Stuxnet Worm Claimed To Be Devastating In Iran

sciencewatcher writes "At debka.com, a website associated with intelligence communities focusing on the Middle East, the claim is made that Tehran this week secretly appealed to a number of computer security experts in West and East Europe with offers of handsome fees for consultations on ways to exorcise the Stuxnet worm spreading havoc through the computer networks and administrative software of its most important industrial complexes and military command centers."

Comments

So what's the word, people.

[Pojut]

Do you think the US did this in an official capacity, an "official" capacity, or had nothing to do with it?

Re:So what's the word, people.

[Anonymous Coward]

No, they didn't. Proof: it worked.

Re:So what's the word, people.

[Bert64]

Doesn't really matter either way...

Iran was grossly negligent in allowing their critical infrastructure to run on software controlled by a hostile government (and which they most likely had to pirate because there are export restrictions against iran).

Re:So what's the word, people.

[Randle_Revar]

If Stuxnet is attacking Iran, I'd bet on Israel (just) ahead of the US.

Re:So what's the word, people.

[davev2.0]

I think Iran did it to themselves.

Re:So what's the word, people.

[xaxa]

(and which they most likely had to pirate because there are export restrictions against iran).

For the US -- there's nothing stopping me selling computer software to Iran, unless that software is of military/nuclear/etc use (you can see the full details of what's not allowed here (the PDF)).

Re:So what's the word, people.

[John Hasler]

So would I, but I'd put Israel way ahead. However, I don't discount the possibility that no government was involved.

Re:So what's the word, people.

[Trevelyan]

It's more likely to have been Israel.

For example this story, note that its from 2009 but still make a pretty good description of how stuxnet works. Google or following the links on stuxnet news stories will bring up other possible links to Israel.

Re:So what's the word, people.

[Darkness404]

...Except for the fact that encryption software is often times classified as "military" technology, making the distribution of most software impossible.

Re:So what's the word, people.

[chill]

Crypto in U.S. law was removed from the munitions classification back in 1996 by then President Clinton.

Shortly thereafter one of the exemptions granted was for open source. If the source code was freely available, you don't need an export license.

Re:So what's the word, people.

[gyranthir]

For the US, Cuba, Iran, Syria, Libia and a bunch of other countries are under an embargo, where american companies cannot export to them...

Re:So what's the word, people.

[Hijacked Public]

So they should have built their own software to run on S7 PLCs? What country that you know of does that? Do you know of any country that does? If so name them, because I've been to dozens and never seen anything of the sort.

They could have probably run a lot of their automation with relay logic, but at a significantly increased cost.

Re:So what's the word, people.

[NatasRevol]

Well given that they're running Windows for critical infrastructure & military command centers - apparently without AV, I'd say that yes, they did do it to themselves.

Re:So what's the word, people.

[rootchick]

Maybe it was extraterrestrials: http://www.americanchronicle.com/articles/view/188021

Re:So what's the word, people.

[bsDaemon]

Clinton issued an executive order placing cryptographic software under the dominion of the Commerce Department with regards to export, and the Commerce Department simplified export rules to make things easier. However, they can always take it back, its not law, just policy.

Re:So what's the word, people.

[rtb61]

The catch with the whole theory of a software hack, the stuxnet worm is far too tightly tied to Iran, hardware is far more likely to be the culprit rather than software. So hardware infrastructure in Iran, well if it was sourced from China or Russia likely safe, except of course in companies head quartered elsewhere were involved.

So access to windows source and Siemens PLC seems a must, so the really only leaves two suspects. Now if the worm in industrials plants result of industrial accidents that kill people, then clearly it would be an act of war, which would be pretty stupid because there are far more effective means of crippling infrastructure with far more primitive methods.

Re:So what's the word, people.

[MyLongNickName]

You might want to read about a similar feat performed by the U.S. Government here

Re:So what's the word, people.

[MyLongNickName]

The issuing of executive orders (i.e. making law) is unconstitutional.

Some people have this opinion. However, that has not been the position of the courts or congress. in fact this practice has happened since at least the beginning of the nineteenth century (possibly 18th as well... they didn't keep records of exec orders until mid 20th century I think). Thus the rest of your statement is meaningless.

Re:So what's the word, people.

[John Hasler]

> So access to windows source and Siemens PLC seems a must...

I see no need for access to Windows source, and anyone can buy the Siemens hardware.

Re:So what's the word, people.

[GooberToo]

So access to windows source and Siemens PLC seems a must, so the really only leaves two suspects.

Actually, access to Window's source absolutely does not seem a must. But regardless, obtaining it is likely trivial. I know I've seen references to it on the net before. Any student and/or spy attending any number of various universities have access to it. Accordingly, it has been periodically freed on the Internet.

You're also missing the fact that Iranians themselves have reason to do this type of thing. Iranians, on average, are far more educated than the average American. Lots work in industry. They likely have no shortage of people who are fully capable and qualified to pull off such worms. Not to mention, politically speaking, they have almost endless justification.

If you want to be honest about it, the Iranian people themselves are the number one group which have reasons to pull this off. Next are the Israelis, followed by other surrounding Arab nations, Europe, and then lastly the US, followed by lots of smaller, less interested parties.

People seem to be in a hurry to forget that with the fall of Iraq, Iran now has center stage for regional power and authority. This is absolutely not acceptable to other Arab countries in the region.

Re:So what's the word, people.

[Anonymous Coward]

(and which they most likely had to pirate because there are export restrictions against iran).

For the US -- there's nothing stopping me selling computer software to Iran, unless that software is of military/nuclear/etc use (you can see the full details of what's not allowed here (the PDF)).

Iran is deemed a "State Sponsor of Terrorism" - http://www.state.gov/s/ct/c14151.htm
http://en.wikipedia.org/wiki/Sanctions_against_Iran

If you sell ANY software to Iran that they *could* then use in their supposed nuclear or ballistic weapons programs, you are fucked. Sure, you can argue your TODO List reminder program is benign, but heck, can you counter that it *could* be used to keep the U235 enrichment on target?? Are you willing to spend next 20 years in jail for that?

For the US,
    1. Iran is a state sponsor of terrorism (Hezbolah being one)
    2. Iran wants to develop nuclear capability
    3. Iran is under UN sanctions preventing and restricting sales of dual-use equipment, software and processes.

I suspect the only computer expects Iran will be talking to will be either,
    1. threatened or put in jail for violating UN sanctions, or
    2. be foreign intelligence officers

Re:So what's the word, people.

[nedlohs]

Microsoft is an American company. Hence, US export restrictions apply to Microsft Windows - irrespective of where you happen to be.

Microsoft can't export it, and others can't buy it from Microsoft and then export it to Iran without also violating US law. Now those non-US folk mightn't care about that (though once the US supplier finds out they can't keep legally keep supplying), but it does violate the licensing on the software from Microsoft and hence all copies of Microsoft Windows do not have valid licenses which makes them pirated software by definition.

Re:So what's the word, people.

[bsDaemon]

So... its unconstitutional for the Chief Executive to issue an Executive Order to Executive Branch agencies, telling them how he thinks they should act, within their Legislatively mandated authority to craft details of policy implementation within the scope of the legislation in question?

Just because its a bitch move doesn't make it unconstitutional.

Re:So what's the word, people.

[divisionbyzero]

Now if the worm in industrials plants result of industrial accidents that kill people, then clearly it would be an act of war, which would be pretty stupid because there are far more effective means of crippling infrastructure with far more primitive methods.

Not if it is built into the side of a mountain, like, say, a nuclear fuel processing plant.

Re:So what's the word, people.

[penix1]

The issuing of executive orders (i.e. making law) is unconstitutional.

You are 100% wrong.

http://legal-dictionary.thefreedictionary.com/Executive+Order

I refer you to the following:

Absent specific statutory authority, an executive order may have the force and effect of law if Congress has acquiesced in a long-standing executive practice that is well-known to it. For example, in Dames v. Regan, 453 U.S. 654, 101 S. Ct. 2972, 69 L. Ed. 2d 918 (1981), the U.S. Supreme Court upheld various executive orders that suspended claims of U.S. nationals arising out of the Iranian hostage crisis, citing Congress's Acquiescence in a 180-year-old practice of settling U.S. citizens' claims against foreign governments by executive agreement.

That is settled law, in short, the law of the land. And...

Executive orders also may be authorized by the president's independent constitutional authority (Cunningham v. Neagle, 135 U.S. 1, 10S. Ct. 658, 34 L. Ed. 55 [1890]). Various clauses of the U.S. Constitution have been cited to support the issuance of executive orders. Among them are the Vestiture Clause, which states, "The executive Power shall be vested in a President of the United States of America" (art. II, 1, cl. 1); the Take Care Clause, which states that the president "shall take Care that the Laws be faithfully executed" (art. II, 3); and the Commander in Chief Clause, which states that the president "shall be Commander in Chief of the Army and Navy of the United States, and of the Militia of the several States, when called into the actual Service of the United States" (art. II, 2, cl. 1).

Even though they are executive policies, they still carry the weight of law.

Re:So what's the word, people.

[DavidTC]

Um, no.

The executive branch was granted the power, by Congress, to make rules and regulations about exporting munitions. Previous administrations put the entirety of that power under the State Department, which had really strict rules. Clinton's order just move encryption under the Commerce Department instead of the State Department, and the Commerce Department is a lot less paranoid. (Other munitions are still under State.)

I love how people have heard about Bush's illegal signing statements, learn they are like 'executive orders', and now presume all executive orders are illegal.

Executive orders, and signing statements, (which are just executive orders that get carried along with bills), are mostly used for the president to decide things that are left for him to decide under the law.

Congress gives the President a budget and the power to do something, he signs the bill and writes an executive order (Or attaches a signing statement to the bill as he signs it, so it will always be with that bill.) making an Office of Doing That Thing in the Department of Whatever, and gives them the money.

Executive orders are just public statements of policy that the executive branch must follow, they are not 'laws', and they move power around within the executive, they don't give the executive any power.

Bush, of course, did a lot of nonsense, things like signing a bill into law and, at the same time, asserting that no one has to follow it. This was obviously bad.

But you really need a basic civics lesson about how the executive works and about how Congress gives it powers. Very often, Congress gives 'regulatory power' over things to the executive, along with a few specific regulations, and the executive branch is in charge of figuring all that out, because you don't want the damn Congress figuring out licensing fees from a Chicago TV station or what roads to build in a national forest. Congress gives the executive branch the power to figure that out, and the President writes orders putting that power under the FCC or the National Parks Service.

Of course, often Congress does specify where in the executive branch things go, and even creates new offices, which the president cannot override. This is generally frowned upon at levels lower than cabinet positions....Congress creates the top level Departments, and maybe one level below that, but generally shouldn't be micromanaging within the offices, as it makes any sort of reorganization difficult. I.e., they create the Department of Homeland Security, and put the FBI (and others) within it, and assign specific crimes for the FBI to handle...but they shouldn't really be creating offices in the FBI to handle those crimes. (Because, over time, crimes change, and the FBI might find itself with one nearly empty office and one overworked one. I mean, at one time it would have made sense to have a 'train robbery' division.)

Congress can do that, though, legally. They just shouldn't, and don't, so it's up to the president to issue executive orders.

Re:So what's the word, people.

[Dare nMc]

built their own software to run on S7 PLCs

To be fair, were not at a hostile level with Germany, so we may not have the same level of concern, for a foreign based software ownership (Siemiens)

It is fair to say the PLC's don't have to be always accessible from windows computers, Can be disconnected after verified... That connection is likely for SCADA (data logging/monitoring protocol to the S7), which is available for other operating systems.

A quick search shows these guys, among others:
http://www.modcomp.com/scada/scada_app.html

So it does seam for critical infrastructure they should have done a better job of hiding the foreign (and closed) software behind non foreign software (or completely disconnected from it.)

Re:So what's the word, people.

[thegameiam]

well said, with very minor nitpick: s/other Arab/Arab/ - whether Iraq is an Arab country (or Persian country) depends on who you ask, but I don't know of anyone with any knowledge of Iranian history who would call Iran an Arab country.

I have no knowledge of who's responsible for the worm, but Steve Bellovin wrote about it very intelligently.

Re:So what's the word, people.

[penix1]

Of course, often Congress does specify where in the executive branch things go, and even creates new offices, which the president cannot override. This is generally frowned upon at levels lower than cabinet positions....Congress creates the top level Departments, and maybe one level below that, but generally shouldn't be micromanaging within the offices, as it makes any sort of reorganization difficult. I.e., they create the Department of Homeland Security, and put the FBI (and others) within it, and assign specific crimes for the FBI to handle...but they shouldn't really be creating offices in the FBI to handle those crimes. (Because, over time, crimes change, and the FBI might find itself with one nearly empty office and one overworked one. I mean, at one time it would have made sense to have a 'train robbery' division.)

Funny you should bring up Homeland Security. That bill was the most God awful piece of crap that they landed in the Executive Branches lap that has ever come out of Congress.

http://www.dhs.gov/xlibrary/assets/hr_5005_enr.pdf

Just look through the table of contents and you can see the Congressional micro-management going on. I remember the change, being in FEMA at the time, and it was terrible to endure. That bill needs to be revisited to remove FEMA from DHS for many reasons (including waste, fraud and abuse) and given a much smaller budget. It needs to become a coordinating agency between federal, state and local law enforcement agencies and the intelligence gathering communities. DHS needs to get out of the disaster business. DHS raiding of FEMA money and more importantly staff resources is a big part of why they are flailing about ineffectually on just about every disaster they try to run.

Another reason the agency is impotent is the micro-management Congress has enforced on this agency through this bill. DHS is a paranoid and schizophrenic agency. It is fragmented into so many compartments it is little wonder why they are ineffective.

why don't they

[Anonymous Coward]

why don't they just use firefox instead of ie??

Re:why don't they

[Ant P.]

Or computer systems certified for safety-critical installations, instead of Windows which flat out says not to use it for that in the EULA?

Re:why don't they

[Hijacked Public]

You don't understand industrial control systems. It isn't Windows that does any safety-critical controlling, it is a PLC, which is the target of Stuxnet's payload. Stuxnet just happens to use Windows to propagate, which is a good choice because nearly all PLC programming and interface software is Windows only. Anyone this telented could have written a Linux worm that did the same thing, but it would have been ineffective because Linux is hardly ever connected to a Siemens PLC. Windows being a bottomless pit of zero days doesn't help, of course.

I guess...

[Anonymous Coward]

...it really stux to be iranian.

Anyone else find that site a litte skeevy?

[SlappyBastard]

I'm not a fan of quoting anything from a website whose motto is "We start where the media stop".

Re:Anyone else find that site a litte skeevy?

[Are You Kidding]

The observation is well taken. Prior to the Iraq war, Debka had a series of stories from "inside sources" who said that Sadam had constructed vast underground bunkers in the desert in which he had hidden his weapons of mass destruction. It is hard to tell whether a story on Debka is intelligence or propaganda.

Re:Anyone else find that site a litte skeevy?

[couchslug]

Getting technical information from Debka is like getting your foreign affairs info from the New York Daily News.

Perhaps it's just me...

[d3ac0n]

But I'm having a really hard time getting upset over the Iranian government being brought to a crawl by a computer virus. These ARE the same people that have made no bones about wanting to commit genocide against all Jews, and have tortured and murdered millions of their own people.

Personally, I hope it causes a total collapse. Perhaps then the Green Revolution people (those that are still alive, anyway) can have a chance at creating a true Democracy in Persia. The Persian people certainly deserve it.

What DOES worry me is that this is, in some ways, a "genie out of the bottle" moment. Formal "Weaponized" use of a computer virus to attack a state. While I'm sure it was inevitable, it is still a bit of a shock to know that the day has arrived.

All the more reason to be sure to be using a variety of redundant and disparate OS types to support your infrastructure I guess.

Re:Perhaps it's just me...

[elrous0]

If a virus like this were to succeed in its apparent goals (reeking havoc on the Natanz enrichment facility, or worse, the new Bushehr nuclear power plant) it could potentially cause an accident that could kill a LOT of innocent people. It had the very real capacity to send the reactors at Bushehr into meltdown. And I'm pretty sure the people who live around that facility had nothing to do with genocide against the Jews (nor have most Iranians ever fired so much as a shot against Israel).

Re:Perhaps it's just me...

[Iphtashu Fitz]

Any modern-day reactor should have an out-of-band method of SCRAMing that doesn't rely on computer control of any sort. A common approach is to have control rods held physically over the nuclear fuel by electromagnets. If power is cut to the electromagnets for any reason then gravity drops them into place and the reaction ceases. If monitoring systems don't automatically cut power to the SCRAM system then it would just take a worker pushing a button. Heck, they may even have fuses located around the reactor that would melt in the presences of excessive heat or the presence of radiation, causing power to the magnets to be cut. So the likelihood of a computer worm causing a meltdown is highly unlikely unless the Iranians are stupid enough to disable the SCRAM system.

Re:Perhaps it's just me...

[BobMcD]

Too bad, so sad. Beats a nuclear war between Israel and Iran.

You're frighteningly insane. If you think this would PREVENT a nuclear war, you need to think it through again.

1) Domestic reactors go Chernobyl due to well known virus

2) Source of virus is established, either credibly or not

3) Iran petitions the UN for military retribution/economic restitution/etc, and it get vetoed

4) Everyone chooses sides and WWIII begins

This isn't even close to being far-fetched. And before we assume '4' results in 'Iran vs Everyone', do understand that going against Iran means going against the freedom to live in something other than a third world nation. Power is relatively essential, and all things considered this virus is of a TERRORISTIC nature because it seeks to attack the civilian infrastructure to achieve political goals. Do you really to side with the terrorists?

Re:Perhaps it's just me...

[elrous0]

Why is this guy labeled a troll? It's no secret that the Israelis have forced the Palestinians into ghettos for decades now (a sad irony considering that many of the Jews who did this had themselves had just come from the jewish ghettos of Germany), and that bigotry on both sides pervades the country. Even many jews admit as much, and condemn the radical Zionists who would gladly plow over the Palestinians as if they were animals. I'm no fan of the Palestinians either, BTW, but I'm under no illusions that Israel is just filled with a bunch of innocent, noble, oppressed Jews just trying to living in fucking harmony with the world.

Re:Perhaps it's just me...

[KevinIsOwn]

Actual quote:

We do not wish, we do not need to expel the Arabs and take their place. All our aspirations are built upon the assumption -- proven throughout all our activity in the Land -- that there is enough room in the country for ourselves and the Arabs.

Go fuck yourself.

Treat anything from Debka cautiously

[Motard]

This site has a lot of seemingly tantalizing information, but a lot of it is BS. It reported that one of Saddam's palaces had huge glass covered aquariums where sharks would swim under your feet. Now that all the palaces have been 'visited', there have been no reports of any such thing.

Cyber World War 2 and a Half...

[wiredog]

Or something like that. Could get a bit scary, push comes t5o shove and all that. I wonder who will get hit with the retaliatory strike?

Alternatively, I wonder if this is the retaliatory strike?

You are in a twisty maze of little passages, all alike...

Incentive to give this impression

[Anonymous Coward]

(repost as the first one isn't showing up)

They would in any case have an incentive to give the impression that everything grinds to a halt. The more their nuclear programme slows down the longer it will be until Israel feels the urgent need to bomb it.

I like to play a little game called "Which world do we live in?". You describe two worlds that are generally similar but differ on some characteristics, and try to find out which of the two worlds we live in, or ways to go about finding out. I am not sure of an easy way to find out in this case.

Spreading havoc?

[brian0918]

It's my understanding that Stuxnet was designed to only *do only* to one certain computer/system that was specifically targeted. On all other computers that do not match the signature of that computer, it leaves them alone. So what is the "havoc" that it is causing?

Re:Spreading havoc?

[dr2chase]

As I understand it (I just used teh Google to figure out whether this worm phones home), the worm does phone "somewhere", and worms on a network update among themselves in a peer-to-peer fashion.

So, perhaps it started as one thing, and has become another. In particular, if the party answering the "phone home" can tell who is calling, they might deliver different payloads to known-Iranian IP addresses and other addresses. (That's what *I* would do.)

Reality seems to be catching up to our more paranoid fantasies, and I'm not sure that's a good thing. I'm feeling better and better about cut-wire security, and it sounds like it would be a good idea to stuff the USB slot full of epoxy.

Re:Spreading havoc?

[__aaqvdr516]

IAAICT (I am an Instrumentation and Controls Tech)

Stuxnet specifically targets Siemens Simatic Wincc software and associated PLC's. Essentially, the Wincc software is the programming base to interact with the PLC's, which are discreet CPU/memory clusters running optimized code for whatever it is you'd like to do. There are many PLC manufacturers and they use their own programming software to upload/download to their cpu's. The fact that this worm only interacts with Siemens software is not surprising as Siemens is one of the major manufacturers of industrial equipment. I have a large number of Siemens devices all around where I work. I do not use Siemens PLC's though, so I am unaffected by this worm.

This whole thing smells to me like a disgruntled software guy that used to work for Siemens.

Re:Spreading havoc?

[elrous0]

It targets two specific models of Seimens programable logic controllers (by targeting the Windows software used to program those PLC's). PLC's are used to control very time-intensive industrial processes. Pretty much every power plant, nuke plant, modern manufacturing plant, etc. uses these, and they control very dangerous physical equipment. Reeking havoc with these processes can cause explosions, radiation leaks, major industrial accidents, etc. (it could even cause nuclear reactors to go critical). That's very bad stuff. Best case scenario, it could cause serious damage to equipment. Worse case scenario, it could cause significant lose of life.

In other words, tampering with a PLC can make things go BOOM. In 1982, the CIA purported did this with the Siberian pipeline, and the resulting explosion was so powerful it set off missile launch alarms in the U.S.

Re:Spreading havoc?

[elrous0]

Having looked carefully at this worm (I'm preparing for a presentation on it at a local security conference), I can tell you it almost certainly wasn't written by one guy. It's the most complex piece of malware I've ever seen. It's written in three languages (C and C++ on the Windows side, MC 7 assembly language on the PLC side), it uses four different Windows exploits and two stolen code-signing certificates from companies in Taiwan (both of which read as legit until just recently), and it has one of the most aggressive and clever rootkits I've ever seen. And that's not even getting into how it can update itself. Unless said disgruntled employee was the goddamn jedi master of hackers in addition to his day-job, I would say this is definitely a major team effort (a very specialized team).

Re:Spreading havoc?

[Lord Ender]

The Air Force was recruiting hackers at DEFCON this year. The recruiter actually said they will take anyone, regardless of criminal record.

It seems reasonable that you wouldn't let criminal hackers work on your own defensive systems. So what *would* you do with them? You would develop offensive technology--that doesn't require the developers have any access to your own infrastructure.

Re:Spreading havoc?

[elrous0]

These models of PLC have a function block at OB 35 that automatically executes every 100 milliseconds. Stuxnet hides its own code at the beginning of this block (while also allowing the original code to run afterward). This allows it to mimic the original functions of the PLC, while it quietly runs in the background.

Re:Spreading havoc?

[Hijacked Public]

How would the worm know if an input tied to turbine RPM or if it is some other device?

It wouldn't know that speficially, but it modifies a block that is used to control a process that requires a very fast response. There aren't very many applications that would require that block so most programmers wouldn't bother programming and tuning it and interrupting the normal logic scan unless they really needed it.

To me it seems that Stuxnet is trying to slow the response time of the block it modifies and of the PLC overall. If you were trying to control your oven's heating element by changing the current you allowed it to draw in response to input from a thermocouple, and I could slow down the calculation you were using to determine the current change, I could cause the oven to overrun the temp. If that were a turbine I could cause it to overspeed, or a pressure vessel to overpressure, etc etc. Just that one change would cause 'havoc' to whatever process it was controlling. The process is guaranteed to be time sensitive regardless of what it is.

Do specific inputs on a PLC got specific ports?

No. But a good programmer can often figure out details of the process just by watching the logic run. I can look at the constants used for a PID instruction and know whether it is controlling a heating element based on input from a Type J thermocouple...for instance.

Or do you just have generic A/D and GPIO ports?

Generally an input to a PLC will have an address like I:1.0/0. That would indicate a discrete input card was present in the first slot of the PLC's chassis and that the wires from this particular input landed on the first input point. Most are 16 bit IO so you'd have I:1.0/0 through I:1.0/15, then I:2.0/0 and so on.

A discrete output would be O:1.0/0. You'd regonize analog IO because it would be used in the logic at the bit level. IO for modern PLCs is typically modular and can be arranged in any order.

You wouldn't know what specifically the was at the end of the wires (a button or a 2 position switch or whatever) but you might be able to figure it out.

Re:Spreading havoc?

[sh0dan]

The first version of Stuxnet (Stuxnet-A), uses a special "autorun.inf", that has an executable at the beginning of the file (which the autorun.inf parser skips). After the executable the "proper" information for the autorun.inf add another "Open" option for the rightclick menu. Selecting this will execute the content of autorun.inf (the malware). read about it here.

The second version (Stuxnet-B or Stuxnet!lnk), uses the zero-day .lnk file vulnerability, that will automatically execute the content, when you browse the content of the USB stick.

See the links for more detail - it's quite fascinating (also from a technical perspective).

Re:Spreading havoc?

[swb]

Why should they fear criminal hackers?

I'm sure during the "orientation" session it was made clear that if they fucked up, there were some scenarios to consider -- like suddenly finding yourself in Pelican Bay State Prison under a new name, starting a 30 year stretch for multiple child molestation convictions.

Re:Spreading havoc?

[kevinNCSU]

You're forgetting hackers like to target people miles away with complete anonymity. Not people they work with that hold sub-machine guns, sign their pay checks, and have their complete life's history on file along with polygraph tests.

DEBKA is totally unreliable.

[Noryungi]

This is DEBKA. Completely ridiculous website, riddled with disinfo.

Example:

Not only have their own attempts to defeat the invading worm failed, but they made matters worse: The malworm became more aggressive and returned to the attack on parts of the systems damaged in the initial attack.

'nuff said.

Of course, that does not mean Iran is not hit hard by Stuxnet - just that everything you read at this site should be taken with a big grain of salt.

Re:DEBKAfile

[Attila Dimedici]

My impression of Debkafile is that they have sources for just about everything they report, but that they are often used by various individuals and groups to get stories out there that are not true. On the other hand, every now and again, they break some story that every other news organization has ignored/missed because there are no solid sources, but once the story breaks, solid sources turn up. What that means is that if you see something on Debkafile, look around for other sources before you take it as true (although this may take some time).

Re:Millions?

[Anonymous Coward]

Sadly, most industrial control stuff runs on Winderz. It's all DCOM-based and takes so much banging your head against the monitor to get configured and working properly that oftentimes, you end up having disabled most any security features available out of sheer "maybe THIS will work" frustration. When you finally DO get it working, the last thing you want to do is go back and start turning on the security features as it will just break this fragile house of cards.

At least that's been my experience with it.

Posting anonymously cuz I just kind of admitted I'm DOING IT WRONG. But I swear it's true.

Re:Millions?

[grub]

I mean really, when Seimens or some other industrial supplier comes in, do they automatically say, "Oh, we need to have this connected to the internet for critical software updates." ? Do they use Microsoft's updating methods?

I can't speak for Siemens' method of updating that type of software but I know that for the MRI console software they make (for the Siemens MRIs) we have a VPN between the console and Siemens directly. No full internet access required.

Is this really stupid, or... what?

[Dr. Crash]

What I don't understand is why the *heck* the SCADA systems running Iran's { illegal | sooper-sekrit | stealth } nuclear weapons program aren't air-gapped! Isn't that something like standard procedure?

Re:d3ac0n - The Stupidity Is Sickening

[Beezlebub33]

Take a look at the wikipedia page on Ahmadinejad and Israel. He's pretty nuts and definitely wants to get rid of Israel. I don't see a quote about genocide though, just wants to get rid of the state; weird comments about the holocaust and 9/11.

Re:wait, couldn't they fix it with one of these

[Xest]

On the contrary! I was being nosy and noticed the script right at the top in the opening body tag, hence why I asked why it tries to resize your browser.

Also

[Sycraft-fu]

Most modern reactor designs have a difficult time going critical. They are made such that if coolant goes away, they stop working. Depending on the kind of fuel you use you can set it up so that when the coolant goes away the excess heat causes things to spread out and thus the reaction slows. It gets hot, but not hot enough to melt down. Not fool proof, nothing is of course, but makes it pretty hard for things to go critical even in a worst case scenario.

It also should be noted that often the SCRAM systems go beyond that. The rods will have springs behind them to force them in quicker, and there are usually secondary systems to drive them in as well, should the primaries fail.

Over all, the world did a pretty good job learning from the problems of early reactors and it is pretty hard to cause a meltdown these days, with a modern reactor design at least.

Do remember that the people who build these have a large vested interest in making sure they DON'T go critical, even in adverse situations. Safeties are taken seriously.

Re:Also

[BlueParrot]

makes it pretty hard for things to go critical even in a worst case scenario.

All power reactors in the world today go critical as part of their normal operation. That's why they can sustain a chain reaction. However, they are all designed in such a way that their criticality is not sufficient to allow the reactor to remain critical without the contribution from so called delayed-neutrons. These are neutrons emitted by the fission products some time after the fission event. It's because the release of these neutrons is much slower than the release of fission neutrons that it is possible to build a stable nuclear reactor. Without them the reactor would either be sub-critical and hence not produce any power without an external neutron source, or it would be prompt-critical, which pretty much means you would not be able to control the rate of the chain reaction rapidly enough to prevent dangerous power fluctuations.

Modern pressurized water reactors typically can't go prompt critical, since the quantity of relatively low enriched uranium is too small.

smells like more israeli racism than news to me

[amias]

have a look at the whois for debka

Registrant:
      DEBKAfile Ltd.
      4, Hamaapilim St.
      Jerusalem, 92545
      Israel

why should anyone trust news about Arabic interests that is published by people living in Israel ?

it would certainly suit Israeli interests to discredit the security of Iran and its the kind of racism that
seems to be all too common in Israel .

Toodle-pip
Amias

Re:smells like more israeli racism than news to me

[jpmorgan]

So what you're saying is you're treating the website differently because it's from a specific race.

Gotcha. Racist.

Thank God it's not named...

[master_p]

...Tuxnet.

or... ...Suxnet.

Re:Hilarious US Media Lies About Iran

[BobMcD]

My Karma speaks for itself, and I fully understand the weight and value of your opinion.

Step one...

[hesaigo999ca]

Step one, never ever, link a computer that is critical and or military in nature. We all hear never should any computer used to control the power grid be placed connected to the internet, follow this rule, as your #1 priority, then the rest follows, no matter how many times you fix it, it will return broken because you are connected to the biggest network of hackers of all, the internet...!

Who died and made you...

[CountBrass]

Who died and made you the Supreme Court? Or is there something in the constitution that allows any ill-informed muppet the right to make that judgement?

This is just pure lie, see proves below...

[XARG]

All this quotes are pure lies:
search for "must expel Arabs and take" in
http://en.wikiquote.org/wiki/David_Ben-Gurion

search for "We must use terror, assassination, intimidation"
http://www.camera.org/index.asp?x_context=22&x_article=775

etc...

some arab supported seem to just LOVE using lies as the best weapon.

Re:This is just pure lie, see proves below...

[sabt-pestnu]

A fair number of the GPs quotes seem to come from mepja.org, or at least are among those also quoted there.

I find both the original references, and the refutation links interesting.

The first refutation link is to a wiki (wikiquote), which one can imagine being subject to propaganda struggles on popular pages. The second refutation link describes the quote being refuted as from some entirely different sources than the GP's. One can't help but wonder, when a quote is attributed to different sources. Of course, the GP's quotes are from sources obscure enough that researching them becomes more than an idle moment's diversion from work as well.

The parent's CAMERA.org link is to a page debunking a few particular "sources of misinformation". It is hard to tell, from the sidelines, whether they've cherry-picked particular statements that are provably false, or whether they have chosen a small set of examples fitting a larger pattern. The sources quoted, as well as those used for verification, are obscure beyond the idle endeavor.

But in as much as I have no first hand evidence, and no experience with any of the sources or organizations involved, I have no basis to place trust in either side. CAMERA evidently has its stated goals, as described:

The Committee for Accuracy in Middle East Reporting in America, or CAMERA, a media watchdog founded to combat what was perceived as anti-Israeli press coverage...

Columbia Journalism Review

...devoted to promoting accurate and balanced coverage of Israel and the Middle East. ... non-partisan organization, CAMERA takes no position with regard to American or Israeli political issues or with regard to ultimate solutions to the Arab-Israeli conflict. ...Frequently inaccurate and skewed characterizations of Israel and of events in the Middle East may fuel anti-Israel and anti-Jewish prejudice.

CAMERA's stated policies.

I would have more trust if they were an academic organization, or if they were interested in busting myths about both Israelis AND Arabs/Palestinians, instead of being specifically a defense of one side.

And this, really, exhausts how far I'm willing to research a set of topics I have no personal stake or influence in, on whim alone. Someone wants to compensate me for my time, I'd develop more interest in chasing down these quotes.

But it does show that you can trust quotes only as far as your personal knowledge, and your sphere of trust goes.