Slashdot Mirror
DHS Chief: What We Learned From Stuxnet
angry tapir writes "If there's a lesson to be learned from last year's Stuxnet worm, it's that the private sector needs to be able to respond quickly to cyber-emergencies (CT: Warning, site contains obnoxious interstitial ads. Blocker advised), according to the head of the US Department of Homeland Security. When Stuxnet hit, the US Department of Homeland security was sent scrambling to analyze the threat. Systems had to be flown in from Germany to the federal government's Idaho National Laboratory. In short order the worm was decoded, but for some time, many companies that owned Siemens equipment were left wondering what, if any measures, they should take to protect themselves from the new worm."
I smell something...
#1 thing learned from Stuxnet:
Air-gap your production SCADA/embedded stuff.
Confirmed: Stuxnet Was False Flag Launched by Israel and U.S.
http://www.infowars.com/confirmed-stuxnet-was-false-flag-launched-by-israel-and-u-s/
Kurt Nimmo
Infowars.com
January 16, 2011
On Saturday, the Gray Lady of establishment propaganda, the New York Times, passively admitted that the Stuxnet virus responsible for crippling Iran’s nuclear energy program was engineered by Israeli and U.S. intelligence.
“Officially, neither American nor Israeli officials will even utter the name of the malicious computer program, much less describe any role in designing it,” writes the Times. “But Israeli officials grin widely when asked about its effects.”
so:
1.) keep not only production but all but communication system from the Internet
2) do not allow removable media to the users, apply extreme caution to 'upgrades'
3) verify by viewing the source code ( or let it be done by 2 or more separate parties )
-
you have no source code? forget your IT security!!
US government responded quickly to the worm created by the US government...and then patted themselves on the back.
someone just assaulted a program designed to bathe you, your family, and your entire nation in nuclear fire. Of course you're going to grin.
I'm amused to see reports of the DHS analyzing something that might have been constructed by the guy they were sharing a cafeteria with....
I'm sorry what? All accounts suggest that the US and Israel jointly created and/or utilized Stuxnet to target Iran. There would be no reason for DHS to scramble to analyze it when the government itself created it! Unless of course one government agency is not talking to the other - Completely possible. I think this is misinformation from DHS.
The lesson is: get yourself out of the Administrators group for day to day use, even in Windows 7.
What they should have done:
1) anyone bringing in flashdrives and plugging them into mission critical should be taken out back and shot, or at least given a stern talking to. Autorun should be disabled
2) Any machines brought into from the outside (laptops etc) should be placed on a separate, untrusted network
3) Mission critical machines shouldn't be on a network. If that isn't possible, they should be on a separate network or vlan with only the machines they need to talk to, at the very least they shouldn't be able to access the internet
4) Always ensure that all security updates are applied promptly and all relevant hardening is performed
5) At the first sign of such a massive infection across multiple machines and devices, everything should have been taken offline, wiped, flashed, and reinstalled and brought up again on a know clean environment, with security procedures tightened.
6) If all of your machines are running version X of OS Y, they will all suffer from the same 0 day attacks. Diversity, where appropriate, is useful.
This may not have prevented a infection, but it would have definitely reduced its impact. I really question the competency of any IT person that had no idea what to do.
Ralph Langner: Cracking Stuxnet, a 21st-century cyber weapon
http://www.ted.com/ When first discovered in 2010, the Stuxnet computer
http://www.youtube.com/watch?v=CS01Hmjv1pQ
In short he shows/claims US was behind it.
There are no stupid questions, Just a lot of inquisitive idiots. (from a good friend)
Don't know much about the Iranian nuclear power program, do you? Even though I grew up in northern Michigan it still amazes me how gleefully people suck down even the most blatant of propaganda and believe it like they had personally been handed engraved tablets by god.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
One department rubbing a lamp doesn't mean another can control what comes out.
If you want to keep your involvement a secret you need to react normally. Best way to do that is not tell the guys who react to this stuff (until they get too close, then you tell their boss's boss's boss's boss to put a cork in it.)
We created it! http://www.vanityfair.com/culture/features/2011/04/stuxnet-201104/
Maybe the branch that created the malware and sent it to Iran should fill the DHS in on a few things...
I thought the US wrote this? I still think it was Canada.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
wait...we needed a conspiracy nut to inform us that Stuxnet was written by the CIA??? i cant be the only one that figured it out a year ago. But really why is it a surprise. this is basic espionage.
they say it is often more relevant then the comment above, all we know is its called the Sig!
Not to get conspiratorial, but i read a few places that the Fukushima Daichi plant was infected by stuxnet which is part of the reason why they had such difficulty getting it back together.
1) Warn Boss of vulnerabilities
2) Boss asks for time/cost estimate to fix
2a) Boss brings estimate to talking-head meeting
2b) people protest about their job process changing
3) estimate sits on Boss's desk for 3 months
4) Boss golfs with his sis's brother-in-law and they talk security
5) Boss comes to work next day, calls meeting about security
6) You remind him of estimate on desk for 3 months
7) meeting devolves into yucks about golfing/hangover
8) Boss calls you into office after meeting
9) Asks you to pick two of the "hottest" security bullets in your list
10) time/cost gets approved for two of the 10 security items
11) system eventually gets compromised
12) everyone runs amok, asks how is this possible
13) Boss approves 8 remaining security bullets
14) Goto 1
Glad I don't do security anymore.
boycott slashdot February 10th - 17th check out: altSlashdot.org
One of us is in the intelligence community. Is it you?
~Sticky
/My opinions are my own.
Don't try and make weapons-grade fissile material without the blessing of the USA?
I thought they would have learned that with enough private sector forensics, everything gets traced back to them? Didn't DHS in Conjunction with Siemens and Israel write this?
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
Don't know much about the Iranian nuclear power program, do you? Even though I grew up in northern Michigan it still amazes me how gleefully people suck down even the most blatant of propaganda and believe it like they had personally been handed engraved tablets by god.
And you fell off the turnip truck just yesterday, too, from the looks of it.
Because I'm sure all the senior leadership of that Iranian nuclear program has gone out of their way to keep the oh-so-important smashed Michigan turnip up-to-date on the goals of their program. (That's YOU in case you don't get it - figured I'd have to spell that out since you don't seem to be the sharpest tool in the shed...)
Let's see:
1. Leader of nearby nation claims he wants to wipe you off the map - literally. And he has about a thousand years of religious history behind him backing up that EXACT wording
2. Said leader's country maintains a proxy army right next door in a failed state. The publicly-stated goal of proxy army is to "wipe your country off the map".
2. Said leader's country begins a secret nuclear program.
Nah, there's no reason why someone who's the target of being "wiped off the map" wouldn't be happy about that no-longer-secret nuclear program suffering a major setback. Not at all. :-P
Unless maybe you haven't even fallen off the turnip truck yet. Then maybe you'd think the Iranian nuclear program could never have any non-peaceful purposes.
And you probably think you're getting a pony for Christmas, too.
Whats the latest threat from imagination land?
step 1: Log into your SCADA environment and observe controllers accordingly
step 2: issue commands to check if you are you an active ally of the United States government with regular trade and economic ties and no dissenting opinion of its policy?
step 3: log out of your SCADA environment, sigh despondently as you lift your hands from the Dell keyboard, pick something off the value menu at McDonalds for lunch today.
Good people go to bed earlier.
"...but for some time, many companies that owned Siemens equipment were left wondering what, if any measures, they should take to protect themselves from the new worm."
The implication of this statement is that DHS didn't have an immediate answer (outside of pedantic default answers like "unplug your equipment" or "reload software" or anything else from answers.com).
Gee, let's see -- a new worm never seen before, apparently written by a sophisticated group from the intelligence community and someone's actually surprised that there was no immediate 5 step fix or concrete and specific guidance?
I *know* the Intraweb age has increased everyone's sense of entitlement and expectation of an easy fix on the first Google search page, but instead of trying to blame someone else for not being able to tell you what to do, completely, comprehensively and correctly, NOW, maybe these companies could have taken CEO bonus dollars and done their own research.
According to Iran, who is never wrong about these things as they will tell you themselves, We wrote this virus in collusion with the Zionist enemy. So why are we having to now go to all of this trouble to decode it?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
is that like with the events leading up to 9/11, various government entities still don't share information with other ones.
Until they fix that (isn't that what DHS was supposed to be for?) Iran is the least of their problems.
Analyze? Some say they scambled for creating it.
Boy is egg on their face over that one.
Can you be Even More Awesome?!
Where are the verifiable facts that support blaming the US or Israel? All I have heard are theories and suppositions but no supporting facts.
I live near this person gmhowell, and I think it's only fair that I warn you that he is a known psychotically dangerous schizophrenic. He recently escaped from a mental institution and was put there because he injured himself by masturbating non-stop for 3 days straight. He needs to take his meds, so please, would you all remind him of that? Thank you.
The U.S.A. Governmnet IS untrustworthy. Period!
DHS, how appaling. Such a reched motley crue of miss fits and anthro
FBI ... what a laugh. 30 years ago, under a "FORCED" technology upgrade program.
The Executive Office of the President of the United States of America. What a laughing stock! If Obama were a hermaphrodite, that would explain all of the the dissinformation.
Without Gitmo, Obama does not have a reason, nor rational to exist.
That is Obama's horror? Kill Gitmo, and Kill ....
You read it here first ... FBI!
Kill me? ....
Last I checked DHS are part of the US government. So all they needed to find out about stuxnet was to talk to their Federales buddies who helped create it.
get over to that windows 8 story and save it from being almost a puff piece.
The way I hear it, Idaho National Labs was able to quickly decode the worm since it was likely a weaponized exploit from a report they wrote. I'm betting when DHS got them involved, it was not their first time seeing this equipment as they audit our infrastructure all the time.
You do realize that "wipe off the map" is an English idiom, and that there is no equivalent in Farsi, don't you? That phrase was inserted by the Memri news service, a company founded by former intelligence officials (it's right on their web site) which "directly supports fighting the U.S. War on Terror," and which count on its board and staff such lunatics as John Bolton, John Ashcroft, and Eliot Abrams.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
You didn't get your tablet? You must be a bad, bad, bad boy, or God would have given you one. Have you been worshipping false idols or something? All of MY freinds have their tablets. And, I wouldn't leave the house without mine!
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
The reading that I've done on that subject included words to the effect, "Drive the Jews into the sea". I believe that GP may have inserted his own words with that "wipe off the map", or some author interpreted that before he read it.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
The more accurate translation is -
"The Imam said this regime occupying Jerusalem must vanish from the page of time."
The closest analogy I can think of is the "dustbin of history". In either case, it means that someone or something isn't a concern any more. Either it no longer exists or is no longer relevant. I agree that the statement isn't as militant as "wipe of the map", but it's still threatening.
In the land of the blind, the one-eyed man is usually crucified.
I've been working with SCADA and real-time control systems for 30+ years and I see one security hole cannot be plugged by any of the steps you mention.
Ultimately, data must be *analyzed*. Your telemetry files will have to be brought in some manner to an engineer's desktop for that. A system that has no way to transfer data to less secure networks is useless.
For me, the most secure control system would be a Linux system. In Linux, differently from closed-source OSes, you can configure exactly what's running. You can strip down the system to allow only the needed functions.
With Linux you can make the data transfer as unidirectional as possible, allowing downloads for analysis but uploads only in a very controlled manner for carefully vetted upgrades.
He said this:
We are very l33t now - we have learned how to pwn nuclear reactors LOLZ
The same folks who bring us the TSA.
Based on that alone, I can confidently say that they didn't learn anything from Stuxnet.
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."