14 ms·
Stuxnet may have destroyed 1,000 centrifuges at Natanz
- dshankar 16y agoPrime example of cyberwarfare.
- rms 16y agoGreat hack, or greatest hack of all time? I am inclined to think the latter.
- yuvadam 16y agoI concur. Only time will tell, but I believe this attack is going down in the books as the first successful cyber attack of military grade. Future wars will look exactly like this. Attacks on military and civilian cyber-infrastructure are imminent.
- Helianthus16 16y agoI disagree with the categorization of this attack as 'military' grade, though upon reflection this is largely semantic. By military you refer to the degree and purpose of the accomplished action. But it isn't warfare proper in my mind. Military action has a nationality to it, and we don't know who it was [star]. Military action has an opposition with its own capacity for action, and Iran is not hacking at the reverse. Maybe it's that I have a category in my mind for open cyberwarfare, and its character is absurd. It seems to me that the endgame is quick: disable the power or take control of computers and fill the country's network with garbage. That'd be a precise and deadly trick to pull off. Ah, there's another distinction then: this was a subtle effect designed solely for sabotage. It's not outright war on their system. Outright cyberwarfare could only be a prelude to military action. Incapacitate a nation like the US for a mere 24 hours, and imagine what military possibilities that could yield... Hopefully the cyberwarfare to come will be cyber-espionage--little tricks and turns, subtle but powerful changes--instead of cyber assault. [star] except that it was probably the US or Israel. I'd bet it was the US, any takers? [subfootnote] is the escaping of asterisks really turned off?
- aaronbrethorst 16y agoMy money is on Mossad: http://www.bloomberg.com/video/63225920/ http://www.bloomberg.com/video/63225920/
- yuvadam 16y agoThe current assumption here in Israel is that this was a joint operation. Mossad brought the detailed intel (possibly with US assistance) and the army intelligence unit 8200 (http://en.wikipedia.org/wiki/Unit_8200 http://en.wikipedia.org/wiki/Unit_8200) carried out the execution. Unit 8200 is not only in charge of SIGINT collection, but also oversees and coordinates the entire cyber-warfare effort in the IDF.
- aaronbrethorst 16y agoVery interesting, thanks for the further detail.
- vgbhjnmkl 16y agoThe US sabotaged some parts for a gas pipeline that were stolen by the Russians from a Canadian company. The sabotage caused the pipeline to explode - fortunately in an uninhabited area. I wonder where the first casualty will be?
- cabalamat 16y ago> Military action has a nationality to it, and we don't know who it was That doesn't preclude it from being military action. For example, there were Italian submarines involved in sinking ships during the Spanish Civil war, and at the time the nationality of the submarines wasn't known. But no-one would classify that as not being military action. Quite possibly the identity of the people behind Stuxnet will emerge over the next few decades.
- mhansen 16y agoThe best hacks are the ones that are so silent, you never hear about them.
- rms 16y agoYes, in this case "great" implies historical significance.
- acqq 16y agoI'd say neither: there are 10000 centrifuges and only 1000 were replaced, it's not certain that that has anything to do with the virus, the virus gained a lot of press early on which prevented it from staying put and silently disrupting for any longer period of time (which was the supposed mode of operation). Not to mention that it was so "overdesigned" that it was too obvious that it's a too well funded operation etc.
- Swannie 16y agoThe virus had been in place a relatively long time before it's public disclosure in June. Also the way the virus was designed it wasn't going to damage all of the rotors anyway.
- acqq 16y ago> the way the virus was designed it wasn't going to damage all of the rotors anyway Why not? Why shouldn't it make as much damage as possible, as it attracted too much attention anyway? > had been in place a relatively long time I think the version that became analyzed all over the world (with the last certificate) was discovered very soon after it was introduced. It still sounds to me more like something for what somebody got some promotion than something that did the damage appropriate to the money/time invested.
- Swannie 16y agoI'd suggest anyone who has a real interest in this checks out the Symantec dossier: http://www.symantec.com/connect/blogs/w32stuxnet-dossier http://www.symantec.com/connect/blogs/w32stuxnet-dossier The virus was first identified in late 2008, and was in the wild, in various forms until June 2010 when it was identified and advertised to the world. Let's assume it went 2 years from release to June. That's a relatively long time, even if half of that was reconnaissance. To quote the Symantec document: "Thus, the targeted system is using Profibus to communicate with at least 33 frequency converter drives from one or both of the two manufacturers, where sequence A is chosen if more Vacon devices are present and sequence B is chosen if more Fararo Paya devices are present." The upshot (to my understanding) is that only one type of frequency converter drive can be targeted per bus. If the buses are mixed, e.g. 50/50, only half the drives on that bus will be targeted. Additionally, if the bus has less than 31 devices on it, then it is not targeted. We can assume that at least a few of these buses were not hooked up to a full compliment of converter drivers.
- iwwr 16y agoWhat are the sources for these news?
- tedunangst 16y agoWell, the picture at least is cited as "Photo by: Courtesy", but you can find a bigger version on wikipedia. http://en.wikipedia.org/wiki/File:Gas_centrifuge_cascade.jpg http://en.wikipedia.org/wiki/File:Gas_centrifuge_cascade.jpg
- marze 16y agoThey've probably switched to homegrown motor drives now, but other weaknesses are probably waiting to be exploited.
- Swannie 16y ago1) It was the speed controllers for the motors which were targeted. 2) They did use home grown speed controllers (apparently). Stuxnet targeted two types of speed controller, one made in Finland (IIRC) and one in Tehran. 3) Undoubtedly, however the exposure of their delivery mechanism makes this much harder.
- gregschlom 16y ago> They've probably switched to homegrown motor drives now According to Wikipedia [1]: it was reported in 2006 that the tiny amount of material deposited in fingerprints on Iran's prototype centrifuges were enough to cause the machines to shatter. It's not like that's the kind of stuff anyone can build at home. [1] http://en.wikipedia.org/wiki/Zippe-type_centrifuge http://en.wikipedia.org/wiki/Zippe-type_centrifuge
- marze 16y agoIf you can build a centrifuge, you'd think you could build a variable speed motor drive which is about 100 times easier.
- Luyt 16y agoThese ultra-centifuges spin at 1000-1500 revolutions per second and can easily break when not carefully controlled. The Zippe-type centrifuges (http://en.wikipedia.org/wiki/Zippe-type_centrifuge http://en.wikipedia.org/wiki/Zippe-type_centrifuge) are probably used in Natanz for enrichment. During the spinning, a temperature gradient of 300C is applied to the cylinder which induces a convection inside (filled with uranium-fluoride gas). The lighter fraction collects at the top and is captured. These centrifuges operate in a vacuum, and can turn frictionless due to magnetic bearing.
- pdelgallego 16y agoWell, I don't know how smart is to piss off people with nuclear material, and not to much to lose. Attack other nation territory is considered a Casus belli.
- jhamburger 16y agoNuclear material != nuclear weapons. And I'm not sure why you think they'd feel they don't have much to lose.
- ohashi 16y agoI find that attack awesome in the true sense of the word, I am in awe.
- varjag 16y ago..or it may have not. But it doesn't make such a great headline. Anyway, if it is true and I had to make a bet about authorship, it would be on the USA. The USA has been doing that since 1970s (Siberian pipeline incident). Mossad is great at machinegunning waiters at Norwegian ski resorts, but high-tech ops have not been their strength.
- ratsbane 16y agoThere is another possible explanation, though it sounds even more like an airport novel than the Stuxnet story does. Consider that a lot of people, including the US, Israel, and just about everyone else on the planet would like to do anything possible to derail the Iranian nuclear activities. Making the centerfuges self-destruct by introducing Stuxnet would do that - but making the Iranians think that a virus was the problem would have the same effect. I'm sure that the Iranians spent a lot of effort trying to remove the malware from the computers controlling the centerfuges and they probably even took them off-line until they were sure that the controllers were clean. Why would you risk the very valuable remaining centerfuges until you were sure the problem was fixed? They might have even tried to replace the Windows controllers with something running Linux or Solaris or something. It's quite likely that the clean-up from Stuxnet delayed the enrichment process even more than the original damage. Malware is a convenient excuse for computer problems. "I don't have my homework because the computer crashed" certainly sounds valid but it's also an excuse that people immediately understand and have a hard time disputing. The Iranians may have internally blamed Stuxnet for the problems but isn't it possible that someone at Natanz might be using that to off-load blame for some other problem? It's also a convenient story for Israeli and Western Intelligence. Perhaps the Israelis really did do something to destroy the centerfuges - perhaps they had a mole on the inside who unbalanced the centerfuges with sweaty fingerprints or grains of sand. It's reasonably likely, especially this close to the time of the event, that the story they would want the Iranians to believe isn't the actual story. Put out a false account and watch the Iranians running around reformatting their computers while your man on the inside stays safe and ready to act again. If the Stuxnet story is true it shows remarkable technical cleverness by whoever did it. But if they're that clever they might be even slightly more cunning - enough to throw off the Iranians as to the actual cause and retain the ability to bung up the works again.