4 ms·

I think this was possible without siemens help. Many of Siemens customers would be familiar enough with the control system product in question to find weakness

I think this was possible without siemens help. Many of Siemens customers would be familiar enough with the control system product in question to find weaknesses in it. People find flaws in software of all sorts without help from the vendor all the time right?

redthrowaway 16y ago
It's certainly possible without Siemens' help, but my assertion is that the government would have gone to Siemens first anyway, because that's how the government works. A small group of hackers could have banged out Stuxnet, but if you accept that it was created by the US and Israel, then it's pretty reasonable to presume it was contracted out to some security firm, who were given the information they would need by Siemens, via the gov't.
- Cushman 16y ago
  If a small group of hackers could have banged it out, and it was intended as a covert operation, wouldn't it make more sense to do it that way rather than involve (and implicate) more people? Or am I giving US/Israeli intelligence too much credit?
  - redthrowaway 16y ago
    >Or am I giving US/Israeli intelligence too much credit? The US military is a big operation. They deal with big groups and big numbers. I just don't think it's in their DNA to approach a small group of blackhats to do what they could contract a legitimate firm to do. The US military contracts out to private firms for almost everything. To think that the US would approach a small, illegitimate group requires viewing Stuxnet as an aberration. I just don't think it is. It may be a new medium for the military, but it isn't a new paradigm: they identified a problem, and approached a firm that could solve it for them. That's my theory, at any rate. It's supported by those in the security industry who've analyzed it and determined the code itself wasn't anything special, just that the number of 0days involved was unusual. Any major security firm will have a shelf full of 0days kicking around; just look what we saw come out of HBGary. I don't have any evidence that Stuxnet was a contract job. Hell, I don't even have any evidence beyond hearsay that the US was involved. I'm simply looking at the known facts and the known motivations and standard practices of the institutions that were (likely) involved.
    - extension 16y ago
      I just don't think it's in their DNA to approach a small group of blackhats to do what they could contract a legitimate firm to do I'm still amazed it's in their DNA to do this at all, but if they did, blackhats are the right people for the job. No point in hiring a legitimate firm to build an illegitimate weapon. Remember, Stuxnet infected thousands of other factories around the world. Whoever built it ain't legitimate anymore.
      - redthrowaway 16y ago
        Going back to the HBGary situation (again), I think it's clear that many of the firms that work with the government stretch the definition of legitimacy pretty far. The story of the teenaged arms dealers also sheds some light on acceptable behaviour by those the US military contracts out to: http://www.rollingstone.com/politics/news/the-stoner-arms-dealers-20110316 http://www.rollingstone.com/politics/news/the-stoner-arms-de...
    - rdtsc 16y ago
      > The US military contracts out to private firms for almost everything. Not necessarily for highly classified projects. I can see a NSA or CIA internal group organizing. I imagine some projects can be compartmentalized and organized to run like a small startup with a handful of hand-picked individuals having a narrowly focused goal.
      - redthrowaway 16y ago
        That's why they have security clearances. Remember, Bechtel builds most of the US's nukes, Lockheed Martin developed the F-117 when it officially didn't exist, and the same was true of Northrop-Grumman and the B2. Private firms are regularly entrusted to perform functions that require the highest levels of secrecy. And, as much as it may tickle our nerd fancy to think so, Stuxnet was nowhere near as important as nukes or stealth technology during the Cold War.
- ams6110 16y ago
  The larger the number of people who know a secret, the more likely it is that someone will spill the beans. If the government went to Siemens, they'd then need to worry about the possibility that word gets out internally, and someone leaks the plans in time for the target to take preventive action.
  - redthrowaway 16y ago
    Siemens has people with security clearances, as they do quite a bit of defence-related work. I'm sure they have official channels that governments can interact with them through without worrying about leaks (any more than usual).

redthrowaway 16y ago

It's certainly possible without Siemens' help, but my assertion is that the government would have gone to Siemens first anyway, because that's how the government works. A small group of hackers could have banged out Stuxnet, but if you accept that it was created by the US and Israel, then it's pretty reasonable to presume it was contracted out to some security firm, who were given the information they would need by Siemens, via the gov't.

Cushman 16y ago
If a small group of hackers could have banged it out, and it was intended as a covert operation, wouldn't it make more sense to do it that way rather than involve (and implicate) more people? Or am I giving US/Israeli intelligence too much credit?
- redthrowaway 16y ago
  >Or am I giving US/Israeli intelligence too much credit? The US military is a big operation. They deal with big groups and big numbers. I just don't think it's in their DNA to approach a small group of blackhats to do what they could contract a legitimate firm to do. The US military contracts out to private firms for almost everything. To think that the US would approach a small, illegitimate group requires viewing Stuxnet as an aberration. I just don't think it is. It may be a new medium for the military, but it isn't a new paradigm: they identified a problem, and approached a firm that could solve it for them. That's my theory, at any rate. It's supported by those in the security industry who've analyzed it and determined the code itself wasn't anything special, just that the number of 0days involved was unusual. Any major security firm will have a shelf full of 0days kicking around; just look what we saw come out of HBGary. I don't have any evidence that Stuxnet was a contract job. Hell, I don't even have any evidence beyond hearsay that the US was involved. I'm simply looking at the known facts and the known motivations and standard practices of the institutions that were (likely) involved.
  - extension 16y ago
    I just don't think it's in their DNA to approach a small group of blackhats to do what they could contract a legitimate firm to do I'm still amazed it's in their DNA to do this at all, but if they did, blackhats are the right people for the job. No point in hiring a legitimate firm to build an illegitimate weapon. Remember, Stuxnet infected thousands of other factories around the world. Whoever built it ain't legitimate anymore.
    - redthrowaway 16y ago
      Going back to the HBGary situation (again), I think it's clear that many of the firms that work with the government stretch the definition of legitimacy pretty far. The story of the teenaged arms dealers also sheds some light on acceptable behaviour by those the US military contracts out to: http://www.rollingstone.com/politics/news/the-stoner-arms-dealers-20110316 http://www.rollingstone.com/politics/news/the-stoner-arms-de...
  - rdtsc 16y ago
    > The US military contracts out to private firms for almost everything. Not necessarily for highly classified projects. I can see a NSA or CIA internal group organizing. I imagine some projects can be compartmentalized and organized to run like a small startup with a handful of hand-picked individuals having a narrowly focused goal.
    - redthrowaway 16y ago
      That's why they have security clearances. Remember, Bechtel builds most of the US's nukes, Lockheed Martin developed the F-117 when it officially didn't exist, and the same was true of Northrop-Grumman and the B2. Private firms are regularly entrusted to perform functions that require the highest levels of secrecy. And, as much as it may tickle our nerd fancy to think so, Stuxnet was nowhere near as important as nukes or stealth technology during the Cold War.
ams6110 16y ago
The larger the number of people who know a secret, the more likely it is that someone will spill the beans. If the government went to Siemens, they'd then need to worry about the possibility that word gets out internally, and someone leaks the plans in time for the target to take preventive action.
- redthrowaway 16y ago
  Siemens has people with security clearances, as they do quite a bit of defence-related work. I'm sure they have official channels that governments can interact with them through without worrying about leaks (any more than usual).