Why did Stuxnet have command and control servers?

Question

I am currently reading Countdown to Zero Day which, amongst other things, describes Stuxnet in lay terms. It states that Stuxnet could report to two command and control servers.

Most basic definitions say command and control servers allow a hacker to communicate with or through the malware that's phoned home and as such they can do mischief on the infected machine.

If the Natanz facility was the only target of interest and if it was air gapped then you can't do any of this. Furthermore, Stuxnet was self sufficient in its objective - it didn't need any further interaction once it had found a suitable target.

Other than being made aware of when the cat is out of the bag, why would a hacker need command and control servers for malware that primarily shouldn't have ever made it on to the internet?

Answer 1

You have 2 questions here. Let's start with the basic one:

Why did Stuxnet have command and control servers if it was supposed to infect airgapped computers

The CC servers had multiple functions, which is mentioned in the same book your reading if I remember right:

1: Kill Switch. The entire operation could be killed with a kill switch on those servers in case of incident.

2: Time verification: the CC servers updated the time for the stuxnet virus so it wouldn't get confused and shut down (it had multiple kinds of timers built in)

3: Tracking, which is probably the main reason. These servers allowed for the monitoring of the spread of the infection.

4: Other metric collection.

5: Version control. Yes, when a new version of stuxnet was released the CC servers literally told the old version to destroy itself.

Question 2:

why would a hacker need command and control servers for malware that primarily shouldn't have ever made it on to the internet?

They wouldn't. Stuxnet's original intention was mass infection. 70% of computers in Iran were infected. The hope was to infect the country so effectively that they were insured of a worker bringing in a flash drive with it. If the goal had been a one off sneaker kit drop it's much, much, less likely it would have CC servers.