Wow! The Brilliance of Stuxnet!

[destrekor]

i fucking hate stuxnet. we have two siemens variable frequency drives at work so everyone thinks we are susceptible but it doesn't infect the PLCs we use

It sounds like this worm was tasked with only infecting other PCs to serve as stepping-stones to the actual target - in short, it looks like it caused zero damage to neutral PCs, and only did its duties on PCs related to the target.

 

[TXHokie]

pfft, all they had to do was run malwarebytes and then /reformat c: and then reinstall windows

So I read in some details that when it finds itself on a network that matches its criteria (software version number), it hooks into the central SQL database and login via a vendor backdoor access and start running database queries to modify the plant configuration. You're pretty much screwed at this point short of nuking the whole network and start from scratch to be really sure. They're still finding new bits and pieces on the worm as it goes.

 

[Fenixgoon]

I knew the world was slowly but surely moving in the direction of cyber warfare. I've been waiting for it, and I ultimately hope that I will find myself employed in some capacity with the agencies who are tasked with the assault of foreign states and defense of the home grid. Cyber warfare is the future, and I must say I look forward to that future - because it could save the lives of men and women tasked with conventional warfare.

disagree - it is a means to an end. once you destroy your enemy's networks, infrastructure, and manufacturing capability, they cannot communicate or produce anything, and then you really lay the hurt on.

 

[lxskllr]

disagree - it is a means to an end. once you destroy your enemy's networks, infrastructure, and manufacturing capability, they cannot communicate or produce anything, and then you really lay the hurt on.

Yea, there's no substitute for actually capturing, and holding land.

 

[DrPizza]

If I had to try to run a really 'secure' environment, I'd certainly make sure external devices could not be hooked up to any computer. Another thing I'd do is to have computers be essentially dumb terminals running off a shared virtual environment. That way any and all unauthorized system updates would be nullified each day anyway.

I agree 100%. They can't be that stupid in Iran. Seriously - if you have a set of secure computers, no one setting that system up is stupid enough to allow flash drives or any other drives to be connected from outside the facility. Thus, the vector of attack suggested by the article is likely false. Putting that much time and effort into a vector of attack that shouldn't have succeeded seems unlikely. However, what if they did it via hardware? i.e. the "virus" was transported in via some chip in some hardware component that would likely be replaced or upgraded?

 

[MarkXIX]

You would be surprised at the ingenuity and idiocy of people on government owned computer networks.

You would think that there should be no reason for people to air gap classified data onto unclassified networks, but they do it all the time. All it takes is a single person to override the security architecture in just one place and the whole system is essentially compromised.

 

[SantiClaws]

does...not...compute...

The article is worded badly. This is the key phrase:

The servers monitored the worms and were shut down once the worm had infiltrated Natanz.

The servers monitored progress on computers outside the secure facility. If flash drives were carried back and forth, it is possible the virus was capable of reporting progress inside the facility as well.

 

[Rubycon]

I agree 100%. They can't be that stupid in Iran. Seriously - if you have a set of secure computers, no one setting that system up is stupid enough to allow flash drives or any other drives to be connected from outside the facility. Thus, the vector of attack suggested by the article is likely false. Putting that much time and effort into a vector of attack that shouldn't have succeeded seems unlikely. However, what if they did it via hardware? i.e. the "virus" was transported in via some chip in some hardware component that would likely be replaced or upgraded?

Their software is Shit!

http://www.maplandia.com/iran/mazandaran/shit/

:biggrin:

 

[The Boston Dangler]

I agree 100%. They can't be that stupid in Iran. Seriously - if you have a set of secure computers, no one setting that system up is stupid enough to allow flash drives or any other drives to be connected from outside the facility. Thus, the vector of attack suggested by the article is likely false. Putting that much time and effort into a vector of attack that shouldn't have succeeded seems unlikely. However, what if they did it via hardware? i.e. the "virus" was transported in via some chip in some hardware component that would likely be replaced or upgraded?

i seem to remember hearing that the opening shot of operation desert storm was a virus embedded on the board of a printer.

 

[sactoking]

For those wondering about how the virus got access, you're overlooking a key point: as stated in the article the system was isolated from the World Wide Web to prevent attack, it was not isolated from all possible outside communication systems. Presumably it was on a government network of some sort. If you gain access to that network through some other point of entry (say another agency) the worm can proceed along other channels.

 

[pcslookout]

Interesting. My bets of who did it is Russia or The United States.

 

[pcslookout]

I knew the world was slowly but surely moving in the direction of cyber warfare. I've been waiting for it, and I ultimately hope that I will find myself employed in some capacity with the agencies who are tasked with the assault of foreign states and defense of the home grid. Cyber warfare is the future, and I must say I look forward to that future - because it could save the lives of men and women tasked with conventional warfare.

Are you so sure about that? People could still die easily. Depends on what happens or what they attack.

 

[preslove]

Either the US or Israel.

 

[Freshgeardude]

im not so sure russia was involved in making the virus.

they have been helping build (and of course profit) from the bush (idk the full name) nuclear facility.

why would they want to lose money?

they have been defiant with UN sanctions (as well as china) until recently because they both stand to have their economies suffer from a sanctioned iran.


imo, the US, Germany, and Israel combined could have made this together.

the US and Israel both obviously dont want a nuclear iran, and im sure germany doesnt either.

sorry to make this P&N ish but it comes with the topic

 

[MarkXIX]

im not so sure russia was involved in making the virus.

they have been helping build (and of course profit) from the bush (idk the full name) nuclear facility.

why would they want to lose money?

they have been defiant with UN sanctions (as well as china) until recently because they both stand to have their economies suffer from a sanctioned iran.


imo, the US, Germany, and Israel combined could have made this together.

the US and Israel both obviously dont want a nuclear iran, and im sure germany doesnt either.

sorry to make this P&N ish but it comes with the topic

How would they lose money? If the system is slowly destroyed, they make a killing replacing "bad" parts in the system and doing the repair work themselves. Seems like a win/win to me.

 

[Freshgeardude]

How would they lose money? If the system is slowly destroyed, they make a killing replacing "bad" parts in the system and doing the repair work themselves. Seems like a win/win to me.

with economic sanctions and physical crippling of the reactors.


the goal of the US and israel is for Iran to stop their nuclear program.

if it comes to that, russia will lose money

 

[destrekor]

disagree - it is a means to an end. once you destroy your enemy's networks, infrastructure, and manufacturing capability, they cannot communicate or produce anything, and then you really lay the hurt on.

Yea, there's no substitute for actually capturing, and holding land.

Are you so sure about that? People could still die easily. Depends on what happens or what they attack.

Well I never said it would replace conventional warfare fought with bodies.
For as long as we retain our animalistic tendencies, we will quarrel over anything and everything. And we will need bodies at the location of whatever we wish to declare, "This is ours!"

But it will save the lives of soldiers.

However, in the end, deathtolls of warfare won't exactly decline because of it. Soon, I reckon, cyber warfare will simply be a type of lethal weapon in some instances. You cause certain vital infrastructures to malfunction, and people may die.
We're not far from a time where nothing even has to be made into a weapon to actually cause mass casualties. If you use code to cripple or shut down critical infrastructures, people will die. Oil, gas, water, electricity - all things developed civilization depends upon, and if permanently lost for a period of time, it will take society a certain amount of time to adapt.

Boots on the ground will never be completely removed from the situation, at least not for the foreseeable future of mankind - we've known it true for our entire existence. And yet, there may be a time they are needed less and in lower numbers.

 

[JJChicken]

Wow, those security experts in Iran are pretty stupid.

 

[Engineer]

I'm sure someone just updated i-Tunes and BAM worms everywhere...

happens to me all the time.

Are you this person (at the 0:25 mark)?

 

[The Boston Dangler]

Wow, those security experts in Iran are pretty stupid.

your comment is pretty stupid.

why are they stupid? because they were defeated? napoleon, rommel, kasparov, and a million other geniuses have been defeated at some point. once the west decided to commit the resources to accomplishing this objective, no amount of leet skillz was going to stop it.

nor are they stupid because they come from a country 5 minutes from the stone age. just because a nation has little or no running water doesn't mean there aren't very educated people performing work on a high level, particularly in the year 2010.

 

[lothar]

I agree 100%. They can't be that stupid in Iran. Seriously - if you have a set of secure computers, no one setting that system up is stupid enough to allow flash drives or any other drives to be connected from outside the facility. Thus, the vector of attack suggested by the article is likely false. Putting that much time and effort into a vector of attack that shouldn't have succeeded seems unlikely. However, what if they did it via hardware? i.e. the "virus" was transported in via some chip in some hardware component that would likely be replaced or upgraded?

It wasn't until 2-4 years ago that DoD/Pentagon banned the use of flash drives in their computer systems.

If we only banned them just 2-4 years ago, what makes you think Iran(or some other country) would have done that?
I remember reading an article about us banning flash sticks at the Pentagon/DoD a few years ago..Wish I could find it. May have even been on AT P/N here itself.

 

[Venix]

Bruce Schneier has a better, more technical article. He also provides links to other sources, with this Symantic reverse engineering analysis of the virus probably being the most interesting.

 

[lothar]

im not so sure russia was involved in making the virus.

they have been helping build (and of course profit) from the bush (idk the full name) nuclear facility.

why would they want to lose money?

they have been defiant with UN sanctions (as well as china) until recently because they both stand to have their economies suffer from a sanctioned iran.


imo, the US, Germany, and Israel combined could have made this together.

the US and Israel both obviously dont want a nuclear iran, and im sure germany doesnt either.

sorry to make this P&N ish but it comes with the topic

How would they lose money? If the system is slowly destroyed, they make a killing replacing "bad" parts in the system and doing the repair work themselves. Seems like a win/win to me.

This.
If Russians were interested in success, they would have finished the plant on schedule by 1999(or around that time) as was originally proposed in the Russian-Iranian agreement.

The Russians(like all other contractors such as Boeing, Lockheed Martin, etc... that cheat on defense contracts by underbidding along with other strategies) are only interested in milking the system.