4 ms·

Stuxnet is interesting. Apparently, the US and Israeli agents threw away a number of USB devices around target facilities. What do you do when you find a USB st

by aborsy 6y ago

Stuxnet is interesting. Apparently, the US and Israeli agents threw away a number of USB devices around target facilities. What do you do when you find a USB stick? Well, eventually someone working in an air gapped facility picked up one and used it inside. The NSA apparently perfectly aligned 4 zeros days in Siemens and Microsoft products to spread the malware from USB into the Iranian LAN (shared printers, industrial PICs etc). The fact that they could choose and align 4 zero days indicates that the NSA probably has a large list of zeros days.

bayindirh 6y ago
Its more nuanced than that. Didn't read the book completely but read a long report. What I remember: - They got exact hardware details and topology of the centrifuges somehow. - They've stolen Realtek's driver signing keys. - The virus looks like a simple worm which can infect other USB devices and doesn't unpack beyond a certain point if it can't find the SCADA equipment and the correct device ID & topology (It's like a homing cruise missile which looks like an RC plane from distance until it finds its target). It's possibly the most sophisticated hacking campaign when social and technical aspects combined.
- peteretep 6y ago
  > It's possibly the most sophisticated hacking campaign when social and technical aspects combined. It’s the most sophisticated one _we know of_
  - deleted 6y ago
    [deleted]
  - nostoc 6y ago
    And it's 10 year old now...
    - bdamm 6y ago
      Frankly I expect basically all computers are compromised at this point.
      - ReactiveJelly 6y ago
        And I expect all food is unhealthy, so all I eat is pancakes.
- wh1t3n01s3 6y ago
  If anyone is interested in this, or wanna refresh your memory, you should watch the docufilm Zero Days (2016) by Alex Gibney (most of his ‘movies’ are quite interesting) https://www.imdb.com/title/tt5446858/ https://www.imdb.com/title/tt5446858/
- parliament32 6y ago
  Morality aside, the whole system was a work of art.
- firmnoodle 6y ago
  > - They've stolen Realtek's driver signing keys. I have been to Realtek's offices in Hsinchu many times. While the other efforts may have taken major resources I don't think getting their private keys would have been hard at all. Especially back then. IMHO the building and some people could be easily compromised and I suspect they didn't really care much about security.
- nickbauman 6y ago
  The hardware-software combination that was used to compromise the Iranian nuclear facilities was amazingly old and primitive, though. It truly was a weak link that I cannot fathom how this wasn't upgraded looong before. I mean, I guess it just didn't matter that much, after all, it's only a uranium enrichment facility, after all. What could possibly go wrong?
  - bayindirh 6y ago
    You're overestimating SCADA systems (and industrial control systems in particular) about their pace of evolution. Some ideas about the reason they had this particular hardware and software combination: - The SCADA hardware they got was not compatible with newer software which runs on more modern OSes. - The SCADA software didn't have any newer version which runs on newer OSes (Windows 7 and further versions are more restrictive in terms of direct HW access). - Since there are sanctions it was the only hardware and software combo they were able to legally obtain. Industrial control is like automotive industry. Everything is improved in minuscule steps and by encapsulating everything in more modern carriers. A good example is MODBUS. They still carry the same data, the old way. Only thing is it's either encapsulated in USB or TCP/IP. Why? Because it works and allows perfect backward compatibility. Since neither the hardware and the software has to run latest version of Doom (metaphorically), if the application is reliable, it's left as is. Even if it runs on DOS 6.22. Fun fact: There's an auto repair shop in Poland which runs its main application on a C64 [0]. [0]: https://www.popularmechanics.com/technology/gadgets/a23139/commodore-64-repair-shop/ https://www.popularmechanics.com/technology/gadgets/a23139/c...
- colejohnson66 6y ago
  Book?
  - bayindirh 6y ago
    Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon - by Kim Zetter [0] [0]: https://www.goodreads.com/book/show/18465875-countdown-to-zero-day https://www.goodreads.com/book/show/18465875-countdown-to-ze...
pilsetnieks 6y ago
You know, I've heard so many variations of those "USB drives in the parking lot" stories, I wonder if that isn't a cover for something else. Or maybe just someone covering their asses and not willing to take blame for something else. "USB drives in the parking lot" could be the tech industry's Korean fan death.
- Darkphibre 6y ago
  > In one test of how well a USB scam can work, Trustwave planted five USB drives decorated with the targeted company’s logos in the vicinity of the organization’s building. Two of the five “lost & found” drives were opened at the organization. One of the openings even enabled the researchers to glimpse software employed to control the organization’s physical security. https://www.redteamsecure.com/blog/usb-drop-attacks-the-danger-of-lost-and-found-thumb-drives/ https://www.redteamsecure.com/blog/usb-drop-attacks-the-dang... They are used to great effect in pentesting. I think it's natural to see a drive and think "Oh no, I need to get this back to a coworker."
  - russh 6y ago
    I have a friend who does pentesting and she collects many cool and interesting looking usb flash drives for this very purpose. She says "60% of the time, it works every time."
thisisnico 6y ago
I agree. I'm sure the level of this organization operates at utilizes teams of their own vulnerability researchers to provide themselves with the ability to create new and novel zero-day exploits that are not-disclosed to the big players. This is Internet warfare.

by aborsy 6y ago

bayindirh 6y ago

Its more nuanced than that. Didn't read the book completely but read a long report. What I remember: - They got exact hardware details and topology of the centrifuges somehow. - They've stolen Realtek's driver signing keys. - The virus looks like a simple worm which can infect other USB devices and doesn't unpack beyond a certain point if it can't find the SCADA equipment and the correct device ID & topology (It's like a homing cruise missile which looks like an RC plane from distance until it finds its target). It's possibly the most sophisticated hacking campaign when social and technical aspects combined.

peteretep 6y ago
> It's possibly the most sophisticated hacking campaign when social and technical aspects combined. It’s the most sophisticated one _we know of_
- deleted 6y ago
  [deleted]
- nostoc 6y ago
  And it's 10 year old now...
  - bdamm 6y ago
    Frankly I expect basically all computers are compromised at this point.
    - ReactiveJelly 6y ago
      And I expect all food is unhealthy, so all I eat is pancakes.
wh1t3n01s3 6y ago
If anyone is interested in this, or wanna refresh your memory, you should watch the docufilm Zero Days (2016) by Alex Gibney (most of his ‘movies’ are quite interesting) https://www.imdb.com/title/tt5446858/ https://www.imdb.com/title/tt5446858/
parliament32 6y ago
Morality aside, the whole system was a work of art.
firmnoodle 6y ago
> - They've stolen Realtek's driver signing keys. I have been to Realtek's offices in Hsinchu many times. While the other efforts may have taken major resources I don't think getting their private keys would have been hard at all. Especially back then. IMHO the building and some people could be easily compromised and I suspect they didn't really care much about security.
nickbauman 6y ago
The hardware-software combination that was used to compromise the Iranian nuclear facilities was amazingly old and primitive, though. It truly was a weak link that I cannot fathom how this wasn't upgraded looong before. I mean, I guess it just didn't matter that much, after all, it's only a uranium enrichment facility, after all. What could possibly go wrong?
- bayindirh 6y ago
  You're overestimating SCADA systems (and industrial control systems in particular) about their pace of evolution. Some ideas about the reason they had this particular hardware and software combination: - The SCADA hardware they got was not compatible with newer software which runs on more modern OSes. - The SCADA software didn't have any newer version which runs on newer OSes (Windows 7 and further versions are more restrictive in terms of direct HW access). - Since there are sanctions it was the only hardware and software combo they were able to legally obtain. Industrial control is like automotive industry. Everything is improved in minuscule steps and by encapsulating everything in more modern carriers. A good example is MODBUS. They still carry the same data, the old way. Only thing is it's either encapsulated in USB or TCP/IP. Why? Because it works and allows perfect backward compatibility. Since neither the hardware and the software has to run latest version of Doom (metaphorically), if the application is reliable, it's left as is. Even if it runs on DOS 6.22. Fun fact: There's an auto repair shop in Poland which runs its main application on a C64 [0]. [0]: https://www.popularmechanics.com/technology/gadgets/a23139/commodore-64-repair-shop/ https://www.popularmechanics.com/technology/gadgets/a23139/c...
colejohnson66 6y ago
Book?
- bayindirh 6y ago
  Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon - by Kim Zetter [0] [0]: https://www.goodreads.com/book/show/18465875-countdown-to-zero-day https://www.goodreads.com/book/show/18465875-countdown-to-ze...

pilsetnieks 6y ago

You know, I've heard so many variations of those "USB drives in the parking lot" stories, I wonder if that isn't a cover for something else. Or maybe just someone covering their asses and not willing to take blame for something else. "USB drives in the parking lot" could be the tech industry's Korean fan death.

Darkphibre 6y ago
> In one test of how well a USB scam can work, Trustwave planted five USB drives decorated with the targeted company’s logos in the vicinity of the organization’s building. Two of the five “lost & found” drives were opened at the organization. One of the openings even enabled the researchers to glimpse software employed to control the organization’s physical security. https://www.redteamsecure.com/blog/usb-drop-attacks-the-danger-of-lost-and-found-thumb-drives/ https://www.redteamsecure.com/blog/usb-drop-attacks-the-dang... They are used to great effect in pentesting. I think it's natural to see a drive and think "Oh no, I need to get this back to a coworker."
- russh 6y ago
  I have a friend who does pentesting and she collects many cool and interesting looking usb flash drives for this very purpose. She says "60% of the time, it works every time."

thisisnico 6y ago

I agree. I'm sure the level of this organization operates at utilizes teams of their own vulnerability researchers to provide themselves with the ability to create new and novel zero-day exploits that are not-disclosed to the big players. This is Internet warfare.