New York Times Reports US and Israel Behind Stuxnet
Oxford_Comma_Lover writes "Confirming heavy speculation in the Slashdot community, the New York Times reports that joint US-Israeli efforts were almost certainly behind the recent Stuxnet attack on Iran's nuclear program." The article stops just short of saying in so many words that Israeli is the doer, but leaves little doubt of its conclusion.
Did anyone believe otherwise?
They probably "almost certainly" did, but the NYT article is still just speculation. The haven't confirmed anything.
It will considered an act of war resulting in the real thing, of course.
For justice, we must go to Don Corleone
WhooRah!!
Because the NYT was unable to definitively blame the US & Israel, this is a huge disappointment to them and their fellow "blame the US" & Israel crowd.
You really have to hand it to Israel, they continue to be the very best at cloak and dagger style work. Yes, I consider this C&D due to its ingenious nature. Spread a massive virus across as many systems as you can, and nestle a chunk a code in it to only activate on the correct system. This not only requires the method to spread it, but far more impressive is the fact that it required the correct code for there machines. This means they do 100% have spys inside of Iran's nuclear systems and gives a butt load more credit to the statements made by Israel and America about Iran's nuclear goals. Well done
So basically, -1 troll/offtopic is really slashdots way of saying "I hate that you thought of something before me."
In this case whoever did it seems to have averted war at least for a few years.
You'll never be able to trust anything more complex than a simple light switch ever again. Wait till all this crap gets into your "smart grid". It'll be comedic to say the least.
For justice, we must go to Don Corleone
.... Israeli is the doer...
Do this implode the horrible consequence that human are the thingifier? Slashdot are the grammarmaker!
... and then they built the supercollider.
im sticking to the theory of one lone hacker, either not connected to a government, or paying off jail time did it; till the almost is out of the picture
as no one in government know computers, otherwise their nonsence laws would be enforceable or abusable
warning pointless sig
Jason Wright, the OpenBSD developer funded by NETSEC to work on IPsec (and allegedly put in backdoors for the FBI) went to work at the DHS cyber security lab that the NYT is saying helped do Stuxnet http://nyti.ms/grd51X http://bit.ly/feB9ZV
SecTor 2008 gives his speaker bio http://www.sector.ca/speakers2008.htm
I am not making this up.
I'll have to put it in a blog post this evening. See homepage link.
Since when is the media considered factual confirmation? "Hey, let's all go out and look at the Inquirer to get proof that aliens exist!" While it is almost certain that the attack did originate from the suspected nations, a better wording would be, "supporting /* speculation" rather than "confirming" seeing as NYT is certainly not the fount of truth and honesty in reporting and fact-finding. Now excuse me while I go study on Wikipedia...
and killed dozens of sailors? or, say, shelled their islands killing 4 people? like that kind of act of war that brought on armageddon? you mean we would go and bomb them into the stone age? oh .. ok.
coz im pretty sure we would 'write them a very stern letter',
or in Obama's days, "work closely with our partners to blah blah blah blah"
i love the 'work closely with our partners' thing. where the hell did that come from?
There are a few important aspects of the story that didn't get covered by the NYT. One is that there was no mention of the origin of the 4 zero-day Windows vulnerabilities and another is the insertion method. Obviously Stuxnet wasn't just blasted out on botnets. Someone got it very close, probably into a facility or more than one facility, or perhaps into a government office or contractor. That's one of the aspects of this that always told me it was a state actor with quality human intelligence capabilities. Actually, my wild guess before is that a contractor from Siemens or someone like that spread it. Which brings up another aspect of this: This story can't be good news for Siemens's customer relations, especially with their government customers.
I have to agree with those that think this article was a bunch of innuendo and unsubstantiated statements.
.."
"...when it began circulating around the world, unexplained, in mid-2009.
I found it extremely funny when they mentioned that the worm had no explanation of it's purpose, as if that were somehow indicative of a covert and malicious nature.
So, does anybody out there know of any worm, virus, trojan, or other malware that actually comes with a manifesto to explain it's existence/purpose?
By the way, all the pundits saying it would take the resources of a government to create that worm know very little about what it actually takes to make one. It did however take very intimate knowledge of the code running on those systems, so the creator probably has a copy of the source code on those machines, or the equivalent. (I'm pretty sure it's too large to be memorized by a single person.)
considering that 1. Massive numbers of Jews left Russia to go to Israel in the past 20 years 2. Massive numbers of those Russians know a shitload about computers and 3. Massive numbers of them keep contact with their buds in Russia and 4. Russia has been helping Iran with its 'civilian' nuclear program for a long time. Now, 4 is probably at the behest of the CIA, who pays the Russians big bucks to go "help" Iran. Thank god, is all I have to say, because of the Russians weren't inside Iran's program watching it, then the Chinese would be, and that's the last thing we need, a China-Iran alliance.
Iran has oil. North Korea are just a joke.
Does this mean that companies in the US can obtain compensation from the government for the damage done to their computer systems and their efforts to remove the worm? Can Siemens sue the US government for trashing its customers worldwide?
Now albeit through anonymous sources that government powers are developing malware, how will it be either through legislation, treaty or "gentleman's agreement" that anti-virus software manufacturers will have to look the other way for certain payloads? Is this already happening? Certainly the Third Amendment tells us we don't have to use our homes to quarter soldiers, but will the government use its citizenry's hard drives and bandwidth to host a weapon?
There are two kinds of fool. One says, This is old, and therefore good. And one says, This is new, and therefore better.
1) I didn't think the US was sophisticated enough to help with something like this, much less keep its Facebook privacy settings. Maybe the US contribution was just 'click on google.ir?'
2) This is much, much preferable to Israel bombing (or even nuking) bits of Iran. Shutting down their nuclear bomb program this way is far better - of course it also lets the cat out of the bag.
I have an IBM "Deathstar". They'll never get anything out of that.
I'm currently working my way through the article, but I'm sure a collection of sane countries helped out on this. I would guess the Saudis, the Brits, and the Germans helped out in some form or another.
Except for ending slavery, the Nazis, communism, & securing American independence, war has never solved anything.
Are worms like this engineered to stay within a targeted ecosystem (i.e. networks involved in Iran's nuclear infrastructure) or can we expect 'blowback'? And if the weaknesses it exploits have been patched or fixed, does this mean there was corporate involvement, or notification after the fact?
...you need to build all your own shit, from the ground up.
For now, anyhow. Maybe, in the future, it will be OK to buy your infrastructure off of Craig's List and eBay... (or various Euro conglomerates) but for now, if you want the job done right, do it yourself.
In this case, I think a Simpson's quote, from Nelson would be appropriate - "Ha Ha".
This issue is a bit more complicated than you think.
What would you rather have, Israel and the US bombing Tehran, or the CIA and Mossad making a computer virus to disable centrifuges? I think I'll open door #2, thank you very much.
Either way, you have collateral damage; I just think the world is better off with fried OS installations than fried humans.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Stuxnet looks like it's bought Israel and The West time to try alternatives to military action before Iran develops the bomb. But the main alternative is regime change, and encouraging home-grown counter-revolution is hard, as the US found with Castro and Saddam. Here you've got the tougher nut of a authoritarian theocracy.
Now you've got a humiliated Iran, who will be even more determined to develop nuclear missiles and to export terrorism as a way of balancing their feeling of powerlessness.
So I see two endgames: regime change via military action, or a treaty driven by concessions from Israel and the West. The latter will have to involve resolving any perceived Western hypocrisy over Israel. This would include Israel also giving up her nuclear capability, even though form suggests that Iran can't be trusted as much as Israel not to use nukes provocatively.
Blame all this on the Italians. They started the ball rolling in 135.
...that NYT does all this work on StuxNet and so little on the current US administration and its allies?
North Korea are just a joke.
That's what MacArthur thought.
The funny thing about modern war is that everybody loses. The victor loses too. That the enemy lost more doesn't negate your own losses.
And right now, I don't think the US could afford "winning" another war.
1) While technically impressive, this is not "cloak and dagger" by any stretch of the imagination. Everyone knows Israel did it. They broadcast the code all over the world. "Cloak and dagger" implies some degree of stealth or misdirection.
2) If Israel had a spy in Iran's nuclear systems, why would Stuxnet have leaked out? Why wouldn't all the centrifuges just quietly self-destruct? It didn't take espionage to get the technical specs on Iran's centrifuges. They were reported to the IAEA. Sure, it's not impossible, but seems unlikely.
3) For the US, war is basically a right-wing welfare program, so there is constant pressure for lucrative new targets. Israel is perpetually engaging in economic warfare against basically everyone. The scare-mongering with respect to Iran's nuclear power program is just typical, sabre-rattling, lies exactly like those told about Saddam to drum up the Iraq invasion. An energy-independent Iran poses the same threat as Saddam's pricing oil in Euros and state gas subsidies: hastening the end of petrodollars and cheap oil for the US.
"I assumed blithely that there were no elves out there in the darkness"
are either denying the obvious/equivocating ridiculously i.e. "this is not confirmation, so we can't take it as fact, even though it's almost certainly true" or flat out justifying the sabotage. If some Chinese hacker group (which would clearly be some shadow arm of the EVIL COMMUNIST PARTY) did this to an American government institution, the masses here would be calling for immediate war against China.
The Western hypocrisy is strong with Slashdot, as it has always been. It loves to get on its soapbox and be sanctimonious when non-allied nations try to defend themselves against Western imperialism, but it's clear that when it's your team doing it, it's all good, just like in a sports match.
The big thing in this article that stuck out for me was that Siemens participated with the Idaho National Lab to do a security audit of their software.
We now know that cooperating with the US Government in this regard is giving up your customers to them, effectively.
What if the Siemens gear were a few generations ahead and automatically updated itself online? Would they be barred from issuing some fixes? Did Siemens even get a full report of what was found? Was their participation in this exercise a requirement for some other business contract?
We've read previously that Stuxnet used 4 0-days in Windows to propagate. So, we can assume that part of the US Government knows about holes that affect its citizens' economic and real safety, has DHS/US-CERT in place, but does not disclose? Does CERT know about these and sit on them or are they in the dark as well?
I'm not necessarily arguing that the ends weren't justified, but it's important to understand just how everybody's relationship is structured here with regards to computer security.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
... I don't have particularly high esteem for the Iranian leadership, but they're not stupid, they're not suicidal, and they understand MAD ...
No. Some in the leadership do not believe in MAD. However they are not suicidal because they believe god will intervene and protect them from a nuclear attack. Like some ultra-fundamentalist christians they welcome an apocalyptic war because it means the return of the mahdi for the Ahmadinejad types and jesus for the comparable christian extremists. Some of Ahmadinejad's public statements:
2005: "Our revolution's main mission is to pave the way for the reappearance of the 12th Imam, the Mahdi,"
2009: “They [U.S.] have devised all these plans to prevent the coming of the Hidden Imam because they know that the Iranian nation is the one that will prepare the grounds for his coming and will be the supporters of his rule.”
2010: "the Mahdi will come here, accompanied by Jesus Christ" to liberate Palestine and allow the millions of Arabs of Palestinian descent to move there in his wake.
MAD only works with rational people who are not expecting divine intervention.
I'm sure they wish they had a refuge from this deluge of centrifuge subterfuge.
anyone surprised by that? cause I'm not. If some psycho get a hold of nukes and launches everyone else will launch, and I don't want to witness that. And if I am not mistaken the country in question has a past history of unreasonable violence over territory. So you can call me whatever but who ever is doing it needs to keep it up, if for nothing else than to delay the inevitable.
The entire American nation is 99% dicksuckers. All you have to do is look at their media programming...how could you go wrong?
The third alternative would be to simply stop the provocative rhetoric and let them be.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Isn't this the same people who told me the Tucson shooter was influenced heavily by Palin, the Tea Party people, and was a right wing zealot? If they can't even get that right why believe them now on highly secret and very competent spy stuff?
Frankly if they *were* responsible for this more would be happy than not - given Iran's govt isn't this how we would want them to act instead of bombing them (and surely no one here thinks a nuclear weaponized Iran is a Good Idea)? Iran's Nuclear program makes few happy outside of Iran and such an easy crippling of it with little to no others damaged is more competent than I think most of the western world is capable of. Indeed should we even believe them as to how much it crippled Iran?
It seems to me that the vast majority of what we "know" about this is from people who can't figure out if a person with extensive postings on the internet a 10 minute search points out is a Lefty, Righty, or a Nihilist why should we believe them on things that take months of research into highly secret areas that leaking information results in long term prison sentences? As far as I can tell they have done extensive research of speculation on the internet and printed it as something more - well yea, those are some of the more likely to be suspected but there are others. They are months behind reading comments here and seem to have about the same level of insight into the thing (which is nothing more than speculation).
------- Sorry about the spelling, I suffer from two problems. Dyslexia makes it difficult to spell well, lazy makes it
1. its illegal for you to marry a non-'common sense american'
2. you are not allowed to work
3. your house/apartment has been taken from you and you live in a walled ghetto
4. your money has been 'kept for safety' by a special bank for 'common sense americans' only
5. your place of worship got burned down last year
6. several of your friends are dead
7. within 6 years, everyone you ever knew or loved will be a skull in a mass grave
8. you live in a one party state without any elections, with one single labor union controlled by the state, a massive military industry based on slave labor, and a dictatorial leader who has corrupted the entire court system, and replaced the constitution with laws that specifically single out 'common sense' americans for death or imprisonment
yes. i can see very much how being a "common sense american" is JUST LIKE being a german jew in 1939.
People who are seriously religiously insane tend to spend their time at the Mosque praying. Even if there's some multiple personalities involved, at least one of the guy's personalities has to be pretty calculating to have got to the level of power he has got to in the place he got there.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
The funny thing about modern war is that everybody loses.
That's why they invented the term "Pyrrhic" after WWII.
That has already happened with the Sony rootkit.I think it was f-secure that had heated discussions with Sony for about a week before releasing the information to the press and their virus definition - and that may have only been because there was a non-commercial fix by then. All of the others were silent but some were reported as corresponding with Sony on the issue. The company that did release information to the press had most definitely been asked to enter a "gentleman's agreement".
I highly doubt it was anyone but the usual bored teenager that wrote it, as I would assume that if you were to wage cyber-warfare as a nation, the least they could have done was to make the nuclear plants blow up completely. Now that would effectively have stopped their nuclear program rather permanently...
If the explosions were combined with an Israeli attack on Tehran to wipe out the theocratic power structure, taking advantage of the chaos, then we would have something worth building on. If you cut off the head of a snake, even an evil one like Iran, the rest will die. And Iran has since 1979 seriously been asking for it.
Well a gentleman's agreement between corporations are lubricated with money. Between a government and a company? I assure you Uncle Sam would appeal to patriotism and expect one to lay back and take it while thinking of their country with nothing more to ease the experience. Probably even given threats as to what would happen if one did not cooperate.
There are two kinds of fool. One says, This is old, and therefore good. And one says, This is new, and therefore better.
In these slashdot comments... Americans denying that their country would ever do anything like this.
Tell me then how much money you think Sony gave to the antivirus companies to look the other way? Are you suggesting bribery was involved?
I don't think it was.
I think it was a situation of "might makes right" with the large corporation of Sony possibly making threats involving expensive legal action where the one with the deepest pockets wins instead. That makes it very similar to what an organisation connected to a government would do.
Ahhh, General Pyrrhus, hero of D-Day. We will never forget you.
Aide-toi, le Ciel t'aidera - Jeanne D'Arc.
"Siemens" as "Siemens" consistently in a single article? Where do people get "Seimens" from?
And somehow the NY times has some credibility?
Not with me they don't. Pretty easy to make up anything they want and publish it as fact when Neither of the Gov'ts involved will be willing to say "yup .. we did it" LOL
Hurricane Island Outward Bound
OB
Clear as the sun!, US is behind it.
To me, this looks like some reporters decided on a conclusion ( "The U.S. and Israel did it!") and then went and dug up a bunch of information that kind of supports their conclusion but doesn't actually prove it but didn't examine any other possible ideas, then published it as "We can't prove it but this is exactly what happened, honestly, it the truth!"
...they actually didn't report that. But we all *know* who did it, so that makes it okay to say they did, right?
Wow, that got my head spinning...
how long until
Fascinating. It appears that the Western Democracies are simultaneously the most vulnerable to cyber attack, and the most capable of launching cyber attacks.
That creates an unique and fantastic challenge and conundrum for our diplomats responsible for negotiating treaties regarding cyber warfare.
Perhaps my great grandchildren will get to read the actual story of how they navigated that narrow path. For now, we can only hope that Tom Clancy might be inspired to write one of his marvelous novels around this theme. I'm sure it would make fascinating reading.
Where is the uproar over the possibility that there was another leak involved with American intelligence efforts? Leaks like this have been happening for decades, so why the uproar over wikileaks?
Yup - this is why most countries try to source all their military supply chain from friendly countries, if not 100% domestic. The US won WWII because it could build ships/tanks faster than anybody could destroy them. It started out WWII much weaker than their opponents. The US could meet almost all of its production needs domestically, and geographic barriers protected the means of production.
Now, I'm not sure how likely a protracted war between equals would be in the future. If a war is fought and won in six months it doesn't really matter whether the US can build replacement microchips or whatever - the whole war is fought from inventory. However, in a protracted war the ability to continue building fancy high-tech weapons will probably help determine the outcome. If the US can only field 1970s-era tech due to supply constraints they will suddenly be on parity with many nations out there...
Hey, someone mod this guy Funny! That crack just made my day and me without mod points. :-(
you don't need the source code to write exploits, it doesn't even really help, it is more of a distraction.
most exploits are for Windows.
but Linux, BSD and even OSX provide source code.
you'd think more people would attack those easier open source targets.
Canada would be far easier to take over than Russia with nearly the same level of natural resources.
Plus it's closer, which is important given how much Americans complain about commute times to work.
“Common sense is not so common.” — Voltaire
That battle took place in Washington DC.
The US is its own worse enemy. We probably have no business fighting wars when we aren't able to complete them.
Despite what the anti-American international community says, the US are not imperialists. To be an imperialist you need to claim control over those you conquer. US policy is to wash your hands of any victory or defeat once it becomes politically unpopular.
This is why we laugh whenever Ahmadinejad refers to the US as an imperialist nation.
It was the best outcome that was available given the circumstances, but it was a national disaster even so.
That is one reason why people like David Brooder show themselves to be senile fools when they advocate starting a war to cure the economy. The US economy only benefitted from WWII due to a massive increase on the input side of the economy: married women started to do paid work.
If you look at every other war that the US has been involved with the result has been a massive increase in debt.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
"Israeli is the doer"??? Wheres your English skills....
I want that, on a T-Shirt. Does Stuxnet have a logo?
"Operation Screaming Fist".
Mossad is behind almost all the terrorism in the world today. There is ample evidence that they perpetrated 9/11 for instance. Mossad being the bad guy in nearly any situation should come as no surprise to anybody.
I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
... those thinking in terms of scarcity: http://www.pdfernhout.net/recognizing-irony-is-a-key-to-transcending-militarism.html
"Likewise, even United States three-letter agencies like the NSA and the CIA, as well as their foreign counterparts, are becoming ironic institutions in many ways. Despite probably having more computing power per square foot than any other place in the world, they seem not to have thought much about the implications of all that computer power and organized information to transform the world into a place of abundance for all. Cheap computing makes possible just about cheap everything else, as does the ability to make better designs through shared computing. I discuss that at length here: http://www.pdfernhout.net/post-scarcity-princeton.html
There is a fundamental mismatch between 21st century reality and 20th century security thinking. Those "security" agencies are using those tools of abundance, cooperation, and sharing mainly from a mindset of scarcity, competition, and secrecy. Given the power of 21st century technology as an amplifier (including as weapons of mass destruction), a scarcity-based approach to using such technology ultimately is just making us all insecure. Such powerful technologies of abundance, designed, organized, and used from a mindset of scarcity could well ironically doom us all whether through military robots, nukes, plagues, propaganda, or whatever else... Or alternatively, as Bucky Fuller and others have suggested, we could use such technologies to build a world that is abundant and secure for all.
So, while in the past, we had "nothing to fear but fear itself", the thing to fear these days is ironcially ... irony. :-) "
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
The NYT is not The Guardian but sometimes comes pretty darn close in terms of semi bizarre attributions of the secret powers of Israel. The US part of the article has the standard plausible deniability of sources but the Israel parts are sheer conjecture yet somehow we are supposed to just accept that the Israelis can setup a test lab of P-1s to match the production environment in Iran. America cant even ship P-1s to England without the units getting damaged, but Israel can build a working test lab of them. Right... These sorts of articles border on accusations of secret Jewish cabals. A way to dog whistle for "Jew World Order" or "Zionist Occupation Government" folks who consider themselves far to reasonable to openly admit to believing in such nonsense.
So we have confirmed there ARE people who care what the NY Times writes...