5 ms·

How a secret Dutch mole aided the U.S.-Israeli Stuxnet cyberattack on Iran

119 points by jbegley 7y ago

arianvanp 7y ago
Original article: https://www.volkskrant.nl/nieuws-achtergrond/aivd-speelde-cruciale-rol-bij-sabotage-kernprogramma-iran~ba24df9f/ https://www.volkskrant.nl/nieuws-achtergrond/aivd-speelde-cr...
- macintux 7y ago
  Discussion (eventually, maybe): https://news.ycombinator.com/item?id=20860056 https://news.ycombinator.com/item?id=20860056
yasp 7y ago
Interesting, but why reveal now?
- arianvanp 7y ago
  It took Huib years of Investigative journalism to find this out. The official stance of the agency is that this didn't happen. And the state was trying to sue him for publishing his work https://www.volkskrant.nl/nieuws-achtergrond/aivd-doet-aangifte-tegen-volkskrant-journalist-publicatie-over-digitale-spionage-bevat-staatsgeheimen~b45a9482/ https://www.volkskrant.nl/nieuws-achtergrond/aivd-doet-aangi...
fortran77 7y ago
It's never been confirmed this was a "U.S. - Israeli" attack, if there was any attack in the first place.
- miracle2k 7y ago
  The code has been analysed and it is well known how it worked and what it does. How can it not be called an attack?
- freeflight 7y ago
  > if there was any attack in the first place. So Stuxnet just randomly self-assembled on the Internet, to attack very specific air-gapped industrial controllers?
  - RandomTisk 7y ago
    It evolved over billions of memory bit errors from the Code Red virus.
  - mattr47 7y ago
    Well that is basically how we came into existence, right? Its not like some all powerful creator programmed our DNA. So, the same random events can happen with computer viruses.
    - earenndil 7y ago
      It is orders of magnitude of orders of magnitude less likely.
- eternalny1 7y ago
  It has never been confirmed it's anything but it's been extensively researched and it's pretty obvious what it was. It's not like this highly-targeted Siemens controller worm was a cryptojacker written by a bored teenager.
  - thefj 7y ago
    Could have been a very sophisticated false flag self sabotage for no visible reason. (Not that I believe that, or think that it shouldn't be called an attack)
    - eli 7y ago
      This is true of literally anything and therefore is not helpful to the discussion.
    - TazeTSchnitzel 7y ago
      Occam's razor
- dfhdshfff 7y ago
  In the same way it was never confirmed that Israel has nuclear weapons?
- mayankkaizen 7y ago
  Even if this happened, why would someone confirm it and how will it be confirmed? Does US or any other country confirm that they are carrying out espionage program in other parts of world?
jacquesm 7y ago
Interesting how the whole world was in an uproar over Assange endangering lives and this gets a free pass. We should make up our minds about stuff like this, either Assange should be treated as a reporter or this reporter is endangering lives. I hope that whoever this mole was that he/she has good life insurance and no kids. Based on this info it should be trivial to figure out who it was and even if the journalist got it wrong there will likely be repercussions against the people implicated here.
- tptacek 7y ago
  What are you trying to say here? It sounds like you're suggesting that to support investigative journalism at all, one must also support the wholesale compromise of national security secrets. But people obviously, empirically support one and not the other.
  - sterileopinions 7y ago
    He's trying to frame the conversation in such a way that makes it seem like criticism of Assange is inherently misconstrued and misplaced, rendering it ineffectual. He's clearly got a bone to pick and it isn't a truth bone.
- jabedude 7y ago
  The article heavily implies that the Dutch mole was executed years ago.
  - meowface 7y ago
    Not necessarily. All it says is two of their intelligence sources refused to answer the question of whether or not he was executed. They reported Iran executed some number of people who were believed to be moles or otherwise guilty of harming the program. According to the sources, Iran doesn't seem to know with certainty if they got the right people, or if the executed individuals were merely unwitting carriers who got infected. It's also possible they didn't care so much and considered this sort of incompetence/negligence (of course, not such a fair accusation given their adversaries) a capital offense. They may have executed everyone involved, wittingly or not, to serve as a deterrent and increase future OPSEC. Many it's just a bonus for them if a mole also got caught in the net. This is kind of like a game theory puzzle: if he was executed and you say he was, you give them valuable information. Same if he wasn't and you say he wasn't. You could lie, but Iran's intelligence reading this article may suspect you'll lie. Or they may think it's a double bluff or something. The safest move to cause the least damage and give Iran as little info as possible may be to say the mole may or may not have been executed. There's also the possibility that the sources fuzzed the story a bit: there may have been more than one mole, or, less likely, zero moles. Intelligence is always cat-and-mouse mind games, with fact and fiction often intermixed carefully.
miller_joe 7y ago
Co author is Kim Zetter the Wired journalist who has been covering Stuxnet for years and wrote a great book on it “Countdown to Zero Day”.
- chance_state 7y ago
  For those interested in this topic but not interested enough to read 450 pages about it, I would encourage you to check out the book and only read the chapters that seem interesting. While the book is somewhat chronological and story-driven, there's still a ton of interesting info packed into it that I think a lot of HN readers would love.
trhway 7y ago
>Germany contributed technical specifications and knowledge about the industrial control systems made by the German firm Siemens that were used in the Iranian plant to control the spinning centrifuges may be it is all just a smoke screen and parallel construction, and the virus was just included in the next patch update :) Wouldn't be the first time. The parallel construction is obviously needed to make Iranians and the likes to continue hunting for moles (sucks to be executed as a mole for an USB drive that you have no idea about found in your house), tightening security and wasting their money/resources in all the other ways while still continuing to buy Siemens/etc.
- lawnchair_larry 7y ago
  When has a vendor previously put a virus in a patch update?

119 points by jbegley 7y ago

Original article: https://www.volkskrant.nl/nieuws-achtergrond/aivd-speelde-cruciale-rol-bij-sabotage-kernprogramma-iran~ba24df9f/ https://www.volkskrant.nl/nieuws-achtergrond/aivd-speelde-cr...

macintux 7y ago
Discussion (eventually, maybe): https://news.ycombinator.com/item?id=20860056 https://news.ycombinator.com/item?id=20860056

yasp 7y ago

Interesting, but why reveal now?

arianvanp 7y ago
It took Huib years of Investigative journalism to find this out. The official stance of the agency is that this didn't happen. And the state was trying to sue him for publishing his work https://www.volkskrant.nl/nieuws-achtergrond/aivd-doet-aangifte-tegen-volkskrant-journalist-publicatie-over-digitale-spionage-bevat-staatsgeheimen~b45a9482/ https://www.volkskrant.nl/nieuws-achtergrond/aivd-doet-aangi...

fortran77 7y ago

It's never been confirmed this was a "U.S. - Israeli" attack, if there was any attack in the first place.

miracle2k 7y ago
The code has been analysed and it is well known how it worked and what it does. How can it not be called an attack?
freeflight 7y ago
> if there was any attack in the first place. So Stuxnet just randomly self-assembled on the Internet, to attack very specific air-gapped industrial controllers?
- RandomTisk 7y ago
  It evolved over billions of memory bit errors from the Code Red virus.
- mattr47 7y ago
  Well that is basically how we came into existence, right? Its not like some all powerful creator programmed our DNA. So, the same random events can happen with computer viruses.
  - earenndil 7y ago
    It is orders of magnitude of orders of magnitude less likely.
eternalny1 7y ago
It has never been confirmed it's anything but it's been extensively researched and it's pretty obvious what it was. It's not like this highly-targeted Siemens controller worm was a cryptojacker written by a bored teenager.
- thefj 7y ago
  Could have been a very sophisticated false flag self sabotage for no visible reason. (Not that I believe that, or think that it shouldn't be called an attack)
  - eli 7y ago
    This is true of literally anything and therefore is not helpful to the discussion.
  - TazeTSchnitzel 7y ago
    Occam's razor
dfhdshfff 7y ago
In the same way it was never confirmed that Israel has nuclear weapons?
mayankkaizen 7y ago
Even if this happened, why would someone confirm it and how will it be confirmed? Does US or any other country confirm that they are carrying out espionage program in other parts of world?

jacquesm 7y ago

Interesting how the whole world was in an uproar over Assange endangering lives and this gets a free pass. We should make up our minds about stuff like this, either Assange should be treated as a reporter or this reporter is endangering lives. I hope that whoever this mole was that he/she has good life insurance and no kids. Based on this info it should be trivial to figure out who it was and even if the journalist got it wrong there will likely be repercussions against the people implicated here.

tptacek 7y ago
What are you trying to say here? It sounds like you're suggesting that to support investigative journalism at all, one must also support the wholesale compromise of national security secrets. But people obviously, empirically support one and not the other.
- sterileopinions 7y ago
  He's trying to frame the conversation in such a way that makes it seem like criticism of Assange is inherently misconstrued and misplaced, rendering it ineffectual. He's clearly got a bone to pick and it isn't a truth bone.
jabedude 7y ago
The article heavily implies that the Dutch mole was executed years ago.
- meowface 7y ago
  Not necessarily. All it says is two of their intelligence sources refused to answer the question of whether or not he was executed. They reported Iran executed some number of people who were believed to be moles or otherwise guilty of harming the program. According to the sources, Iran doesn't seem to know with certainty if they got the right people, or if the executed individuals were merely unwitting carriers who got infected. It's also possible they didn't care so much and considered this sort of incompetence/negligence (of course, not such a fair accusation given their adversaries) a capital offense. They may have executed everyone involved, wittingly or not, to serve as a deterrent and increase future OPSEC. Many it's just a bonus for them if a mole also got caught in the net. This is kind of like a game theory puzzle: if he was executed and you say he was, you give them valuable information. Same if he wasn't and you say he wasn't. You could lie, but Iran's intelligence reading this article may suspect you'll lie. Or they may think it's a double bluff or something. The safest move to cause the least damage and give Iran as little info as possible may be to say the mole may or may not have been executed. There's also the possibility that the sources fuzzed the story a bit: there may have been more than one mole, or, less likely, zero moles. Intelligence is always cat-and-mouse mind games, with fact and fiction often intermixed carefully.

miller_joe 7y ago

Co author is Kim Zetter the Wired journalist who has been covering Stuxnet for years and wrote a great book on it “Countdown to Zero Day”.

chance_state 7y ago
For those interested in this topic but not interested enough to read 450 pages about it, I would encourage you to check out the book and only read the chapters that seem interesting. While the book is somewhat chronological and story-driven, there's still a ton of interesting info packed into it that I think a lot of HN readers would love.

trhway 7y ago

>Germany contributed technical specifications and knowledge about the industrial control systems made by the German firm Siemens that were used in the Iranian plant to control the spinning centrifuges may be it is all just a smoke screen and parallel construction, and the virus was just included in the next patch update :) Wouldn't be the first time. The parallel construction is obviously needed to make Iranians and the likes to continue hunting for moles (sucks to be executed as a mole for an USB drive that you have no idea about found in your house), tightening security and wasting their money/resources in all the other ways while still continuing to buy Siemens/etc.

lawnchair_larry 7y ago
When has a vendor previously put a virus in a patch update?