Slashdot Mirror
Stuxnet Worm May Have Targeted Iranian Reactor
yuna49 writes "Analysis of the Stuxnet worm suggests its target might have been Iran's nuclear program. "Last week Ralph Langner, a well-respected expert on industrial systems security, published an analysis of the Stuxnet worm, which targets Siemens software systems, and suggested that it may have been used to sabotage Iran's Bushehr nuclear reactor. A Siemens expert, Langner simulated a Siemens industrial network and then analyzed the worm's attack. Experts had first thought that Stuxnet was written to steal industrial secrets, but Langner found something quite different. The worm actually looks for very specific Siemens settings — a kind of fingerprint that tells it that it has been installed on a very specific Programmable Logic Controller (PLC) device — and then it injects its own code into that system."
Sounds eerily similar to the Siberian Pipeline explosion but, had it actually worked, the consequences could have been much much worse.
Looks like national cyber security is about to get a much higher priority than copyright protection.
One of the most effective ways to penetrate a company is to drop a couple of USB sticks in their parking lot with some "special" autoinstalled software. Someone sees it, picks it up, takes it in side and plugs it in to see what's on it. A few boring things, maybe a naked picture of someone, and a rootkit.
I've worked for a couple of companies which have had security audits performed on them that included hiring outside firms to do "social engineering" penetration tests to see how good the employees are about that sort of thing. It's strange... someone who won't be fooled by "we're from IT and need your password" sweet-talk and who would never open an attachment to an email will happily stuff a flash drive into their computer. The penetration testing firms tell me they almost always get a hit with the USB drive trick. (And, for the record, one of my companies passed the test, 100%. Woot! Let's not talk about the other, though...)
So yeah, physical devices > air-gap.
Everybody gets what the majority deserves.
Iran wants to provoke a conflict with Israel. It doesn't want to start one. There is apparently an Islamic sect that believes in their version of Rapture and they believe it will be triggered by Israel's attack on Iran. Iran cannot be the aggressor here - that's the belief at least. Iran will then be saved by the 12th Imam. And that's the Islamic version of Rapture.
"Our revolution's main mission is to pave the way for the reappearance of the 12th Imam, the Mahdi," Ahmadinejad said in the speech to Friday Prayers leaders from across the country.
http://analysis.threatswatch.org/2005/11/understanding-ahmadinejad/
There are a number of crazzy sites that "predict" stuff about him,
http://www.satansrapture.com/hitler2.htm
"Bush said: 'God said to me, attack Afghanistan and attack Iraq.' The mentality of Mr. Bush and Mr. Ahmadinejad is the same here - both think God tells them what to do," says Mr. Mohebian, noting that end-of-time beliefs have similar roots in Christian and Muslim theology."
http://www.csmonitor.com/2005/1221/p01s04-wome.html
Iran will not start hostilities :)
I'm still having a problem with......why ANY nuclear reactor or power plant needs to be directly connected to a computer network. I can see it having say a USB port for upgrades of controller firmware but a network connection? Nope.
So you're saying that you can't see any use for having the two reactors on site both connected to the same control room? I mean, why the hell would people in one central location want to monitor both reactors at once, in real time, right? That's crazy!
What do you think, that when someone needs to shut down or modify the parameters of a reactor or centrifuge that they actually walk up to the component and hit a button on it? What if they need to start 100 centrifuges at the same time, do they have 100 technicians standing there all on a giant conference call waiting for the "go" signal? If they want to check the current core temps or fuel levels, what do they do, call each one and ask them what the gauge says? What the hell do you think all of this equipment is for:
http://www.upi.com/News_Photos/Features/The-Nuclear-Issue-in-Iran/1581/19/
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
It is the developer's tools available.
The 'mission critical control system' in this case is a PLC, which directly controls the equipment. It doesn't even require that any consumer computer be involved for that to happen, although they often are to provide for data collection or operator interfaces or the like.
But to get the PLC to control the hardware a person has to write logic for it, which was probably done in this case with Simatic S7, which is Windows only. The bulk of the above mentioned interface and data collection packages are Windows only as well.
With a good design an industrial control system, because it is the PLC that does the work, will run along just fine even if PC based nodes crash. The new development with Stuxnet is that the virus is running on the PLC itself.
"Sacrifice for the good of The State" - The State
Which makes sense. If those guys aren't total retards, the control PC is airgapped from the Internet, it might be on a secure LAN (as secure as they can be with Windows machines on them) but most likely airgapped. So your most probable method of infection is via flash drives.
Now the nuclear facility is going to have guards so you release it somewhere that it will get on an engineer's PC - on their home file server from the sidewalk, send them an email to a site that will do a drive-by download, or ideally you social-engineer them into letting you switchblade their laptop (if the engineer is a guy (99% chance), pay a classy hooker to dress up nice, flirt with the guy, say she's an aspiring model and give him a flash drive with her "portfolio" containing some hastily snapped photos so it looks legit...you'd plug it in too, but you'd be more careful than someone without an IT/CompSci background). From there the virus is programmed to spread over USB storage so all you can do is hope and wait, and hopefully the virus reaches the target machine before people notice the outbreak...so you make the virus as unnoticeable as possible.
And the Stuxnet worm was first discovered in Iran and went unnoticed for a long time...
"When information is power, privacy is freedom" - Jah-Wren Ryel
Eventually.
According to many sources, at the first stages of the war though, there was panic at the top. So much in fact that the nuclear option was seriously considered. Read about it, fascinating subject.
What everyone including parent post has so far overlooked is that the announcement of this story is ALL BY ITSELF damaging to the Iran nuclear development effort.
Whatever the goal of Stuxnet might be, Iran must now spend time and effort checking whether all kinds of computer control systems include hidden time bombs... things that might do anything from overspinning centrifuges until they break to overheating core enough to warp the fuel rods and force their replacement. And the only sure way that Iran can proceed from this point is to replace all the PLCs with homegrown technology... but it would take them a decade or more to develop that technology on their own. I don't think they have any microchip manufacturing capability at all.
All this has been accomplished at the very low cost of publicizing a few factoids within a very suggestive framing in such a way that third parties are going to fall all over themselves to do further investigation in ways that can only magnify the perceived risks. This is a perfect con game. The more so because even if someone comes out and says its a con, Iran cannot afford to rely on that. Stuxnet might not even have a payload, but it will still cause the Iran nuclear effort months of delay. Long enough, probably, to lay the groundwork for Son Of Stuxnet, whatever that might be.
Will