4 ms·

Israel has been pretty public about its desire to stop the Iranian nuclear program. This kind of plausibly deniable attack sounds just like what Israel has bee

Israel has been pretty public about its desire to stop the Iranian nuclear program. This kind of plausibly deniable attack sounds just like what Israel has been wanting. And they have the talent to get the job done. So why not? A nation state sabotaging an enemy's nuclear weapons without it being traced back to them. That's a pretty nice thing to have. While what you're talking about is of course the most common scenario, it seems like a no-brainer to me that the NSA/DOD/IDF would spend money on preparing to make these kinds of attacks even if they rarely or never implement them. I don't see why the author's theory is implausible.

tptacek 16y ago
There is no evidence to suggest that Israel has anything to do with this. None. But here we are, speculating on whether Israel is targeting Iran with "cyber attacks". This is my problem with any story that suggests any country is using security flaws as a weapon. As a professional matter, nothing in any of the reporting or analysis of Stuxnet suggests to me that this would have cost more than low-six figures to build cold (meaning, what it would cost to have a contractor familiar with malware and runtime security but not familiar with the particular software targeted here). It'd be significantly cheaper if you had devs with industrial controller backgrounds assisted by an exploit-dev contractor. So, yes, Israel could have been behind this attack. And the NSA could have been behind the Twitter XSS worm. It could be Putin ordering all those DDoS extortion attempts on gambling websites. But I doubt it; it's probably just someone's scheme to make money. Talk to banking security people sometime; crazy stuff is happening every day.
- forensic 16y ago
  What would Putin's motivation be to make DDoS extortion attempts? Means, motive, opportunity. Putin has no motive to extort pennies from gambling websites. He has better ways to make money. The NSA has no motive to make the Twitter worm. But Israel has a gigantic motive to make something that would sabotage a nuke plant in Iran. That's the difference. I agree that it's speculation - I just think it's plausible speculation.
- Qz 16y ago
  No hard evidence (yet), but there is definitely circumstantial evidence.
  - tptacek 16y ago
    What circumstantial evidence would that be? Be as specific as you can. Circumstantial evidence doesn't mean "whatever I think of".
    - Qz 16y ago
      Stuxnet (according to some) looks like it was built to attack Iran's nuclear reactor computers. Israel has a vested interested in stopping Iran's nuclear program. Israel has the technical knowhow to design Stuxnet. Not being directly linked to the Stuxnet-as-attack thing is also in Israel's interest. It's pretty simple, if we go with the idea that Stuxnet was built to attack the nuclear program, then the circumstantial evidence points to Israel. Motive, Means, Opportunity.
      - tptacek 16y ago
        How many grid operators do you think there are in the middle east? What's your evidence that they were targeting Iran's? There is equally compelling evidence that this worm came with a ransom demand. And that's a more plausible story.
        Qz 16y ago
        That's the difference between circumstantial evidence and direct evidence: On its own, it is the nature of circumstantial evidence for more than one explanation to still be possible. Inference from one piece of circumstantial evidence may not guarantee accuracy. (from wikipedia) If there was direct evidence, this would be a different discussion entirely. Oh, and as for 'why Iran?', that's from: http://news.ycombinator.com/item?id=1712296 http://news.ycombinator.com/item?id=1712296
        16y ago
- aristus 16y ago
  I respect your expertise, but this estimate seem at odds with the mainstream reporting on the difficulty of building it. Can you elaborate why you think this could be a low 6-figure job? It seems to have used more than one 0day, for example.
  - tptacek 16y ago
    One of the four "zero days" it's alleged to have targeted was disclosed last year. Two of the others are privilege escalation bugs, which probably aren't worth tens of thousands of dollars. You can probably buy real clientsides in IE or a popular plugin for far less than six figures.
    - qq66 16y ago
      Haha, it's fascinating to see someone in the security field talk about purchasing exploits. It sounds only one step removed from discussing the price to purchase a proof of the Riemann Hypothesis.
      - lsc 16y ago
        from the parent: "You can probably buy real clientsides in IE or a popular plugin for far less than six figures." I'm pretty sure that what the parent means is that you could buy a plugin, or rather the company that writes a plugin. say, adblock (okay, adblock might be more than six figures... a less popular plugin that is still fairly widely used.) along with the rights and credentials to upload a new version. (of course, you'd pretend to be a legitimate business to do this.) Now, I don't know how IE works, but FireFox has a mechanism to automatically update plugins to their latest versions. You now insert your malicious code into the plugin and cause the auto-update to run. Assuming the infection isn't immediately obvious, you will, within a few days, infect nearly all users of that plugin.
        JoachimSchipper 16y ago
        I am pretty sure that tptacek does mean buying vulnerabilities. There are quite a few unsophisticated hackers offering exploits for sale ("serious buyers only") (e.g. on the Full-Disclosure mailing list), and the occasional debate about publishing/selling to "good guys" like Zero Day Initiative/selling to "bad guys" suggests that these sellers are, indeed, unsophisticated. (Which is not to say that your way wouldn't work too.) EDIT: Mention Full-Disclosure somewhere.

tptacek 16y ago

There is no evidence to suggest that Israel has anything to do with this. None. But here we are, speculating on whether Israel is targeting Iran with "cyber attacks". This is my problem with any story that suggests any country is using security flaws as a weapon. As a professional matter, nothing in any of the reporting or analysis of Stuxnet suggests to me that this would have cost more than low-six figures to build cold (meaning, what it would cost to have a contractor familiar with malware and runtime security but not familiar with the particular software targeted here). It'd be significantly cheaper if you had devs with industrial controller backgrounds assisted by an exploit-dev contractor. So, yes, Israel could have been behind this attack. And the NSA could have been behind the Twitter XSS worm. It could be Putin ordering all those DDoS extortion attempts on gambling websites. But I doubt it; it's probably just someone's scheme to make money. Talk to banking security people sometime; crazy stuff is happening every day.

forensic 16y ago
What would Putin's motivation be to make DDoS extortion attempts? Means, motive, opportunity. Putin has no motive to extort pennies from gambling websites. He has better ways to make money. The NSA has no motive to make the Twitter worm. But Israel has a gigantic motive to make something that would sabotage a nuke plant in Iran. That's the difference. I agree that it's speculation - I just think it's plausible speculation.
Qz 16y ago
No hard evidence (yet), but there is definitely circumstantial evidence.
- tptacek 16y ago
  What circumstantial evidence would that be? Be as specific as you can. Circumstantial evidence doesn't mean "whatever I think of".
  - Qz 16y ago
    Stuxnet (according to some) looks like it was built to attack Iran's nuclear reactor computers. Israel has a vested interested in stopping Iran's nuclear program. Israel has the technical knowhow to design Stuxnet. Not being directly linked to the Stuxnet-as-attack thing is also in Israel's interest. It's pretty simple, if we go with the idea that Stuxnet was built to attack the nuclear program, then the circumstantial evidence points to Israel. Motive, Means, Opportunity.
    - tptacek 16y ago
      How many grid operators do you think there are in the middle east? What's your evidence that they were targeting Iran's? There is equally compelling evidence that this worm came with a ransom demand. And that's a more plausible story.
      - Qz 16y ago
        That's the difference between circumstantial evidence and direct evidence: On its own, it is the nature of circumstantial evidence for more than one explanation to still be possible. Inference from one piece of circumstantial evidence may not guarantee accuracy. (from wikipedia) If there was direct evidence, this would be a different discussion entirely. Oh, and as for 'why Iran?', that's from: http://news.ycombinator.com/item?id=1712296 http://news.ycombinator.com/item?id=1712296
        16y ago
aristus 16y ago
I respect your expertise, but this estimate seem at odds with the mainstream reporting on the difficulty of building it. Can you elaborate why you think this could be a low 6-figure job? It seems to have used more than one 0day, for example.
- tptacek 16y ago
  One of the four "zero days" it's alleged to have targeted was disclosed last year. Two of the others are privilege escalation bugs, which probably aren't worth tens of thousands of dollars. You can probably buy real clientsides in IE or a popular plugin for far less than six figures.
  - qq66 16y ago
    Haha, it's fascinating to see someone in the security field talk about purchasing exploits. It sounds only one step removed from discussing the price to purchase a proof of the Riemann Hypothesis.
    - lsc 16y ago
      from the parent: "You can probably buy real clientsides in IE or a popular plugin for far less than six figures." I'm pretty sure that what the parent means is that you could buy a plugin, or rather the company that writes a plugin. say, adblock (okay, adblock might be more than six figures... a less popular plugin that is still fairly widely used.) along with the rights and credentials to upload a new version. (of course, you'd pretend to be a legitimate business to do this.) Now, I don't know how IE works, but FireFox has a mechanism to automatically update plugins to their latest versions. You now insert your malicious code into the plugin and cause the auto-update to run. Assuming the infection isn't immediately obvious, you will, within a few days, infect nearly all users of that plugin.
      - JoachimSchipper 16y ago
        I am pretty sure that tptacek does mean buying vulnerabilities. There are quite a few unsophisticated hackers offering exploits for sale ("serious buyers only") (e.g. on the Full-Disclosure mailing list), and the occasional debate about publishing/selling to "good guys" like Zero Day Initiative/selling to "bad guys" suggests that these sellers are, indeed, unsophisticated. (Which is not to say that your way wouldn't work too.) EDIT: Mention Full-Disclosure somewhere.