Slashdot Mirror
Stuxnet Worm May Have Targeted Iranian Reactor
yuna49 writes "Analysis of the Stuxnet worm suggests its target might have been Iran's nuclear program. "Last week Ralph Langner, a well-respected expert on industrial systems security, published an analysis of the Stuxnet worm, which targets Siemens software systems, and suggested that it may have been used to sabotage Iran's Bushehr nuclear reactor. A Siemens expert, Langner simulated a Siemens industrial network and then analyzed the worm's attack. Experts had first thought that Stuxnet was written to steal industrial secrets, but Langner found something quite different. The worm actually looks for very specific Siemens settings — a kind of fingerprint that tells it that it has been installed on a very specific Programmable Logic Controller (PLC) device — and then it injects its own code into that system."
Sounds eerily similar to the Siberian Pipeline explosion but, had it actually worked, the consequences could have been much much worse.
There's one non-secular country in the world that is famous for it's disregard for anyone but itself and its fundamentalist religious belief in their own specialness in the eyes of their own god, which they believe justifies their evil actions.
The truth is some evil people will do anything for wealth and power.
Brilliant - let's get one up on the Iranians by messing with their nuclear reactor controls! What could possibly go wrong?
If true, this is reckless endangerment, and the people involved - government-backed or lone wolves - should be prosecuted. Just because the Iranian government is full of militaristic and theocratic jerks does not give anyone the right to endanger the lives of any old (or young) person living or working in and around that facility. Indeed, it's the kind of stunt that can only push their ruling class farther into paranoia and fear, the kind tha leads to... nuclear weapons development.
Someday, you're going to die. Get over it.
And Iran is probably going to blame Israel and then the shit hits the fan and it's WWIII. And we're all dead. Seriously, this is the kind of stuff that gives me ulcers.
My postings are informational and does not constitute legal advice. Act on it at your risk.
The worms in the reactor will eat the fuel rods, become radioactive, mutate, and destroy/dominate the world!
* Preemptive defense against the person who will take this post seriously: I realize most mutations have no significant effect, most of the remainder are harmful, and the chances of a slightly beneficial mutation, let alone a highly beneficial mutation is highly negligible. This post is for humor sake only.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
Looks like national cyber security is about to get a much higher priority than copyright protection.
Why in the Hell is Iran connecting their nuclear reactor to the Internet???
Either Iran is unbelievably stupid, or they've got some blindingly incompetent IT people working at that plant. And considering the international attention that plant is getting, you'd imagine that any incompetent operators would have been sent into the desert to look for minefields while wearing clown shoes long ago.
[End Of Line]
Ugh, what a terrible article. There's no firm conclusions at all, just mindless speculation. Here's some gems: "The only thing I can say is that it is something designed to go bang" and "'If I had to guess what it was, yes that's a logical target' he said, 'but that's just speculation'"
This could be an interesting topic, but unfortunately, it is turned into a pointless article spewing wild guesses. And the findings are to be submitted in a closed door security meeting? WTF? I guess we'll never know.
I have programmed many PLC's in my day, but unfortunately not Siemens. Does anyone have experience with siemens that can comment on the mysterious operational block 35?
Siemens PLCs are everywhere. Same with GE and others. They run everything from nuke plants to little benchtop lathes and aerospace applications. How this person decided that it *had* to be the Iranian nuke plant baffles me.
How does he know that it wasn't targeted at various military targets? Iranian medium and short range missile installations also come to mind. Does he *have* the Siemens PLC configuration from the nuke plant in his hot little hands? Or does he even have the model numbers?
Reading TFA, no.
Peterson believes that Bushehr was possibly the target. "If I had to guess what it was, yes that's a logical target," he said. "But that's just speculation."
Well, there you go. Nothing to see here.
That's not to say that actual cyber-warfare is not happening, but to come out with wild-ass speculation and present it as newsworthy reminds me of Fox "News" and the rest of the Murdoch "empire."
--
BMO
There's one non-secular country in the world that is famous for it's disregard for anyone but itself and its fundamentalist religious belief in their own specialness in the eyes of their own god, which they believe justifies their evil actions.
Fundamentalist Muslims are not limited to one country.
Intolerance isn't exactly limited to borders drawn on a map...
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
I'm still having a problem with......why ANY nuclear reactor or power plant needs to be directly connected to a computer network. I can see it having say a USB port for upgrades of controller firmware but a network connection? Nope.
So you're saying that you can't see any use for having the two reactors on site both connected to the same control room? I mean, why the hell would people in one central location want to monitor both reactors at once, in real time, right? That's crazy!
What do you think, that when someone needs to shut down or modify the parameters of a reactor or centrifuge that they actually walk up to the component and hit a button on it? What if they need to start 100 centrifuges at the same time, do they have 100 technicians standing there all on a giant conference call waiting for the "go" signal? If they want to check the current core temps or fuel levels, what do they do, call each one and ask them what the gauge says? What the hell do you think all of this equipment is for:
http://www.upi.com/News_Photos/Features/The-Nuclear-Issue-in-Iran/1581/19/
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
That's because it does. You just need to be a *little* slyer. (Not much.)
This is one point where it really does matter what the target OS is. If your USB is vfat, then you can't have allow execute set to true. But if you use a properly targeted file system (say ext3), then you can set execution permissions. Or even just make it a tar.gz file, and when it's expanded, it ends up with execute permissions set. So you open a jpeg, and actually execute a script that opens the jpeg while executing something else in the background.
(Allowing tar files so set the execute permission is a big weakness...and a vast convenience. But that should require running a separate script or chmod with root permissions.)
I think we've pushed this "anyone can grow up to be president" thing too far.
It is the developer's tools available.
The 'mission critical control system' in this case is a PLC, which directly controls the equipment. It doesn't even require that any consumer computer be involved for that to happen, although they often are to provide for data collection or operator interfaces or the like.
But to get the PLC to control the hardware a person has to write logic for it, which was probably done in this case with Simatic S7, which is Windows only. The bulk of the above mentioned interface and data collection packages are Windows only as well.
With a good design an industrial control system, because it is the PLC that does the work, will run along just fine even if PC based nodes crash. The new development with Stuxnet is that the virus is running on the PLC itself.
"Sacrifice for the good of The State" - The State
This could be an interesting topic, but unfortunately, it is turned into a pointless article spewing wild guesses.
yeah, the writer should have called up the Mossad, and asked to talk to the author so he could get some solid facts...
Really, what do you expect from a story about what is obviously a covert operation?
HA! I just wasted some of your bandwidth with a frivolous sig!
this was a high-level inside hack. somebody is going to go missing. where they came from or end up will tell you who really orchestrated this one.
oh, and by the way, note that it was a broadcast inside hack, going all over Iran and elsewhere to get to the prize.
tells you two things. one, Iran has the nuclear stuff very highly compartmented. the originators did not have access to ring 0 of the secret program despite presumably working for the contractor.
two, there should not be any commodity stuff hanging on the side of any sensitive system. the worm got all over because there were Best Buy laptops running open market software.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Maybe instead of bombing them or infecting them with a worm, we should notify MS and the BSA that Iran is using pirated copies of windows in their nuclear program. The subsequent audit will slow their nuke operation to a crawl!
I prefer rogues to imbeciles because they sometimes take a rest.
The Bushehr reactor is operated under an international agreement, allowing Iran to operate it and generate power, but keeping the fuel under control of Russia. This was negotiated in order to allow Iran the capability to operate power generating facilities but keep the fuel cycle under control, avoiding diversion to weapons development.
If anyone (outside of Iran) gets caught sabotaging the reactor, it supports Iran making the argument that outside powers (under control of the West and/or Israel) can't be trusted. It is in our best interests to see this plant suceed. It will support the idea Iran can deal sucesfully with the IAEA and others in the development of nuclear power facilities and medical uses.
Have gnu, will travel.
Dude, Israel is not *that* evil. They just like poking the Palestinians with a stick by building settlements.
They just like pissing off the rest of the Middle East by existing.
The higher the technology, the sharper that two-edged sword.
What everyone including parent post has so far overlooked is that the announcement of this story is ALL BY ITSELF damaging to the Iran nuclear development effort.
Whatever the goal of Stuxnet might be, Iran must now spend time and effort checking whether all kinds of computer control systems include hidden time bombs... things that might do anything from overspinning centrifuges until they break to overheating core enough to warp the fuel rods and force their replacement. And the only sure way that Iran can proceed from this point is to replace all the PLCs with homegrown technology... but it would take them a decade or more to develop that technology on their own. I don't think they have any microchip manufacturing capability at all.
All this has been accomplished at the very low cost of publicizing a few factoids within a very suggestive framing in such a way that third parties are going to fall all over themselves to do further investigation in ways that can only magnify the perceived risks. This is a perfect con game. The more so because even if someone comes out and says its a con, Iran cannot afford to rely on that. Stuxnet might not even have a payload, but it will still cause the Iran nuclear effort months of delay. Long enough, probably, to lay the groundwork for Son Of Stuxnet, whatever that might be.
Will