Slashdot Mirror
New York Times Reports US and Israel Behind Stuxnet
Oxford_Comma_Lover writes "Confirming heavy speculation in the Slashdot community, the New York Times reports that joint US-Israeli efforts were almost certainly behind the recent Stuxnet attack on Iran's nuclear program." The article stops just short of saying in so many words that Israeli is the doer, but leaves little doubt of its conclusion.
They probably "almost certainly" did, but the NYT article is still just speculation. The haven't confirmed anything.
It will considered an act of war resulting in the real thing, of course.
For justice, we must go to Don Corleone
You really have to hand it to Israel, they continue to be the very best at cloak and dagger style work. Yes, I consider this C&D due to its ingenious nature. Spread a massive virus across as many systems as you can, and nestle a chunk a code in it to only activate on the correct system. This not only requires the method to spread it, but far more impressive is the fact that it required the correct code for there machines. This means they do 100% have spys inside of Iran's nuclear systems and gives a butt load more credit to the statements made by Israel and America about Iran's nuclear goals. Well done
So basically, -1 troll/offtopic is really slashdots way of saying "I hate that you thought of something before me."
In this case whoever did it seems to have averted war at least for a few years.
There was some decent evidence that it was actually a Chinese-Finnish operation
My guess is when it's all declassified in 100 years or so we'll find out it was actually created out of different virus cross breeding and the Internet has been alive this entire time. Yea, I'll be shocked too.
Jason Wright, the OpenBSD developer funded by NETSEC to work on IPsec (and allegedly put in backdoors for the FBI) went to work at the DHS cyber security lab that the NYT is saying helped do Stuxnet http://nyti.ms/grd51X http://bit.ly/feB9ZV
SecTor 2008 gives his speaker bio http://www.sector.ca/speakers2008.htm
I am not making this up.
I'll have to put it in a blog post this evening. See homepage link.
Since when is the media considered factual confirmation? "Hey, let's all go out and look at the Inquirer to get proof that aliens exist!" While it is almost certain that the attack did originate from the suspected nations, a better wording would be, "supporting /* speculation" rather than "confirming" seeing as NYT is certainly not the fount of truth and honesty in reporting and fact-finding. Now excuse me while I go study on Wikipedia...
There are a few important aspects of the story that didn't get covered by the NYT. One is that there was no mention of the origin of the 4 zero-day Windows vulnerabilities and another is the insertion method. Obviously Stuxnet wasn't just blasted out on botnets. Someone got it very close, probably into a facility or more than one facility, or perhaps into a government office or contractor. That's one of the aspects of this that always told me it was a state actor with quality human intelligence capabilities. Actually, my wild guess before is that a contractor from Siemens or someone like that spread it. Which brings up another aspect of this: This story can't be good news for Siemens's customer relations, especially with their government customers.
Now albeit through anonymous sources that government powers are developing malware, how will it be either through legislation, treaty or "gentleman's agreement" that anti-virus software manufacturers will have to look the other way for certain payloads? Is this already happening? Certainly the Third Amendment tells us we don't have to use our homes to quarter soldiers, but will the government use its citizenry's hard drives and bandwidth to host a weapon?
There are two kinds of fool. One says, This is old, and therefore good. And one says, This is new, and therefore better.
By the way, all the pundits saying it would take the resources of a government to create that worm know very little about what it actually takes to make one. It did however take very intimate knowledge of the code running on those systems, so the creator probably has a copy of the source code on those machines, or the equivalent. (I'm pretty sure it's too large to be memorized by a single person.)
Did you RTFA? It claims Israel acquired some of the centrifuges that Iran is using, got them working, then tested the worm's effect on them. That's a lot more than the resources of Joe Hacker. Not just anyone can run down to Pakistani-Centrifuges-R-Us and buy a dozen of them to test with.
When you look at the instructions Stuxnet was sending to the centrifuges, they're brilliantly designed exactly to cause them to fail. After lurking for a couple weeks, they over-speed them for a few minutes, then drop them down to almost stopped speed, then bring them back to a fairly normal operating speed. The overspeed period stresses the already stressed components, occasionally beyond the breaking point. The underspeed periods act like a mixer, stirring up any U-238 that had already been spun out of suspension. Returning them to normal speed allayed suspicion that they were faulty.
There is no way one guy is going to know exactly what values it would take to create such a precise scenario. It takes massive resources to pull that off.
John
It is even quite likely that Ahmedinejad is looking for an attack in order to complete the nuclear program. It is unlikely that the religious leadership would want to allow him to complete a nuclear bomb: it would put him above them. If Iran really wanted a nuclear weapon they would have one by now, they have vastly more resources than were available to the Manhattan project in the 40s. Another possibility is that Iran does already have a nuclear bomb but is unable to declare it since that would lead to an immediate attack etc.
In either case it would make perfect sense for Ahmedinejad to incite an Israeli attack which would provide a pretext for withdrawal from the NPT and become a declared nuclear power within a short interval.
A war between Israel and Iran would be a war of attrition with each side aiming to rack up as many civilian deaths as possible. Israel cannot win that game and it would be stupid of them to try. The mullahs have shown themselves quite capable of accepting a million casualties in a war.
The Times report itself says nothing new and nothing that can be believed. All that we know is that there is are sources in US/Israeli intelligence that want to take credit for Stuxnet. We do not even know if the source would even have knowledge of such an operation if it existed.
The motives for wanting to take credit are rather obvious. But if you look at what the attack achieved or was likely to achieve it is very hard to see how it would be in the interests of either to burn major intelligence assets for an act of minor vandalism.
We know that the attack involved four zero days, was written in a modular fashion, probably by multiple authors and had references that might have been intended to lead to a certain conclusion. What we really don't know much about is the payload code. We do not even know for certain what the target was.
For several weeks we were discussing media reports that 'confirmed' that the virus was Chinese on the basis of some 'expert' who had seen an algorithm in Chinese code and erroneously considered it to be uniquely Chinese. The press will repeat any nonsense that is said to them by someone who is convinced they are right.
If the target was indeed the Iranian centrifuges or the Iranian power plant then the only way that it could have possibly been expected to work would be with very deep knowledge of the design and deployment of a top secret Iranian facility. There are only two ways that knowledge could be available to the attacker - if they designed the plant or if they had a source with access.
Looking at the likely result of this attack I cannot possibly see how anyone would wish to let the Iranians know about the intelligence source for the sake of some minor inconvenience to the Iranian program.
A much more likely explanation in my view is the idea that the Russians wrote Stuxnet to damage the nuclear plant they designed and thus require Iran to buy additional services from Russia to repair the damage and to accept the reprocessing proposal (which they did). Such shakedown tactics were common during the Soviet era.
Russia would not have an incentive to take credit for the attack in such circumstances. But some of the US/Israeli hawks would even knowing that the claim was false.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/