11 ms·

Saudi Arabia cyber attack goal was chemical plant explosion; experts fear retry

99 points by mfrw 9y ago

sharpercoder 9y ago
In Zero Days [0], people exert concern that US cyber attacks in Iran causes counter attacks, while the US infrastructure is not yet ready to defend these attacks. Furthermore, it is concluded that the Iranian cyber army is greatly expanded and funded since Stuxnet; the government wanted the ability to defend against similar attack in the future. [0]: http://www.imdb.com/title/tt5446858/ http://www.imdb.com/title/tt5446858/
sandworm101 9y ago
>>> Within minutes of the attack at Tasnee, the hard drives inside the company’s computers were destroyed and their data wiped clean, replaced with an image of Alan Kurdi, the small Syrian child who drowned off the coast of Turkey during his family’s attempt to flee that country’s civil war. Attacks meant to do physical harm or shutdown systems do not resort to 1990s trickery like copying an image billions of times. This is industrial vandalism and, even if a danger exists, should not be described as an attempt to murder people. Such damage, such unwanted activity within an information system, can happen without any ill intent by anyone. Therefore those designing large systems need to incorporate such failures into their plans. The failure of multiple drives due to some runaway process should never be capable of causing an explosion.
- zellyn 9y ago
  The image proves it's not industrial espionage only if you're playing a very shallow game. I expect that anything that muddies the waters helps the attackers. Attackers are quite familiar with forensic and analysis techniques, and you'd have to be a pretty naive attacker not to include red herrings and intentional pointers to shift the focus to someone else.
  - pbhjpbhj 9y ago
    You might be naive, or you might want people to know it was you, or you might be doing a false flag operation, ... telling which it is seems hard. Cf. recent attempted murder with nerve agent in UK.
- jack6e 9y ago
  It sounds like you are confusing the multiple attacks described in the article. The most recent attack in August 2017, the primary focus of the article, was indeed intended to manipulate controls and cause an explosion. The January 2017 attack, part of a string of them, is what you are describing. That one was not suspected of intending physical destruction but, "to inflict lasting damage on the petrochemical companies and send a political message."
  - sandworm101 9y ago
    The article is the one muddling the various attacks. It gives the impression of campaign of multiple attempts at murder, when in fact we have a plurality of attack intents, evidence imho of very different attackers.
    - konceptz 9y ago
      Or one attacker with (intentionally) multiple intents.
- the-dude 9y ago
  The family was already living in Turkey, so they were not fleeing "that country's civil war". The family were economic migrants seeking to enter Europe.
- Nomentatus 9y ago
  Single-MO theory is now out of fashion even in policing.
some_random 9y ago
Sometimes I can't believe how thoroughly clickbait has seeped through the news industry. At least in this case, the article was reasonably well written.
LifeLiverTransp 9y ago
I wonder how often such "mistakes" are actual some state-bound to secrecy hacker doing the ethical thing. So here is to the nameless, rotting in some oubliette, making mistakes, so others can return to theire familys at night, a secret brotherhood of servants to ruthless masters. Cheers.
- archgoon 9y ago
  For clarity, the mistake LifeLiverTransp is referring to is: > The only thing that prevented an explosion was a mistake in the attackers’ computer code, the investigators said.
  - larkeith 9y ago
    Slightly more detailed: > The only thing that prevented significant damage was a bug in the attackers’ computer code that inadvertently shut down the plant’s production systems.
- dgut 9y ago
  Typo... oops.
- wallace_f 9y ago
  I had the same thought; but then I read about $500 million in charitable relief to Haiti disappearing, or Harvard faculty lying to the public about the health and safety of lead or sugar because they received some bribe, and I don't know what to think.
  - larkeith 9y ago
    Everyone is unique, and choose differently based on their history and context.
    - wallace_f 9y ago
      Yea. But sometimes it just seems so shocking that some people who could act with such humanitarian goals share this world with others who just don't care.
dzdt 9y ago
Non-clickbait headline suggestion: "Saudi Arabia cyber attack goal was chemical plant explosion; experts fear retry" (Edit: meet length requirement)
- mfrw 9y ago
  Done
  - notadaytrader 9y ago
    Is there a way to massage this into the HN submission guidelines? Basically any headline from NY Times, Washington Post, Business Insider, Forbes, The Atlantic, or its offshoot QZ is styled in this way.
- tzs 9y ago
  How is the original headline, "A Cyberattack in Saudi Arabia Had a Deadly Goal. Experts Fear Another Try", clickbait? According to the article, investigators believe the explosion would have killed people, and notes that fatalities are a common outcome of chemical plant explosions. Most cyber attacks just inconvenience people, or cost a little bit of money. If they can kill, it is a tertiary or more remote effect. That this one was trying to do something that had it succeeded would have very directly and immediately led to deaths is what makes it interesting to a wider audience.
  - kurthr 9y ago
    The original title is longer, has less information, and higher emotional content.
  - godzillabrennus 9y ago
    When you talk about deaths because of a cyber attack I think people also wonder what would the retaliation be from the nation state that was attacked? Would a cyber attack start a new real world war? Would more people die? There is a reason the headline is written in this way. This is big news.
  - 9y ago
tomdale 9y ago
It’s strange this article effectively pins the attack on Iran, but doesn’t mention Stuxnet/Olympic Games, a malware attack on Iran that destroyed nearly 1,000 of their centrifuges[1]. 1: https://www.washingtonpost.com/world/national-security/stuxnet-was-work-of-us-and-israeli-experts-officials-say/2012/06/01/gJQAlnEy6U_story.html?utm_term=.517d10e8bc25 https://www.washingtonpost.com/world/national-security/stuxn...
- dredmorbius 9y ago
  Or, another related attack by the CIA against the USSR resulting in a catastrophic natural gas explosion. https://www.telegraph.co.uk/news/worldnews/northamerica/usa/1455559/CIA-plot-led-to-huge-blast-in-Siberian-gas-pipeline.html https://www.telegraph.co.uk/news/worldnews/northamerica/usa/...
- azinman2 9y ago
  Why is that strange?
  - salimmadjd 9y ago
    It's strange because one is seen as a retaliation and the other as preemptive aggression. Retaliation is more tolerable than preemptive aggression to many people. It's very important in this context, because the article goes out of its way to try to point the finger to Iran, but it fails to establish the context. That it was not only attacked on its Nuclear facilities, but also had cyberattack on its oil facilities via the "Flame" malware [0] Which if this was an Iranian attack makes it a retaliation. [0] http://www.cbc.ca/news/technology/flame-virus-hit-iran-s-oil-industry-but-officials-say-antidote-found-1.1238954 http://www.cbc.ca/news/technology/flame-virus-hit-iran-s-oil...
    - dqpb 9y ago
      >one is seen as a retaliation and the other as preemptive aggression I don't think so. This fire has been burning for a very long time.
    - 9y ago
crb002 9y ago
Why Iran and not Israel?
- deleted 9y ago
  [deleted]
- wolf550e 9y ago
  Because Israel and Saudi Arabia are allies.
  - justaman 9y ago
    "allies"
- golergka 9y ago
  Israel and SA are very allied now, in terms of ME politics.
allthenews 9y ago
Why isn't it SOP to isolate safety critical components from the web? Is this just incompetence/cost savings, or is there some other legitimate reason for building this vulnerability into so much of our global infrastructure?
rsync 9y ago
Chemical plants (and other such facilities) should not be Internet connected. The equipment and tools should not even have a network stack. Workers in such a facility should not have their general purpose phones and computers with them. This is not a panacea - there are conceivable attack vectors for non networked equipment - but it raises the bar significantly and should be the bare minimum of acceptability for designing and running these plants.
- liotier 9y ago
  > Chemical plants (and other such facilities) should not be Internet connected Ok. > The equipment and tools should not even have a network stack How do you imagine sensors and actuators will be operated instead ? People running about everywhere with handheld radios, reading gauges and turning valves ? I know a guy who develops simulators for refinery operation. He explained to me how each refinery is a unique setup, cold-starting one takes a couple of days of non-stop valve twiddling with eyes on gauges and has plenty of ways to end in a fiery inferno if you do it wrong. Computerized control systems are not optional.
  - raverbashing 9y ago
    You don't need tcp/ip for that
    - liotier 9y ago
      Sure, you can do it with a couple of analog electrical wires running from each valve and gauge to a central computer... You still have a computer and software (and a thick cable routing mess) and you only took some network protocol out of the attack surface (and you still need one to connect the workstations...)
      - raverbashing 9y ago
        You don't need to control everything centrally, you can compartmentalize your control (and also enforce limits) Don't bring a thermal overrun detection to the central computer and have it shutdown a burner. Do this locally
salimmadjd 9y ago
There is some shoddy journalism here: “If attackers developed a technique against Schneider equipment in Saudi Arabia, they could very well deploy the same technique here in the United States,” said James A. Lewis, a cybersecurity expert at the Center for Strategic and International Studies, a Washington think tank. Yet the NY Times forgets to cite their own article that shows Unite Arab Emirates, who is politically tied to Saudi Arabia was one of the largest donors to Center for Strategic and International Studies [0] as well as CSIS own listing [1] All of the investigators believe the attack was most likely intended to cause an explosion that would have killed people Times does not list which investigators they have spoken to directly. and again, which intelligence analysts? What worries investigators and intelligence analysts Two weeks later, the same attackers hit other Saudi targets with the same computer virus. On Jan. 23, 2017, they struck again How did they establish it was the same attackers? The article then talks about the Shamoon attack attributed to Iran with links and attribution to an earlier article by one of the writers and then in it says, The attack in August was not a Shamoon attack. It was much more dangerous. If it was not a Shamoon attack, then why mention that. Or why not just say, past attacks were attributed to Iran. Once again, Investigators believe a nation-state was responsible because there was no obvious profit motive Times does not indicate which "investigators" believes that. Also, it seems like more and more "journalism" is relying on "believe" rather than evidence and facts. Then once again, Cybersecurity experts said Iran, China, Russia the United States and Israel had the technical sophistication to launch such attacks No quote or attribution to which expert or their level of experience. The article ends horribly with, Tasnee said in an email that it had hired experts from Symantec and IBM to study the attack against it "Study the attack", Which means the experts have not had a chance to review the evidence nor Times had spoken directly to these hired experts to get their answers. But they wrote a whole article with their own conclusions. [0] https://mobile.nytimes.com/2014/09/07/us/politics/foreign-powers-buy-influence-at-think-tanks.html https://mobile.nytimes.com/2014/09/07/us/politics/foreign-po... [1] https://www.csis.org/support-csis/our-donors/government-donors https://www.csis.org/support-csis/our-donors/government-dono...
- uhnuhnuhn 9y ago
  "Times does not list which investigators they have spoken to directly." "Times does not indicate which "investigators" believes that." Not disclosing your sources is journalism 101. You will have to choose to trust or mistrust the professional integrity of NYT journalists and editors. Integrity is the NYT's main selling point, so make of that what you will.
berdon 9y ago
Likely a strange coincidence but there were just explosions at a DFW Chemical Plant. https://www.nbcdfw.com/news/local/Large-Fire-at-Fertilizer-Facility-in-Cresson-476963713.html https://www.nbcdfw.com/news/local/Large-Fire-at-Fertilizer-F...
adultSwim 9y ago
Hmm. Maybe Stuxnet wasn't the best precedent to set...
- Nomentatus 9y ago
  I sometimes think the lads at the three letter agencies were under the impression that only people with exactly their skin color would ever be able to code competently. Their long, insistent drive to make certain computers are unsafe when manufactured (always vulnerable) suggests this.

99 points by mfrw 9y ago

In Zero Days [0], people exert concern that US cyber attacks in Iran causes counter attacks, while the US infrastructure is not yet ready to defend these attacks. Furthermore, it is concluded that the Iranian cyber army is greatly expanded and funded since Stuxnet; the government wanted the ability to defend against similar attack in the future. [0]: http://www.imdb.com/title/tt5446858/ http://www.imdb.com/title/tt5446858/

sandworm101 9y ago

>>> Within minutes of the attack at Tasnee, the hard drives inside the company’s computers were destroyed and their data wiped clean, replaced with an image of Alan Kurdi, the small Syrian child who drowned off the coast of Turkey during his family’s attempt to flee that country’s civil war. Attacks meant to do physical harm or shutdown systems do not resort to 1990s trickery like copying an image billions of times. This is industrial vandalism and, even if a danger exists, should not be described as an attempt to murder people. Such damage, such unwanted activity within an information system, can happen without any ill intent by anyone. Therefore those designing large systems need to incorporate such failures into their plans. The failure of multiple drives due to some runaway process should never be capable of causing an explosion.

zellyn 9y ago
The image proves it's not industrial espionage only if you're playing a very shallow game. I expect that anything that muddies the waters helps the attackers. Attackers are quite familiar with forensic and analysis techniques, and you'd have to be a pretty naive attacker not to include red herrings and intentional pointers to shift the focus to someone else.
- pbhjpbhj 9y ago
  You might be naive, or you might want people to know it was you, or you might be doing a false flag operation, ... telling which it is seems hard. Cf. recent attempted murder with nerve agent in UK.
jack6e 9y ago
It sounds like you are confusing the multiple attacks described in the article. The most recent attack in August 2017, the primary focus of the article, was indeed intended to manipulate controls and cause an explosion. The January 2017 attack, part of a string of them, is what you are describing. That one was not suspected of intending physical destruction but, "to inflict lasting damage on the petrochemical companies and send a political message."
- sandworm101 9y ago
  The article is the one muddling the various attacks. It gives the impression of campaign of multiple attempts at murder, when in fact we have a plurality of attack intents, evidence imho of very different attackers.
  - konceptz 9y ago
    Or one attacker with (intentionally) multiple intents.
the-dude 9y ago
The family was already living in Turkey, so they were not fleeing "that country's civil war". The family were economic migrants seeking to enter Europe.
Nomentatus 9y ago
Single-MO theory is now out of fashion even in policing.

some_random 9y ago

Sometimes I can't believe how thoroughly clickbait has seeped through the news industry. At least in this case, the article was reasonably well written.

LifeLiverTransp 9y ago

I wonder how often such "mistakes" are actual some state-bound to secrecy hacker doing the ethical thing. So here is to the nameless, rotting in some oubliette, making mistakes, so others can return to theire familys at night, a secret brotherhood of servants to ruthless masters. Cheers.

archgoon 9y ago
For clarity, the mistake LifeLiverTransp is referring to is: > The only thing that prevented an explosion was a mistake in the attackers’ computer code, the investigators said.
- larkeith 9y ago
  Slightly more detailed: > The only thing that prevented significant damage was a bug in the attackers’ computer code that inadvertently shut down the plant’s production systems.
dgut 9y ago
Typo... oops.
wallace_f 9y ago
I had the same thought; but then I read about $500 million in charitable relief to Haiti disappearing, or Harvard faculty lying to the public about the health and safety of lead or sugar because they received some bribe, and I don't know what to think.
- larkeith 9y ago
  Everyone is unique, and choose differently based on their history and context.
  - wallace_f 9y ago
    Yea. But sometimes it just seems so shocking that some people who could act with such humanitarian goals share this world with others who just don't care.

dzdt 9y ago

Non-clickbait headline suggestion: "Saudi Arabia cyber attack goal was chemical plant explosion; experts fear retry" (Edit: meet length requirement)

mfrw 9y ago
Done
- notadaytrader 9y ago
  Is there a way to massage this into the HN submission guidelines? Basically any headline from NY Times, Washington Post, Business Insider, Forbes, The Atlantic, or its offshoot QZ is styled in this way.
tzs 9y ago
How is the original headline, "A Cyberattack in Saudi Arabia Had a Deadly Goal. Experts Fear Another Try", clickbait? According to the article, investigators believe the explosion would have killed people, and notes that fatalities are a common outcome of chemical plant explosions. Most cyber attacks just inconvenience people, or cost a little bit of money. If they can kill, it is a tertiary or more remote effect. That this one was trying to do something that had it succeeded would have very directly and immediately led to deaths is what makes it interesting to a wider audience.
- kurthr 9y ago
  The original title is longer, has less information, and higher emotional content.
- godzillabrennus 9y ago
  When you talk about deaths because of a cyber attack I think people also wonder what would the retaliation be from the nation state that was attacked? Would a cyber attack start a new real world war? Would more people die? There is a reason the headline is written in this way. This is big news.
- 9y ago

tomdale 9y ago

It’s strange this article effectively pins the attack on Iran, but doesn’t mention Stuxnet/Olympic Games, a malware attack on Iran that destroyed nearly 1,000 of their centrifuges[1]. 1: https://www.washingtonpost.com/world/national-security/stuxnet-was-work-of-us-and-israeli-experts-officials-say/2012/06/01/gJQAlnEy6U_story.html?utm_term=.517d10e8bc25 https://www.washingtonpost.com/world/national-security/stuxn...

dredmorbius 9y ago
Or, another related attack by the CIA against the USSR resulting in a catastrophic natural gas explosion. https://www.telegraph.co.uk/news/worldnews/northamerica/usa/1455559/CIA-plot-led-to-huge-blast-in-Siberian-gas-pipeline.html https://www.telegraph.co.uk/news/worldnews/northamerica/usa/...
azinman2 9y ago
Why is that strange?
- salimmadjd 9y ago
  It's strange because one is seen as a retaliation and the other as preemptive aggression. Retaliation is more tolerable than preemptive aggression to many people. It's very important in this context, because the article goes out of its way to try to point the finger to Iran, but it fails to establish the context. That it was not only attacked on its Nuclear facilities, but also had cyberattack on its oil facilities via the "Flame" malware [0] Which if this was an Iranian attack makes it a retaliation. [0] http://www.cbc.ca/news/technology/flame-virus-hit-iran-s-oil-industry-but-officials-say-antidote-found-1.1238954 http://www.cbc.ca/news/technology/flame-virus-hit-iran-s-oil...
  - dqpb 9y ago
    >one is seen as a retaliation and the other as preemptive aggression I don't think so. This fire has been burning for a very long time.
  - 9y ago

crb002 9y ago

Why Iran and not Israel?

deleted 9y ago
[deleted]
wolf550e 9y ago
Because Israel and Saudi Arabia are allies.
- justaman 9y ago
  "allies"
golergka 9y ago
Israel and SA are very allied now, in terms of ME politics.

allthenews 9y ago

Why isn't it SOP to isolate safety critical components from the web? Is this just incompetence/cost savings, or is there some other legitimate reason for building this vulnerability into so much of our global infrastructure?

rsync 9y ago

Chemical plants (and other such facilities) should not be Internet connected. The equipment and tools should not even have a network stack. Workers in such a facility should not have their general purpose phones and computers with them. This is not a panacea - there are conceivable attack vectors for non networked equipment - but it raises the bar significantly and should be the bare minimum of acceptability for designing and running these plants.

liotier 9y ago
> Chemical plants (and other such facilities) should not be Internet connected Ok. > The equipment and tools should not even have a network stack How do you imagine sensors and actuators will be operated instead ? People running about everywhere with handheld radios, reading gauges and turning valves ? I know a guy who develops simulators for refinery operation. He explained to me how each refinery is a unique setup, cold-starting one takes a couple of days of non-stop valve twiddling with eyes on gauges and has plenty of ways to end in a fiery inferno if you do it wrong. Computerized control systems are not optional.
- raverbashing 9y ago
  You don't need tcp/ip for that
  - liotier 9y ago
    Sure, you can do it with a couple of analog electrical wires running from each valve and gauge to a central computer... You still have a computer and software (and a thick cable routing mess) and you only took some network protocol out of the attack surface (and you still need one to connect the workstations...)
    - raverbashing 9y ago
      You don't need to control everything centrally, you can compartmentalize your control (and also enforce limits) Don't bring a thermal overrun detection to the central computer and have it shutdown a burner. Do this locally

salimmadjd 9y ago

There is some shoddy journalism here: “If attackers developed a technique against Schneider equipment in Saudi Arabia, they could very well deploy the same technique here in the United States,” said James A. Lewis, a cybersecurity expert at the Center for Strategic and International Studies, a Washington think tank. Yet the NY Times forgets to cite their own article that shows Unite Arab Emirates, who is politically tied to Saudi Arabia was one of the largest donors to Center for Strategic and International Studies [0] as well as CSIS own listing [1] All of the investigators believe the attack was most likely intended to cause an explosion that would have killed people Times does not list which investigators they have spoken to directly. and again, which intelligence analysts? What worries investigators and intelligence analysts Two weeks later, the same attackers hit other Saudi targets with the same computer virus. On Jan. 23, 2017, they struck again How did they establish it was the same attackers? The article then talks about the Shamoon attack attributed to Iran with links and attribution to an earlier article by one of the writers and then in it says, The attack in August was not a Shamoon attack. It was much more dangerous. If it was not a Shamoon attack, then why mention that. Or why not just say, past attacks were attributed to Iran. Once again, Investigators believe a nation-state was responsible because there was no obvious profit motive Times does not indicate which "investigators" believes that. Also, it seems like more and more "journalism" is relying on "believe" rather than evidence and facts. Then once again, Cybersecurity experts said Iran, China, Russia the United States and Israel had the technical sophistication to launch such attacks No quote or attribution to which expert or their level of experience. The article ends horribly with, Tasnee said in an email that it had hired experts from Symantec and IBM to study the attack against it "Study the attack", Which means the experts have not had a chance to review the evidence nor Times had spoken directly to these hired experts to get their answers. But they wrote a whole article with their own conclusions. [0] https://mobile.nytimes.com/2014/09/07/us/politics/foreign-powers-buy-influence-at-think-tanks.html https://mobile.nytimes.com/2014/09/07/us/politics/foreign-po... [1] https://www.csis.org/support-csis/our-donors/government-donors https://www.csis.org/support-csis/our-donors/government-dono...

uhnuhnuhn 9y ago
"Times does not list which investigators they have spoken to directly." "Times does not indicate which "investigators" believes that." Not disclosing your sources is journalism 101. You will have to choose to trust or mistrust the professional integrity of NYT journalists and editors. Integrity is the NYT's main selling point, so make of that what you will.

berdon 9y ago

Likely a strange coincidence but there were just explosions at a DFW Chemical Plant. https://www.nbcdfw.com/news/local/Large-Fire-at-Fertilizer-Facility-in-Cresson-476963713.html https://www.nbcdfw.com/news/local/Large-Fire-at-Fertilizer-F...

adultSwim 9y ago

Hmm. Maybe Stuxnet wasn't the best precedent to set...

Nomentatus 9y ago
I sometimes think the lads at the three letter agencies were under the impression that only people with exactly their skin color would ever be able to code competently. Their long, insistent drive to make certain computers are unsafe when manufactured (always vulnerable) suggests this.