Slashdot Mirror
Was Russia Behind Stuxnet?
An anonymous reader writes "Despite the U.S. and Israel being widely assumed to be responsible for Stuxnet, Russia is the more likely culprit, says U.S. Air Force cyber analyst. The nuclear gangsterism of the past 20 years gives it plenty of motive. Quoting: 'So what better way to maintain Russian interests, and innocence, than to plant a worm with digital U.S.-Israeli fingerprints? After all, Russian scientists and engineers are familiar with the cascading centrifuges whose numbers and configuration – and Siemen’s SCADA PLC controller schematics – they have full access to by virtue of designing the plants. ... the observers of the virus could alert the Iranians before full nuclear catastrophe struck. The Belarusian computer security experts who 'discovered' the code seemingly played that role well. They didn't seem too preoccupied with reverse engineering the malicious code to see what it was designed to do.'"
Let's all trust the U.S. propaganda machine. It was the Russians.
Centrifuges can't cause a catastrophe, other than of the "oh shit my centrifuge just came apart and shredded my lab" kind. There is not a nuclear chain reaction to go out of control here.
My amazing wife - Artist, Author, Philosopher - Laurie M
That's the only logical explanation.
Well, the centrifuge itself doesnt. But if it somehow infects a critical PLC, like say the one that controls reactor rods, or ventilation, or whatever.
Point being, something other than centrifuges could get infected, and that something could be bad.
Governments would be wise to focus on securing the code they use rather than attacking the enemy. We already have attack capabilities and adding hack capabilities may not be nearly as valuable to nations with significant resources. On the technical front though ANY tiny nation or group with even few resources can threaten you if your code is bug ridden.
Beyond the obvious fact that we will never know for sure who actually created it, it seems pretty naive to think a US 'cyber analyst' would say or even think anything different. After all Israel is a close US ally so it isn't like they would be interested in "telling the truth". It's like the boy who punches the other boy behind the teacher's back, of course he is not going to rat itself.
So how is this a credible source? Maybe if it came from a team of international security researchers with evidence or something I would deem it a valuable piece of analysis.
I kinda see this "research" as the ones conducted by Microsoft to evaluate IE, or Google to do so with Chrome and, oh surprise, they always come ahead. More like a political thing to say than any actual useful information or analysis being brought to light.
Slashdot. Unreadable news to annoy nerds. - wonkey_monkey
And it's unlikely the government could be bothered with this elaborate conspiracy, the modus operandi seems to be to take Iranian money and just never finish the projects since off the record Russia doesn't really like Iran anymore than anybody else does. Probably what really happened is that USA or Israel tracked down some Russians working on the project and gave them some giant piles of money in order to do plant some virus they'd made. After this went through a lot of Russian scientists got scared because Iran was interrogating everyone to try and find out who was responsible.
Having said that a lot of people think Iran wont nuke Israel because that'd kill arabs too, or that they're not insane or that USA/Russia has nukes too so it's no different. The main difference is someone like Putin is primarily interested in being a crime boss, he has no inherent desire to wipe some places he doesn't like such as Washington DC off the map. Iran on the other hand does when not slaughtering their own people does foreign policy things that don't really make sense like bombing some Jews in Argentina which had no practical benefit for Iran. They're rather juvenile as can be seen by the way they make their cute little American flag with skulls instead of stars last week. I think it's more likely they'd try to detonate a bomb through the Lebanese border to make things look more ambiguous than launch a traceable missile from Tehran. Yes that'd kill a lot of muslims too, but so did their chaining soldiers together and forcing them to march into gas attacks strategies during the war with Iraq.
No.
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
its entirely possible to run an entire nuclear power plant from the control rod insertion to button that opens the front gate off a single Siemens PLC, e.g. their S7-400 with a big CPU. off the CPU comes Profibus which can go directly to input sensors, pnumatic valves, HMIs. The profibus is quite a safe thing, becasue it is just RS485 underneath. The new thing that siemens is touting is profiNET, which as the name implies is just the profibus protocol over ethernet. with control systems running off ethernet is fine, but siemens also do DIN mount 100mb/s ethernet switches where anyone can plug a laptop in and stop/start/upload more code to the entire network with their prodave application.
all i needed to see was "An anonymous reader writes:" and the-diplomat.com, this is blatant propaganda -100 score It has no newsworthy merit is inaccurate in many ways as has already been pointed out by others (centrifuge's causing meltdown???) i know america is pissed about getting caught red handed with this, and also about the missile shield debacle http://www.reuters.com/article/2011/11/24/us-russia-medvedev-missiledefence-idUSTRE7AN1NE20111124 that's currently ongoing but how is aggravating Russia going to help in either matter?
Their scientists are under a lot of pressure from the government Mullahs to finally get that bomb finished. Faced with insurmountable technical problems, the scientists decided to make it look like their project was sabotaged by their enemies: Israel and the US. So they wrote a virus and infected themselves with it.
So now their scientists have some more time, and the Mullahs are happy, because they can play the thing up with their own people and the international theater.
Ditto on that US drone thingie.
If you don't like that one, I'll half-bake another wacko conspiracy theory the next time this story pops up again.
Maybe I could make the "27 Club" responsible . . . ? Robert Johnson, Brian Jones, Jimi Hendrix, Janis Joplin, Jim Morrison, Kurt Cobain and Amy Winehouse are not really dead, but are writing viruses on Marlon Brando's island near Tahiti . . .
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
I don't know. This seemed like a pretty specifically targeted piece of hardware.
Dumbing it down a whole bunch here, but say that the virus modifies the CENTRIFUGE_MAX_SPEED variable from X to X+100 or something. It's affecting a specific piece of software. It's not as if the ventilation or reactor rod system run on the same software, and even if they did it would be doubtful that they would be affected by the same command.
Random Thoughts From A Diseased Mind (Not For Dummies)
Cause in case of a sheep missing, you trust the wolf on saying it was really the bear. Riiiight. ^^
The only thing I know for a fact, is that I have not experienced any of it with my own senses, and so everything I think I "know" about this subject comes from other people, probably all of which have also not experienced it with their own senses but gotten it from even more sources, and so on and so on. With everyone in all those chains having their own set of perceptive biases in their senses and brains, and their own interests. I can choose who to trust and who not. But most people just trust whatever fits their own model of reality best, disregarding that it might be wrong. And the same is true for everyone of you too.
So unless it has a noticeable effect on me personally, instead of wasting my mental resources on this, I use them for something that has a bigger effect on improving my life and keeping what I have. How about you? :)
Great, so you don't even know if Mexico is a real country existing south of the US.
Except that's not how you do it. If your PLC is controlling vital equipment you A) use a password . B) Have the PLC set so that online (means when the PLC is running) program changes are not allowed and C) run redundant PLCs so if there is ever a switch of code in one of them (by a worm etc.) that PLC is locked out and measures taken. However when controlling a Centrifuge one probably wouldn't use redundant PLCs. When it comes to profibus vs. Profinet I would say that the fieldbus has very little to do with security. Most modern PLCs have an ethernet connection for talking to higher level systems anyways no matter which bus you use at the field level. Also anyone WHO can write a virus for a PLC is capable of buying one of the many different devices for connecting to a Profibus or MPI port of a Siemens PLC. /Industrial-programmer (not in nuclear area)
It's just assumed that Stuxnet is SOOOO advanced that only a nation-state could devise this zero-day infiltration into the centrifuge system of Iran.
Why assume that nation-states are behind it, and not corporations? A lot of companies would be hard hit if Iran became a threat to stability. Even major defense contractors, who profit from building weapons, would see little upside in a conflict with Iran.
The news and the internet buzz all say that it has to be a government backed thing, but what if it is simpler than that? It is far simpler to imagine that a private concern is behind it. They can pay for the talent. They have as much at stake as any government.
As long as one of them isn't Gordon Freeman, a cascade event isn't likely to occur...
"Do you suppose that's why God lives in the Heavens? Because he lives in fear of His creations?" - Steve Buscemi
It is. For a start, the centrifuges aren't full of uranium. They are full of uranium hexafluoride, a gas. No possibility of it going critical. The worst case scenario would be that containment is ruptured and the gas escapes - it's nasty stuff, about a ten on the flesh-melt-o-meter, and will quite happily burn though walls and boil the skin off of anyone who gets in it's way. If that happens it'll kill a few workers and completly destroy the centrifuge, but that's all. No boom.
Citizen! It's always the Commie Mutant Traitors!
Really? "nuclear gangsterism"? This is a pretty specific phrase, out of a specific book. It doesn't exist anywhere else on the internet but in summaries about that book, and in this slashdot article. Anyone care to comment on how this phrase ended up in the slashdot summary?
moox. for a new generation.
http://crudeoilpeak.info/iran-crude-oil-decline-to-2016
They'll be able to continue exporting for a few years, 5-10. Then their internal consumption hits production and starts declining. This is when the shtf and people start dying.
So... What choices do they have? Given the history of the external manipulation of their country they appear quite rational.
Deleted
Sorry if I am wrong here, but are you not just producing wild theories here? Surely you don't know what Stuxnet intended to do, so how could you rule that it could not have caused a nuclear catastrophe?
There was an analysis by German researchers that he bases his information on.
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/all/1
http://www.ted.com/talks/ralph_langner_cracking_stuxnet_a_21st_century_cyberweapon.html
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
typically the output of centrifuges is chained together. the output of the last centrifuge is much more enriched than the first. and where does the output of the last centrifuge go? to some holding tank? what if that last centrifuge has an accident that affects the holding tank? http://en.wikipedia.org/wiki/Gas_centrifuge
we dont know the specific layout of their centrifuge operation. what if they are using some sort of arrangement we dont know about?
yes it is incredibly, massively unlikely. on the other hand.
that is the same attitude held by the various managers and dead people you can find described in this article:
http://en.wikipedia.org/wiki/Criticality_accident
the FOIA sites at fbi.gov and cia.gov are full of bizarre, unbeilevable stuff.
is it likely that the US military deliberately administered LSD to people to see if it would be a good mind control drug, and that one of them leaped out of a window and died? no, but it happened.
is it likely that the Nazi government was thoroughly penetrated with Soviet agents? no, but it was.
is it likely that Israel and it's neighbors would go to war in 1967? No, but they did.
is it likely that Israel would repeatedly shoot and napalm a ship flying a huge US flag? no, but it happened.
is it likely that the head of the US OSS would come up with a plan to invite NKVD officers to the US for 'joint exercises' with US law enforcement? No, but it happened.
is it likely that the Department of Justice would charge someone with Espionage for telling a journalist that North Korea would probably test a nuclear weapon? No, but it happened.
As a european we distrust the Russian's a lot more than the American's [sic]
As another European, I disagree. I don't trust any rich and powerful country that could blot out my country any time it felt like it, and whose government is strictly interested in looking after those people who look after it (clue: not necessarily the voters). Either Russia or the USA (or China or the UK or France or Israel or India...) could be bad news for the citizens of another nation, and anyone who trusts the powerful to act against their own interests out of sheer altruism needs his head examined. It may be true, of course, that Russians are more inclined to tell it as they see it, and less inclined to dress things up in fancy moral terms, than Americans (or many other "Westerners").
Thucydides nailed this more than 2400 years ago:
"...[R]ight, as the world goes, is only in question between equals in power, while the strong do what they can and the weak suffer what they must".
If you haven't read about the Melian Dialog, you really should: https://en.wikipedia.org/wiki/Melian_dialogue (the complete text is at http://www.mtholyoke.edu/acad/intrel/melian.htm). It tells you almost everything you need to know about international politics.
I am sure that there are many other solipsists out there.
its short for 'catastrophe bonds'. hedge funds buy and sell them so they can get rich when there is a hurricane, tornado, or 9/11 style event. people will absolutely profit from this war.
secondly, the stock markets do not crash during wars. they crash when investors realize theyve been being scammed and duped by fraud for years on end by 'financial professionals'. (1929, 1987, 2008).
thirdly, the bond markets go apeshit during war. governments love LOVE LOVE to borrow money during war. that means bonds. bonds out the ass.
fourthly, we now have these things called 'credit default swaps', which are essentially gambling on the bond market. they will go super triple-dog ape shit when there is a war with iran, and the investment banks that hold them like JP Morgan, Goldman, Morgan Stanley, Deutsche Bank, Paribas, etc etc etc, will make tons of money.
and since JP Morgan is feeding intelligence to the US government (if you dont believe me, do a search for 'jp morgan' in the wikileaks files) they have even more of an inside edge.
and i wont even get into 'mortality swaps' and 'longevity swaps'.
why do people write shit for slashdot? because they are intensely interested in a subject.
why are they intensely interested? because the subject moves them emotionally.
you have an inherent conflict of interest. you need to be emotionally detached to be a good reporter, but you wouldnt be writing in the first place (for free no less) unless you had some emotional spark that inspired you to do it.
normally, editors will balance the emotions of the reporter, but slashdot editors often leave stuff in that a newspaper editor might remove. on the other hand, newspaper editors are increasingly beholden to their corporate masters these days. so whatever.
when i wrote a story saying an innocent man was innocent, people said i was being too emotional. well, i disagreed, but i cant disagree that it is right to question authors about this type of thing. its the nature of writing.
That really glosses over the importance of the centrifuges. They are massive, expensive machines to replace, and they directly handle the material. If failure occurred during operation (which was exactly what Stuxnet was designed to do), then on top of losing the machines, the nuclear material itself would be lost. The centrifuges are a critical part of the entire program, and their loss set Iran back years. It's unlikely that "full nuclear catastrophe" was ever a plan, given Stuxnet's precise design. Iran under a nuclear fog makes for bad PR, after all.
For those of you who haven't read it, here's a great summary of the unravelling of Stuxnet, the key players, and conclusions made. Or you could listen to the US cyber analyst blame "them Ruskies".
If the US wanted to, they could have nuked the entire Muslim world after 9/11, given the popular mood in the country.
Not without facing enforced disarmament and decades of sanctions from the rest of the developed world. This is a very bad American stereotype you are bandying around here. 'We can do what we want because we got the bomb and people should be grateful we don't just nuke them into the stone age..' There is a whole world out there and America becoming a rogue nuclear state would not go down well with the rest of it.
... but Russian immigrants living in and working for Israel. The name "Stuxnet" can be transliterated to "will rot" in Russian. Which was exactly what the Iranian equipment did.
While the differences between Iranians and Arabs, Shias and Sunnis are real, it's a mistake to think that they never collude. For instance, Tajikistan, whose language is a Farsi derivative, is allied to Iran in spite of being a Sunni country. Likewise, Azerbaijan, whose people are of Turkic origin, just like Turkey, Kazakhstan, Turkmenistan, is allied to Turkey again in spite of being a Shia country.
It's also worth noting that Iran, despite being Shia, backs Sunni organizations like Hamas, in addition to its own proxy Hizbullah. Similarly, during the 80s war between Iran and Iraq, while much of the Arab world, except Syria, backed Iraq, Libya chose to back Iran. These things are not set in stone. While locally, Shias and Sunnis can't stand each other and often either riot or carry out terrorist acts (e.g. Sipah e Sehaba in Pakistan is a Sunni terror organization that takes it out on Shias), they have no problems allying with the other type of Muslims outside their countries when it comes to a war against Infidels.
It all kind of depends on how rationally the mullahs operate.
I'm pretty sure that the concept has been communicated to the Iranians, either semi-directly through back channels or through other third parties that any use of a nuclear weapon against the US or its "close allies" will result in overwhelming nuclear retaliation, the kind that might cause one to question the future of Persian culture centered around Iranian geography.
It's long been rumored that the Israelis have indirectly communicated that any NBC attack will result in nuclear retaliation against all Arab capitals and major Islamic religious sites, allowing for a certain group restraint among Arab countries not wishing to see their capital vaporized should a neighbor's anti-Israeli action get too heated.
And don't think for a second that the Soviets or the Chinese would say a word -- poking a stick at the US via Iran is valuable to the Soviets and the Chinese, but it's not worth trading nuclear strikes with the US.
One would think that Iranian leaders would take this into account when doing the calculus on nuclear weapons. Are they even worth having, outside of defensive use within their own immediate political theater? Would the cost of development be better spent on something else -- a home-grown cruise missile, long-range missile, some other expenditure?
That being said, the mullahs may not be rational -- they may be given to magical thinking and have some kind of literal belief in religion that might cause them to not care. We've certainly seen enough rank-and-file religious nuts blow themselves up.
It doesn't make the slightest sense. A strong Iran is in Russia's interest. If Russia wanted to keep Iran from building a bomb they could just stop supplying nuclear fuel and know-how. Or they could sabotage those plants in much more direct ways because they have access.
And if the Israeli military is not involved they're certainly playing their role well. They seem to be quite proud of Stuxnet -- rightfully so, except that they should have concealed it longer. That "the US defence and intelligence communities" might have been "caught with their pants down" is not an argument. Not everything Israel does is vetted by the US. Frankly, if I were an Israeli official I would prefer not to involve US agencies, because they have little to contribute and are a security risk.
"Trust us! We'll give you 25% MORE smoke and mirrors that the other brand of perception management!"
"Flyin' in just a sweet place,
Never been known to fail..."
Ahmadinejad doesn't just not get along with Israel, but calls out for the destruction of Israel pretty much any time there's an open microphone nearby
You're aware this was a (I assume deliberate) mistranslation of what was actually said? Google "Iranian mistranslation". It is however convenient for those who want war to repeat the propaganda.
He does so even though Israel has never done anything bad to Iran
You have evidence there have been no covert attacks? Your sources are clearly better than most. There are strange explosions happening in Iran at strategic sites. You think they are accidents? Who is the most likely culprit? Who is the most likely culprit for stuxnet?
You also forget that Iran spends millions of oil dollars every year funding terrorist organizations whose sole purpose is to harm and kill American and Israeli civilians.
Perhaps they see themselves as freedom fighters.
You are looking for simple black and white, good and evil; like the movies, and the people who's agenda that serves will be more than happy to serve it up to you on a platter. You should just go back to staring slack jawed at the TV and let your superiors get on with whatever it is they want to do. The very last thing you should ever do is question what you are told.
Deleted
Why would the U.S. nuke some of its closest allies in the Middle East, including countries and governments that it has pledged to protect, and who in turn supply the U.S. with large amounts of oil? It makes no sense.
Bullshit. Nuking the entire Muslim world would have been entirely possible in the context of the times.
Sure. So would nuking France. Or Great Britain. Or even ourselves (you do know we have more than twice the Muslim population of Djibouti; genocide starts at home). Nobody is saying it wasn't *physically* possible to nuke anyone, or *everyone* for that matter.
The real question is whether it was *politically* possible. The answer is no. In part this is because *George W. Bush* had too much sense to even consider that, but the *main* answer is that Americans as a whole would not have stood for it. Religious tolerance has been a basic American value since the founding of our country, and modern Americans as a whole have little enthusiasm for genocide. A somewhat smaller number would have opposed it purely on the obvious grounds that it would have been a disaster for ourselves (disrupting oil supplies, destroying the international economy, risking a global environmental radiological disaster and possibly climatic disruption that could disrupt agriculture even in this country).
That's not to say that *some* Americans don't hold to mainstream values of religious tolerance, dislike of pointless slaughter, and pursuing enlightened self-interest. In a nation of three hundred million the lunatic fringe is loud enough to make a lot of noise.
For that matter, we have our share of people who can't distinguish between things that are *possible* and things that are *advisable*, as can be readily seen in this discussion. Naturally one wouldn't entrust them with making more difficult distinctions, like between *right* and *wrong*. The primary mental defect of these people seems to be that when they feel the impulse to take some action they are incapable of considering whether it has any unintended consequences. In the old days before political correctness we had a name for such people. We used to call them "fools".
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
What I said was completely correct, it can not go critical nor can it level a city block. The specific term for a block levelling reaction is I believe is "high yield prompt criticality excursion", which sounds terrible and didn't need to be said. Criticality is something achieved in nuclear reactors and nuclear bombs, it is not achieved in centrifuges, even when they fail, thus there is no energy release beyond the normal energy released by nuclear decay. Furthermore, that plant you live near does not blow up precisely because it is designed not to, with moderators and coolants. Should its fuel rods be stacked together outside by some guy who wants to make a fort, the situation would be quite different (though 5% enriched really doesn't have much ability to actually blow up).
When Argumentum ad Hominem falls short, try Argumentum ad Matrem
Russia is actually working WITH Iran on their nuclear program - have been for a couple of decades now. That's the reason they didn't take part in the coalition in the first Gulf war; they were trading nuke parts for oil. This is just misdirection on the part of the U.S. - a denial that is a form of confirmation. I recently spoke to someone who works at a DoD facility devoted to cyber-security. Our conversation was going fine until the word Stuxnet left my lips. At that point, he didn't utter another word. And I wasn't asking him for information, just expressing my admiration for the handiwork - whoever's it was. Another denial that looks like a confirmation.
They aren't counterexamples because nation-state conflict is completely different than what happened on 9/11.
You can insist all you want, but the American public was not up for nuking Afghanistan after 9/11. You'd have seen that 91% evaporate pretty quickly, a majority of Americans believe that the US should only use nukes only in response to a nuke attack.