Slashdot Mirror
DHS Chief: What We Learned From Stuxnet
angry tapir writes "If there's a lesson to be learned from last year's Stuxnet worm, it's that the private sector needs to be able to respond quickly to cyber-emergencies (CT: Warning, site contains obnoxious interstitial ads. Blocker advised), according to the head of the US Department of Homeland Security. When Stuxnet hit, the US Department of Homeland security was sent scrambling to analyze the threat. Systems had to be flown in from Germany to the federal government's Idaho National Laboratory. In short order the worm was decoded, but for some time, many companies that owned Siemens equipment were left wondering what, if any measures, they should take to protect themselves from the new worm."
#1 thing learned from Stuxnet:
Air-gap your production SCADA/embedded stuff.
so:
1.) keep not only production but all but communication system from the Internet
2) do not allow removable media to the users, apply extreme caution to 'upgrades'
3) verify by viewing the source code ( or let it be done by 2 or more separate parties )
-
you have no source code? forget your IT security!!
What they should have done:
1) anyone bringing in flashdrives and plugging them into mission critical should be taken out back and shot, or at least given a stern talking to. Autorun should be disabled
2) Any machines brought into from the outside (laptops etc) should be placed on a separate, untrusted network
3) Mission critical machines shouldn't be on a network. If that isn't possible, they should be on a separate network or vlan with only the machines they need to talk to, at the very least they shouldn't be able to access the internet
4) Always ensure that all security updates are applied promptly and all relevant hardening is performed
5) At the first sign of such a massive infection across multiple machines and devices, everything should have been taken offline, wiped, flashed, and reinstalled and brought up again on a know clean environment, with security procedures tightened.
6) If all of your machines are running version X of OS Y, they will all suffer from the same 0 day attacks. Diversity, where appropriate, is useful.
This may not have prevented a infection, but it would have definitely reduced its impact. I really question the competency of any IT person that had no idea what to do.
Ralph Langner: Cracking Stuxnet, a 21st-century cyber weapon
http://www.ted.com/ When first discovered in 2010, the Stuxnet computer
http://www.youtube.com/watch?v=CS01Hmjv1pQ
In short he shows/claims US was behind it.
There are no stupid questions, Just a lot of inquisitive idiots. (from a good friend)
Don't know much about the Iranian nuclear power program, do you? Even though I grew up in northern Michigan it still amazes me how gleefully people suck down even the most blatant of propaganda and believe it like they had personally been handed engraved tablets by god.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
If you want to keep your involvement a secret you need to react normally. Best way to do that is not tell the guys who react to this stuff (until they get too close, then you tell their boss's boss's boss's boss to put a cork in it.)
We created it! http://www.vanityfair.com/culture/features/2011/04/stuxnet-201104/
I thought the US wrote this? I still think it was Canada.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
wait...we needed a conspiracy nut to inform us that Stuxnet was written by the CIA??? i cant be the only one that figured it out a year ago. But really why is it a surprise. this is basic espionage.
they say it is often more relevant then the comment above, all we know is its called the Sig!
1) Warn Boss of vulnerabilities
2) Boss asks for time/cost estimate to fix
2a) Boss brings estimate to talking-head meeting
2b) people protest about their job process changing
3) estimate sits on Boss's desk for 3 months
4) Boss golfs with his sis's brother-in-law and they talk security
5) Boss comes to work next day, calls meeting about security
6) You remind him of estimate on desk for 3 months
7) meeting devolves into yucks about golfing/hangover
8) Boss calls you into office after meeting
9) Asks you to pick two of the "hottest" security bullets in your list
10) time/cost gets approved for two of the 10 security items
11) system eventually gets compromised
12) everyone runs amok, asks how is this possible
13) Boss approves 8 remaining security bullets
14) Goto 1
Glad I don't do security anymore.
boycott slashdot February 10th - 17th check out: altSlashdot.org
~Sticky
/My opinions are my own.
I thought they would have learned that with enough private sector forensics, everything gets traced back to them? Didn't DHS in Conjunction with Siemens and Israel write this?
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
That's lesson one from about 1975. We have no excuse at all for this elevated privilige bullshit today.
Whats the latest threat from imagination land?
step 1: Log into your SCADA environment and observe controllers accordingly
step 2: issue commands to check if you are you an active ally of the United States government with regular trade and economic ties and no dissenting opinion of its policy?
step 3: log out of your SCADA environment, sigh despondently as you lift your hands from the Dell keyboard, pick something off the value menu at McDonalds for lunch today.
Good people go to bed earlier.
"...but for some time, many companies that owned Siemens equipment were left wondering what, if any measures, they should take to protect themselves from the new worm."
The implication of this statement is that DHS didn't have an immediate answer (outside of pedantic default answers like "unplug your equipment" or "reload software" or anything else from answers.com).
Gee, let's see -- a new worm never seen before, apparently written by a sophisticated group from the intelligence community and someone's actually surprised that there was no immediate 5 step fix or concrete and specific guidance?
I *know* the Intraweb age has increased everyone's sense of entitlement and expectation of an easy fix on the first Google search page, but instead of trying to blame someone else for not being able to tell you what to do, completely, comprehensively and correctly, NOW, maybe these companies could have taken CEO bonus dollars and done their own research.
According to Iran, who is never wrong about these things as they will tell you themselves, We wrote this virus in collusion with the Zionist enemy. So why are we having to now go to all of this trouble to decode it?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
is that like with the events leading up to 9/11, various government entities still don't share information with other ones.
Until they fix that (isn't that what DHS was supposed to be for?) Iran is the least of their problems.
Boy is egg on their face over that one.
Can you be Even More Awesome?!
Where are the verifiable facts that support blaming the US or Israel? All I have heard are theories and suppositions but no supporting facts.
Last I checked DHS are part of the US government. So all they needed to find out about stuxnet was to talk to their Federales buddies who helped create it.
get over to that windows 8 story and save it from being almost a puff piece.
The way I hear it, Idaho National Labs was able to quickly decode the worm since it was likely a weaponized exploit from a report they wrote. I'm betting when DHS got them involved, it was not their first time seeing this equipment as they audit our infrastructure all the time.
You do realize that "wipe off the map" is an English idiom, and that there is no equivalent in Farsi, don't you? That phrase was inserted by the Memri news service, a company founded by former intelligence officials (it's right on their web site) which "directly supports fighting the U.S. War on Terror," and which count on its board and staff such lunatics as John Bolton, John Ashcroft, and Eliot Abrams.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
You didn't get your tablet? You must be a bad, bad, bad boy, or God would have given you one. Have you been worshipping false idols or something? All of MY freinds have their tablets. And, I wouldn't leave the house without mine!
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
The reading that I've done on that subject included words to the effect, "Drive the Jews into the sea". I believe that GP may have inserted his own words with that "wipe off the map", or some author interpreted that before he read it.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
The more accurate translation is -
"The Imam said this regime occupying Jerusalem must vanish from the page of time."
The closest analogy I can think of is the "dustbin of history". In either case, it means that someone or something isn't a concern any more. Either it no longer exists or is no longer relevant. I agree that the statement isn't as militant as "wipe of the map", but it's still threatening.
In the land of the blind, the one-eyed man is usually crucified.
Actually, you are being conspiratorial. You didn't cite any references; which places did you read this and what evidence do they have? You then made an allegation concerning a high profile disaster. So, you're being alarmist also.
In the land of the blind, the one-eyed man is usually crucified.
I've been working with SCADA and real-time control systems for 30+ years and I see one security hole cannot be plugged by any of the steps you mention.
Ultimately, data must be *analyzed*. Your telemetry files will have to be brought in some manner to an engineer's desktop for that. A system that has no way to transfer data to less secure networks is useless.
For me, the most secure control system would be a Linux system. In Linux, differently from closed-source OSes, you can configure exactly what's running. You can strip down the system to allow only the needed functions.
With Linux you can make the data transfer as unidirectional as possible, allowing downloads for analysis but uploads only in a very controlled manner for carefully vetted upgrades.
The same folks who bring us the TSA.
Based on that alone, I can confidently say that they didn't learn anything from Stuxnet.
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."