED IRAN’S NUCLEAR-FUEL
ENRICHMENT PROGRAM


David Kushner
26 Feb 2013
24 May 2024
11 min read
31


Illustration: Brian Stauffer
Red


Update 19 January 2024: The fabled story of the 2007 Stuxnet computer virus
continues to fascinate readers, tech enthusiasts, journalists, and lovers of a
good whodunnit mystery. So much so that the Dutch newspaper De Volkskrant
published the results of a two-year investigative effort to get to the bottom of
this sabotage cyberattack that was allegedly carried out by United States and
Israeli forces—possibly in league with intelligence agencies in both
countries—against Iran’s nuclear program.

The original article, of course, being in Dutch, computer translation software
plus the work of security journalists—for instance at Security Week—can at least
provide adept readers a glimpse of what a tangled web of deceit was woven in
this international tale of high-stakes nuclear espionage. According to the new
Dutch reporting, the mystery of how Stuxnet malware was loaded in to the Iranian
centrifuges in the first place has now been compounded. Many previous reports,
including the story that follows, assert a USB thumb drive provided the vector
to infect the Iranian systems. The Volksrant report, however, states that
according to their reporting, Stuxnet was instead loaded in to a water pump near
the Iranian Natanz nuclear facility.

Yet, as Security Week has found, researcher Ralph Langner has independently
determined that, “a water pump cannot carry a copy of Stuxnet,” as he wrote on
Twitter/X on 8 January. That, plus some counterclaims about De Volkskrant’s
estimated $1-2 billion pricetag on the effort—far too high, according to some
critics—leave the controversies and details far from fully settled. Though now
11 years on from David Kushner’s compelling account for Spectrum of the
cyberworm, below, it continues to be the kind of technothriller that can at
least keep the curious wanting to know more and the eager inspired to dig deeper
still to the ultimate core of this enduring mystery. —IEEE Spectrum







Original article from 26 February 2013 follows:

Computer cables snake across the floor. Cryptic flowcharts are scrawled across
various whiteboards adorning the walls. A life-size Batman doll stands in the
hall. This office might seem no different than any other geeky workplace, but in
fact it’s the front line of a war—a cyberwar, where most battles play out not in
remote jungles or deserts but in suburban office parks like this one. As a
senior researcher for Kaspersky Lab, a leading computer security firm based in
Moscow, Roel Schouwenberg spends his days (and many nights) here at the lab’s
U.S. headquarters in Woburn, Mass., battling the most insidious digital weapons
ever, capable of crippling water supplies, power plants, banks, and the very
infrastructure that once seemed invulnerable to attack.

Recognition of such threats exploded in June 2010 with the discovery of Stuxnet,
a 500-kilobyte computer worm that infected the software of at least 14
industrial sites in Iran, including a uranium-enrichment plant. Although a
computer virus relies on an unwitting victim to install it, a worm spreads on
its own, often over a computer network.

This worm was an unprecedentedly masterful and malicious piece of code that
attacked in three phases. First, it targeted Microsoft Windows machines and
networks, repeatedly replicating itself. Then it sought out Siemens Step7
software, which is also Windows-based and used to program industrial control
systems that operate equipment, such as centrifuges. Finally, it compromised the
programmable logic controllers. The worm’s authors could thus spy on the
industrial systems and even cause the fast-spinning centrifuges to tear
themselves apart, unbeknownst to the human operators at the plant. (Iran has not
confirmed reports that Stuxnet destroyed some of its centrifuges.)



Illustration: L-Dopa

Stuxnet could spread stealthily between computers running Windows—even those not
connected to the Internet. If a worker stuck a USB thumb drive into an infected
machine, Stuxnet could, well, worm its way onto it, then spread onto the next
machine that read that USB drive. Because someone could unsuspectingly infect a
machine this way, letting the worm proliferate over local area networks, experts
feared that the malware had perhaps gone wild across the world.

In October 2012, U.S. defense secretary Leon Panetta warned that the United
States was vulnerable to a “cyber Pearl Harbor” that could derail trains, poison
water supplies, and cripple power grids. The next month, Chevron confirmed the
speculation by becoming the first U.S. corporation to admit that Stuxnet had
spread across its machines.







Although the authors of Stuxnet haven’t been officially identified, the size and
sophistication of the worm have led experts to believe that it could have been
created only with the sponsorship of a nation-state, and although no one’s owned
up to it, leaks to the press from officials in the United States and Israel
strongly suggest that those two countries did the deed. Since the discovery of
Stuxnet, Schouwenberg and other computer-security engineers have been fighting
off other weaponized viruses, such as Duqu, Flame, and Gauss, an onslaught that
shows no signs of abating.

This marks a turning point in geopolitical conflicts, when the apocalyptic
scenarios once only imagined in movies like Live Free or Die Hard have finally
become plausible. “Fiction suddenly became reality,” Schouwenberg says. But the
hero fighting against this isn’t Bruce Willis; he’s a scruffy 27-year-old with a
ponytail. Schouwenberg tells me, “We are here to save the world.” The question
is: Does the Kaspersky Lab have what it takes?

Viruses weren’t always this malicious. In the 1990s, when Schouwenberg was just
a geeky teen in the Netherlands, malware was typically the work of pranksters
and hackers, people looking to crash your machine or scrawl graffiti on your AOL
home page.



Photo: David Yellen Cybersleuth: Roel Schouwenberg, of Kaspersky Lab, helped
unravel Stuxnet and its kin in the most sophisticated family of Internet worms
ever discovered.

After discovering a computer virus on his own, the 14-year-old Schouwenberg
contacted Kaspersky Lab, one of the leading antivirus companies. Such companies
are judged in part on how many viruses they are first to detect, and Kaspersky
was considered among the best. But with its success came controversy. Some
accused Kaspersky of having ties with the Russian government—accusations the
company has denied.

A few years after that first overture, Schouwenberg e-mailed founder Eugene
Kaspersky, asking him whether he should study math in college if he wanted to be
a security specialist. Kaspersky replied by offering the 17-year-old a job,
which he took. After spending four years working for the company in the
Netherlands, he went to the Boston area. There, Schouwenberg learned that an
engineer needs specific skills to fight malware. Because most viruses are
written for Windows, reverse engineering them requires knowledge of x86 assembly
language.

Over the next decade, Schouwenberg was witness to the most significant change
ever in the industry. The manual detection of viruses gave way to automated
methods designed to find as many as 250 000 new malware files each day. At
first, banks faced the most significant threats, and the specter of
state-against-state cyberwars still seemed distant. “It wasn’t in the
conversation,” says Liam O’Murchu, an analyst for Symantec Corp., a
computer-security company in Mountain View, Calif.

All that changed in June 2010, when a Belarusian malware-detection firm got a
request from a client to determine why its machines were rebooting over and over
again. The malware was signed by a digital certificate to make it appear that it
had come from a reliable company. This feat caught the attention of the
antivirus community, whose automated-detection programs couldn’t handle such a
threat. This was the first sighting of Stuxnet in the wild.

The danger posed by forged signatures was so frightening that computer-security
specialists began quietly sharing their findings over e-mail and on private
online forums. That’s not unusual. “Information sharing [in the]
computer-security industry can only be categorized as extraordinary,” adds Mikko
H. Hypponen, chief research officer for F-Secure, a security firm in Helsinki,
Finland. “I can’t think of any other IT sector where there is such extensive
cooperation between competitors.” Still, companies do compete—for example, to be
the first to identify a key feature of a cyberweapon and then cash in on the
public-relations boon that results.

Before they knew what targets Stuxnet had been designed to go after, the
researchers at Kaspersky and other security firms began reverse engineering the
code, picking up clues along the way: the number of infections, the fraction of
infections in Iran, and the references to Siemens industrial programs, which are
used at power plants.

Schouwenberg was most impressed by Stuxnet’s having performed not just one but
four zero-day exploits, hacks that take advantage of vulnerabilities previously
unknown to the white-hat community. “It’s not just a groundbreaking number; they
all complement each other beautifully,” he says. “The LNK [a file shortcut in
Microsoft Windows] vulnerability is used to spread via USB sticks. The shared
print-spooler vulnerability is used to spread in networks with shared printers,
which is extremely common in Internet Connection Sharing networks. The other two
vulnerabilities have to do with privilege escalation, designed to gain
system-level privileges even when computers have been thoroughly locked down.
It’s just brilliantly executed.”

Schouwenberg and his colleagues at Kaspersky soon concluded that the code was
too sophisticated to be the brainchild of a ragtag group of black-hat hackers.
Schouwenberg believes that a team of 10 people would have needed at least two or
three years to create it. The question was, who was responsible?

It soon became clear, in the code itself as well as from field reports, that
Stuxnet had been specifically designed to subvert Siemens systems running
centrifuges in Iran’s nuclear-enrichment program. The Kaspersky analysts then
realized that financial gain had not been the objective. It was a politically
motivated attack. “At that point there was no doubt that this was nation-state
sponsored,” Schouwenberg says. This phenomenon caught most computer-security
specialists by surprise. “We’re all engineers here; we look at code,” says
Symantec’s O’Murchu. “This was the first real threat we’ve seen where it had
real-world political ramifications. That was something we had to come to terms
with.”

MILESTONES IN MALWARE

1971

Creeper, an experimental self-replicating viral program, is written by Bob
Thomas at Bolt, Beranek and Newman. It infected DEC PDP-10 computers running the
Tenex operating system. Creeper gained access via the ARPANET, the predecessor
of the Internet, and copied itself to the remote system, where the message “I’m
the creeper, catch me if you can!” was displayed. The Reaper program was later
created to delete Creeper.

1981

Elk Cloner, written for Apple II systems and created by Richard Skrenta, led to
the first large-scale computer virus outbreak in history.

1986

The Brain boot sector virus (aka Pakistani flu), the first IBM PC–compatible
virus, is released and causes an epidemic. It was created in Lahore, Pakistan,
by 19-year-old Basit Farooq Alvi and his brother, Amjad Farooq Alvi.

1988

The Morris worm, created by Robert Tappan Morris, infects DEC VAX and Sun
machines running BSD Unix connected to the Internet. It becomes the first worm
to spread extensively “in the wild.”

1992

Michelangelo is hyped by computer-security executive John McAfee, who predicted
that on 6 March the virus would wipe out information on millions of computers;
actual damage was minimal.

2003

The SQL Slammer worm (aka Sapphire worm) attacks vulnerabilities in the
Microsoft Structured Query Language Server and Microsoft SQL Server Data Engine
and becomes the fastest spreading worm of all time, crashing the Internet within
15 minutes of release.

2010

The Stuxnet worm is detected. It is the first worm known to attack SCADA
(supervisory control and data acquisition) systems.

2011

The Duqu worm is discovered. Unlike Stuxnet, to which it seems to be related, it
was designed to gather information rather than to interfere with industrial
operations.

2012

Flame is discovered and found to be used in cyberespionage in Iran and other
Middle Eastern countries.

In May 2012, Kaspersky Lab received a request from the International
Telecommunication Union, the United Nations agency that manages information and
communication technologies, to study a piece of malware that had supposedly
destroyed files from oil-company computers in Iran. By now, Schouwenberg and his
peers were already on the lookout for variants of the Stuxnet virus. They knew
that in September 2011, Hungarian researchers had uncovered Duqu, which had been
designed to steal information about industrial control systems.

While pursuing the U.N.’s request, Kaspersky’s automated system identified
another Stuxnet variant. At first, Schouwenberg and his team concluded that the
system had made a mistake, because the newly discovered malware showed no
obvious similarities to Stuxnet. But after diving into the code more deeply,
they found traces of another file, called Flame, that were evident in the early
iterations of Stuxnet. At first, Flame and Stuxnet had been considered totally
independent, but now the researchers realized that Flame was actually a
precursor to Stuxnet that had somehow gone undetected.

Flame was 20 megabytes in total, or some 40 times as big as Stuxnet. Security
specialists realized, as Schouwenberg puts it, that “this could be nation-state
again.”

To analyze Flame, Kaspersky used a technique it calls the “sinkhole.” This
entailed taking control of Flame’s command-and-control server domain so that
when Flame tried to communicate with the server in its home base, it actually
sent information to Kaspersky’s server instead. It was difficult to determine
who owned Flame’s servers. “With all the available stolen credit cards and
Internet proxies,” Schouwenberg says, “it’s really quite easy for attackers to
become invisible.”

While Stuxnet was meant to destroy things, Flame’s purpose was merely to spy on
people. Spread over USB sticks, it could infect printers shared over the same
network. Once Flame had compromised a machine, it could stealthily search for
keywords on top-secret PDF files, then make and transmit a summary of the
document—all without being detected.

Indeed, Flame’s designers went “to great lengths to avoid detection by security
software,” says Schouwenberg. He offers an example: Flame didn’t simply transmit
the information it harvested all at once to its command-and-control server,
because network managers might notice that sudden outflow. “Data’s sent off in
smaller chunks to avoid hogging available bandwidth for too long,” he says.

Most impressively, Flame could exchange data with any Bluetooth-enabled device.
In fact, the attackers could steal information or install other malware not only
within Bluetooth’s standard 30-meter range but also farther out. A “ Bluetooth
rifle“—a directional antenna linked to a Bluetooth-enabled computer, plans for
which are readily available online—could do the job from nearly 2 kilometers
away.

But the most worrisome thing about Flame was how it got onto machines in the
first place: via an update to the Windows 7 operating system. A user would think
she was simply downloading a legitimate patch from Microsoft, only to install
Flame instead. “Flame spreading through Windows updates is more significant than
Flame itself,” says Schouwenberg, who estimates that there are perhaps only 10
programmers in the world capable of engineering such behavior. “It’s a technical
feat that’s nothing short of amazing, because it broke world-class encryption,”
says F-Secure’s Hypponen. “You need a supercomputer and loads of scientists to
do this.”

If the U.S. government was indeed behind the worm, this circumvention of
Microsoft’s encryption could create some tension between the company and its
largest customer, the Feds. “I’m guessing Microsoft had a phone call between
Bill Gates, Steve Ballmer, and Barack Obama,” says Hypponen. “I would have liked
to listen to that call.”

While reverse engineering Flame, Schouwenberg and his team fine-tuned their
“similarity algorithms”—essentially, their detection code—to search for variants
built on the same platform. In July, they found Gauss. Its purpose, too, was
cybersurveillance.

Carried from one computer to another on a USB stick, Gauss would steal files and
gather passwords, targeting Lebanese bank credentials for unknown reasons.
(Experts speculate that this was either to monitor transactions or siphon money
from certain accounts.) “The USB module grabs information from the system—next
to the encrypted payload—and stores this information on the USB stick itself,”
Schouwenberg explains. “When this USB stick is then inserted into a
Gauss-infected machine, Gauss grabs the gathered data from the USB stick and
sends it to the command-and-control server.”

Just as Kaspersky’s engineers were tricking Gauss into communicating with their
own servers, those very servers suddenly went down, leading the engineers to
think that the malware’s authors were quickly covering their tracks. Kaspersky
had already gathered enough information to protect its clients against Gauss,
but the moment was chilling. “We’re not sure if we did something and the hackers
were onto us,” Schouwenberg says.

The implications of Flame and Stuxnet go beyond state-sponsored cyberattacks.
“Regular cybercriminals look at something that Stuxnet is doing and say, that’s
a great idea, let’s copy that,” Schouwenberg says.

“The takeaway is that nation-states are spending millions of dollars of
development for these types of cybertools, and this is a trend that will simply
increase in the future,” says Jeffrey Carr, the founder and CEO of Taia Global,
a security firm in McLean, Va. Although Stuxnet may have temporarily slowed the
enrichment program in Iran, it did not achieve its end goal. “Whoever spent
millions of dollars on Stuxnet, Flame, Duqu, and so on—all that money is sort of
wasted. That malware is now out in the public spaces and can be reverse
engineered,” says Carr.

Hackers can simply reuse specific components and technology available online for
their own attacks. Criminals might use cyberespionage to, say, steal customer
data from a bank or simply wreak havoc as part of an elaborate prank. “There’s a
lot of talk about nations trying to attack us, but we are in a situation where
we are vulnerable to an army of 14-year-olds who have two weeks’ training,” says
Schouwenberg.

The vulnerability is great, particularly that of industrial machines. All it
takes is the right Google search terms to find a way into the systems of U.S.
water utilities, for instance. “What we see is that a lot of industrial control
systems are hooked up to the Internet,” says Schouwenberg, “and they don’t
change the default password, so if you know the right keywords you can find
these control panels.”

Companies have been slow to invest the resources required to update industrial
controls. Kaspersky has found critical-infrastructure companies running
30-year-old operating systems. In Washington, politicians have been calling for
laws to require such companies to maintain better security practices. One
cybersecurity bill, however, was stymied in August on the grounds that it would
be too costly for businesses. “To fully provide the necessary protection in our
democracy, cybersecurity must be passed by the Congress,” Panetta recently said.
“Without it, we are and we will be vulnerable.”

In the meantime, virus hunters at Kaspersky and elsewhere will keep up the
fight. “The stakes are just getting higher and higher and higher,” Schouwenberg
says. “I’m very curious to see what will happen 10, 20 years down the line. How
will history look at the decisions we’ve made?”




THIS ARTICLE IS FOR IEEE MEMBERS ONLY. JOIN IEEE TO ACCESS OUR FULL ARCHIVE.

Join the world’s largest professional organization devoted to engineering and
applied sciences and get access to all of Spectrum’s articles, podcasts, and
special reports. Learn more →

If you're already an IEEE member, please sign in to continue reading.
BECOME A MEMBERSIGN IN


MEMBERSHIP INCLUDES:

 * Get unlimited access to IEEE Spectrum content
 * Follow your favorite topics to create a personalized feed of IEEE Spectrum
   content
 * Save Spectrum articles to read later
 * Network with other technology professionals
 * Establish a professional profile
 * Create a group to share and collaborate on projects
 * Discover IEEE events and activities
 * Join and participate in discussions




word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word

mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1