US, Israel Behind Flame Malware

The Washington Post is reporting that the sophisticated 'Flame' malware was created by the United States and Israel in order to collect intelligence on Iranian computer networks. The intel was to be used in a cyber-sabotage campaign intended to slow Iran's development of nuclear weapons. This follows confirmation a few weeks ago that the U.S. and Israel were behind Stuxnet, which caused problems at Iran's nuclear facilities. From the article: "The emerging details about Flame provide new clues to what is thought to be the first sustained campaign of cyber-sabotage against an adversary of the United States. 'This is about preparing the battlefield for another type of covert action,' said one former high-ranking U.S. intelligence official, who added that Flame and Stuxnet were elements of a broader assault that continues today. 'Cyber-collection against the Iranian program is way further down the road than this.' ... The scale of the espionage and sabotage effort 'is proportionate to the problem that's trying to be resolved,' the former intelligence official said, referring to the Iranian nuclear program. Although Stuxnet and Flame infections can be countered, 'it doesn't mean that other tools aren't in play or performing effectively,' he said."

Comments

Duh - Who else would have done it?

[Gothmolly]

I mean seriously? Who else besides the Israelis a) hate Iran and b) have the technical chops to do it?

Re:Duh - Who else would have done it?

[DynamoJoe]

Sabotage: yes. Cyber terrorism? No. Warfare, yes, but not terrorism.

Re:Duh - Who else would have done it?

[girlintraining]

I mean seriously? Who else besides the Israelis a) hate Iran and b) have the technical chops to do it?

Believe it or not, we're not the most technologically sophisticated country. China has more honor students than we have students. Most of Europe has a more developed telecommunications infrastructure than we do; internet, mobile phones, cable tv, you name it. We are not number 1.

As to who else hates Iran and has the capability to do something about it... it should be pointed out we don't hate Iran. We hate any country who tries to acquire nuclear weapons. Something the size of a suitcase can destroy a major city... it's why we worked so damn hard with the Russians to disarm as many of them as we could. Not every country will play nice: Some of them will do whatever it takes to beat their enemies, even if that means killing themselves in the process. Unfortunately, all the countries currently working on making nuclear weapons fall into that category, including Iran.

The only reason we're fucking around with 'cyber' warfare instead of curb stomping them is it's an election year and our economy is in ruins thanks to fighting two unnecessary wars based on our President deciding to finish what his daddy started rather than leave well enough alone, and our country having a momentary fit of stupidity where we had to kill everyone and everything wearing a funny hat because a couple of our sand castles got kicked over by a bully.

Re:Duh - Who else would have done it?

[Anonymous Coward]

I can kinda see both arguments, but "We're spying on your obviously high profile nuclear program" and "our virus broke some of your enrichment hardware", probably just don't have the same shock and terror as "someone just randomly blew up a bus with your family in it". If you find yourself going to the dictionary to figure out if something is terrorism, you're trying too hard.

Though when the Israelis sent people to execute Iranian nuclear scientists and such... that might well qualify in a more traditional way.

Re:Duh - Who else would have done it?

[Dahamma]

It's hard to claim that the primary *intent* was to incite fear when it was created to be so stealthy it may have been running for years without anyone even noticing...

To quote a well-respected Dr. on the subject... "Of course, the whole point of a Doomsday Machine is lost, if you *keep* it a *secret*! Why didn't you tell the world, EH?"

Re:Duh - Who else would have done it?

[SeaFox]

You seem to be assuming that Obama is actually behind this. The three letter agencies that make up the U.S. government don't ask for the President's approval every time they want to tie their shoes.

Re:Duh - Who else would have done it?

[dpilot]

Which scares you more, Stuxnet and Flame, which at the very least appear to have been fairly specifically targeted, or Iran with nuclear weapons?

In another way, at least Stuxnet and Flame have come to light, show us what's possible, and start us thinking about how to counter. Imagine a world where such capabilities had been kept in the dark until used on a public infrastructure attack.

Re:Duh - Who else would have done it?

[InspectorGadget1964]

What scares me most, is Israel's nuclear weapons, not Iran's. Iran does not have any yet and so far, no proof has been provided that they actually are planning to produce them. Furtermore, if such a "proof" were provided by the US would have the same validity as the proof that Saddam Hussein had chemical, biological and nuculear (It is not a typo, I'm mocking W.) weapons. Would most probably be just another lie.

Re:Duh - Who else would have done it?

[symbolset]

Israel has had nukes for a very long time and not hurt anybody with them. When somebody new gets nukes we have to worry if they'll settle a grudge right away.

Re:Duh - Who else would have done it?

[Anonymous Coward]

"We hate any country who tries to acquire nuclear weapons."
This sounds funny from a country that has massive number of nuclear weapons and which has a history of aggression against the native people of the region.

Re:Duh - Who else would have done it?

[Anonymous Coward]

> Which scares you more, Stuxnet and Flame, which at the very least appear to have been fairly specifically targeted, or Iran with nuclear weapons?

A loaded question. I'm either with you or with the terrorists? I fear the US more than any other country, but I think the US fears any other country more than I do the US.

Re:Duh - Who else would have done it?

[Tom]

Which scares you more, Stuxnet and Flame, which at the very least appear to have been fairly specifically targeted, or Iran with nuclear weapons?

That's so easy, it's unfair: Stuxnet and Flame, of course. They already have caused considerable damage on a wide scale, and while they are targeted, it would be way too easy to re-target them on something that matters to me.

Iran with nukes, on the other hand, is still theoretical, still has a long way to go, and even if they had nukes the chances are 99:1 that they would use them for MAD and not actually use them and even if the extremely remote chance of a nuclear detonation came to pass, it would almost certainly not affect me in the slightest.

And, quite frankly, I don't buy nuclear fearmongering coming from the only country ever to actually drop nuclear bombs on civilian cities, twice.

Re:Duh - Who else would have done it?

[AliasMarlowe]

Besides, Israel itself has described cyberattacks as terrorism.

So that implies Stuxnet was "state-sponsored terrorism". In which case, the US should add itself to that list it keeps...

Re:Duh - Who else would have done it?

[dpilot]

> the only country ever to actually drop nuclear bombs on civilian cities, twice.

True, and the US has used nuclear blackmail more than any other country, regrettably.

But there is another perspective on having used the nuclear bomb in war - historical necessity. There are many who say that a "demonstration event" would have sufficed, that the nuclear bomb need never have been used in war. Unfortunately I don't believe that. I don't believe that there would ever be sufficient fear of the nuclear bomb until it had actually been used to demolish a real city and kill real people. Also unfortunately, there was a very narrow window when that could be done "safely" - without the threat of a full-fledged nuclear exchange. That was the few years when the US had the Bomb and the USSR didn't.

Plus if you ever studied the period, you'll see that many feel that using the bomb saved at least a million lives on both sides - the cost of a protracted air/sea/land war in the Pacific. Even the Hiroshima bomb didn't convince Japan to surrender - they felt that there could only ever be one bomb like that. After Nagasaki, the surrendered because they thought that we could just keep dropping bomb after bomb like that - the first one wasn't unique. What they didn't realize was that at the time we'd made 3 bombs, Trinity, Hiroshima, and Nagasaki - that we'd shot our wad. I don't know how far in time we were from a fourth, and I don't know how Japan would have acted had they known we couldn't do it a third time, even.

When we do it to you

[niftydude]

it is an act of espionage and sabotage proportionate to the problem that is trying to be resolved.

If you do it to us, it will be considered an act of war.

Re:When we do it to you

[artor3]

You're referring to a previous story that you misinterpreted to mean that the US would consider cyberattacks to be an act of war. What that story actually said was that cyberattacks against certain key infrastructure might be considered an act of war if it were serious enough. Quoting:

If a cyber attack produces the death, damage, destruction or high-level disruption that a traditional military attack would cause, then it would be a candidate for a "use of force" consideration, which could merit retaliation.

That basically says that they won't rule out military force in certain extreme cases. Nor should they.

And for Iran's part, if they'd like to consider Stuxnet to be an act of war, they can. Heck, they could consider Obama forgetting to say "bless you" after Ahmadinejad sneezes to be an act of war. That's the fun thing about the word "consider". But they won't, just as they didn't consider Israel's assassination of their nuclear scientists to be one.

I'm sorry that international espionage isn't as cut and dry as you'd like it to be, but that's just how it is and has been for most of history. There were pretenses of chivalry in Europe (and likely other places) for a time, back when royalty was a good ole boys' club and the peasants would be the ones dying. We're past that now, and I for one am glad of it.

Re:When we do it to you

[Anonymous Coward]

in other words... if someone were to inject a cyber attack on say... or nuke facilities??? posted anon due to moding

Re:When we do it to you

[Darkness404]

However, there is a double standard. Iran is trying its best to be recognized by the international community as a modern Islamic democracy, Obama is looking for more blood to put on his Nobel Peace Prize. The American public on both sides of the political aisle are crying out for another war and even the smallest thing could set off a "drone war" leading to a full-scale conflict.

Re:When we do it to you

[artor3]

And if a normal person builds an aircraft carrier and conducts military exercises in national waters, they'd also go to prison. What is your point? If a government isn't allowed to do things that individual citizens can't, then it's not a government. It's a social club.

Re:When we do it to you

[demachina]

The U.S. law on computer intrusions specifically exempts law enforcement and intelligence agencies:

"(f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States."

This is the price we pay for electing people who are willing to criminalize nearly every action of ordinary citizens, and almost no action by government officials, even when they engage in actions that most people would consider criminal.

For example:

- torturing people
- computer hacking
- spying on people without a warrant
- snatching people for rendition in violation of the laws and sovereignty of the countries where they are snatched
- holding people, sometimes the wrong people, in indefinite detention without a hearing
- assassinating people including U.S. citizens without a trial
- using drones to assassinate people, often innocent civilians, in countries where no state of war exists while violating the sovereignty of nations we are not at war with

This list goes on for a long time so I'll stop now.

Re:When we do it to you

[artor3]

Oh come on, you know full well that Stuxnet was targeting the centrifuges. Screwing with centrifuges is not going to take their power grid offline, and it's certainly not "risking the lives of Iranian citizens". You're either being dishonest, or you are woefully ignorant of how nuclear power works.

As for your support, I couldn't care less about it, and I've certainly never said anything even remotely like "they hate our freedoms".

Re:When we do it to you

[Anonymous Coward]

The point is the hypocrisy, as in when the US promptly killed more civilians by bombing Afghanistan just after 9/11 than had died on 9/11 and few Americans seemed to notice -- as in Israel condemning Iran's nuclear program when they themselves developed nuclear weapons in the 60s while literally lying about it.

Re:When we do it to you

[Darkness404]

Iran is a terrible government (heck, all governments are terrible) but their international relations are much nicer than the US. The last major war that Iran fought was against Iraq, who invaded Iran in the 1980s. The last major war that the US fought was against Iraq which was several thousand miles away from the US. Last time I checked, Iran didn't have friendly drones in other countries constantly bombing them and writing off civilian casualties as being "terrorists".

Iran isn't good, they have a terrible record of human rights and generally have a dictatorship. However, their foreign policy is a heck of a lot more friendly than the US.

Re:When we do it to you

[TubeSteak]

I don't know what the Iranians have done to you that makes you happy that the US and Israeli government is dangerously meddling with Nuclear power plants and risking the lives of Iranian citizens

Stuxnet only attacked specific hardware configurations known to exist in Iran's uranium enrichment facilities.
Stuxnet infected other computers, but did nothing malicious to them.
There was no risk to nuclear power plants or Iran's civilian population.

but the Iranians haven't done anything to me, and so I'd prefer to take an approach of innocent until proven guilty before instigating a war against them.

Innocent until proven guilty is a legal fiction created so that our system of justice can be fair.
It does not mean you are innocent and outside the legal system no one has to abide by that standard.

That said, allowing Iran to go nuclear would lead to nuclear proliferation amongst its neighbors.
At the same time, directly attacking Iran would cause them to lash out, in all directions, at once.
It's a lose-lose situation that Stuxnet turned into a moderate win.

Re:When we do it to you

[artor3]

Well since you asked...

I have a strong dislike for irrationality, fear-mongering, and lies. I see a lot of all three whenever the topic of the United States comes up on Slashdot. The US certainly has its flaws. Lots of them in fact. But if you believe Slashdot, you'd think the US is some sort of comic book dystopia. So yeah, I push back against that sort of paranoid fear-mongering. I know I'll never get through to the true believers -- just as I'll never convince truthers that Bush didn't plan 9/11 along with Rockefeller and the queen of England -- but hopefully I can stop some forum lurkers from being lured down that path of irrationality and lies.

As for Iran, I don't consider them to be a threat to the US. But if they obtain nukes, it will cement the leadership in power, as it did in North Korea. We all saw the beatings, rapes, and murders that the Iranian government employed against its people when they protested Ahmadinejad's reelection. Do you really think it would be a good thing for that regime to have even more power? I would never support a war in Iran, because that would kill innocent people. I don't even support Israel's assassination of nuclear scientists. But by the same token, I do support actions that prevent the current regime from obtaining nukes, because I think that Iran having nukes would also cause more death. Not through nuclear attacks, mind you, but by perpetuating a regime with a horrid record of human rights abuses. Delaying or preventing that possibility, without bloodshed, is a Good Thing.

Re:When we do it to you

[JoshuaZ]

Whether Iran considers assassination of their nuclear engineers to be an act of war by Israel isn't that relevant since Iran is in a state of war with Israel. In fact, they are at this point the only country in the region which has essentially refused to ever even remotely attempt to consider sitting down at a negotiating table with Israel. (Even Syria has done more). For all purposes that matter, Israel and Iran are at war. The only marginal way that they might not be from a legal perspective is that Iran doesn't recognize Israel's existence. So assassinating Iranian nuclear scientists just means that the state of war is heating up.

Re:When we do it to you

[JoshuaZ]

That ignores that Iran is helping prop up the Syrian government, and that Iran has been one of the chief funders of Hezbollah and other organizations which have repeatedly attacked Israel. Moreover, comparing small countries to large countries when it comes to foreign policy is not generally representative- large countries have much more wide-ranging interests and have much more ability to project power in the pursuit of those interests. So to really do very badly on foreign policy you need to be large.

Double standards?

[Darkness404]

When the US uses "cyber-terrorism" its portrayed as a heroic action. If Iran does the same thing to the US, we'd use it as an excuse to start yet -another- costly, expensive, and needless war.

Why does it seem like the past 15 years of politics have been "Wag the Dog" repeated over and over again?

Re:Beating the War Drums

[Darkness404]

Yep, I just love it.

Last November people said: I'm voting for Obama because he's anti-war and wants to see peace!

2009 Peace Prize: goes to Obama

for his extraordinary efforts to strengthen international diplomacy and cooperation between peoples

2010: Let's bomb Pakistan with even more drones!

2011: Let's bomb Libya!

2012: Let's use "cyber-terrorism" against Iran!

Re:Beating the War Drums

[artor3]

So will you come back and admit to being wrong when you inevitably are?

Israel has been trying to get Obama to go to war alongside them for quite some time now. He's refused. Maybe because we can't afford it, maybe because he doesn't think its necessary, maybe because his base would desert him, maybe because he just thinks that wars of aggression are bad. But declaring war right before an election? Absolute political suicide. His base would desert him, his opponents would mock him for his transparent ploy, and independents would look at the bill from Iraq and blanch.

Now, if Romney wins, we might be in Iran by November of 2013... maybe. But I think Syria is the more likely candidate. He already wants to arm the rebels, and his party wants to go further than that.

Re:Beating the War Drums

[phantomfive]

Still better than Bush.

Re:Beating the War Drums

[Darkness404]

And Herpes is better than AIDS, doesn't mean I want either of them.

Plus, last time I checked, Bush wasn't running in 2008.

Re:Beating the War Drums

[rockout]

Actually he decided to commit our country to support a popular uprising against a dictator, which ultimately succeeded in deposing said dictator without putting American boots on the ground. You and I obviously have our differences if you don't see the contrast between that and Iraq2003, but I for one have no problem with the way he handled our involvement in Libya.