5 ms·

Hiding and obfuscating the payload is pointless in this case. The author doesn’t seem to understand the reasons why a group would go through the trouble of obfu

by axg11 4y ago

Hiding and obfuscating the payload is pointless in this case. The author doesn’t seem to understand the reasons why a group would go through the trouble of obfuscation or other similar techniques. Stuxnet was a one-time operation with a very limited opportunity window. Target systems were airgapped. A large part of the success of the operation relied on a human penetrating that air gap. A successful operation would be attributed to either Israel or USA immediately. What is the benefit of obfuscation?

sokoloff 4y ago
Exactly. All that matters is that the scoreboard reads "Stuxnet - 1; Iran - 0 (Final)"
- spacemanmatt 4y ago
  Yeah, effective trumps every possible hindsight criticism.
- hotpotamus 4y ago
  Considering that Iran went on to develop uranium enrichment capabilities it hardly seems like Stuxnet was a final win, though it certainly delayed them.
  - cronix 4y ago
    Delaying has always been the point, whether it's Stuxnet or technology export bans or assassinating 4 scientists in the streets working on the program.
  - axg11 4y ago
    Long term effects of Stuxnet are unclear. In the short term, it was a huge win in delaying the programme and sending a message that even air gapped systems are at risk. In the long term, Stuxnet put the programme and every adversary on notice that they should increase focus on security practices.
    - moistly 4y ago
      And yet we leave our own infrastructure connected to the internet. It’s like we want our power grid to fail, our dams to release a flood, our water supply to be over-floridated.
      - eru 4y ago
        Didn't we just talk about how Stuxnet showed that even airgaps aren't 100% secure? The benefits of being connected to the Internet are the same as before; but the benefits of the airgap are smaller than we expected them to be. Hence we would expect our preferred trade-off to swing in favour of more connections?
        moistly 4y ago
        And the lock on your house isn’t particularly effective either, yet we don’t see you going on vacation whilst leaving the door fully open.
        eru 4y ago
        If there was a high chance I would come home to my house being devastated whether I lock up or not, I would probably not bother locking up.
        daniel-cussen 4y ago
        I live in Chile. In practice you would lock up (and even set up your lights with an endemic light timer so it looks like you're home) and the alternative is homelessness. Actual homelessness, not eviction. You still pay rent, only there's no roof over your head. You'd be homeless, not evicted. The ruins of your former house are a better home than the street. Shit in the corner, rebuild, that sort of thing. In practice you would not leave for vacations and for sure exercise right to bear arms, that's what's up. The police will ALWAYS tell you you're in safe hands with them don't get a gun in urban areas. They'll say it'll be used against you. I guess it could if you're a wimp. Yeah I'm such a wimp, the thug will walk right up while I do nothing but hold the gun, suck the bullets out of the barrel with his powerful lungs, and spit them out back at me!
  - twbarr 4y ago
    The damage goes way beyond delaying them one time, it also makes it way harder to use COTS hardware in the future. It's going to be a lot harder to get work done when you can't just buy a computer off Amazon.
  - mike_d 4y ago
    In World War 2 the British developed "exploding rats." The idea was to pack rats with explosives and leave them near boilers. The person shoveling fuel would eventually find the rat and shovel it in to the furnace to dispose of it - where a relatively small explosion would cause the pressure vessel to rupture and take out an entire train or industrial facility. A single shipment of 100 explosive rats was sent across the border and was intercepted. What resulted was a massive amount of German energy spent on trying to detect rat shipments and having to consider exploding rats in their threat model for every further operation. Stuxnet not only delayed the the Iranian nuclear efforts, it made everything a hundred times more complex going forward because they realized not even air gapped computers were safe. Not to mention they no longer trust any of their monitoring or instrumentation, which Stuxnet made a point of faking... imagine trying to debug even the smallest issue when you don't trust a single piece of data.
  - GekkePrutser 4y ago
    They already had enrichment capabilities. What stuxnet targeted was and I believe is an active enrichment plant. I don't think it did more than delay production and destroy some really expensive centrifuges but it could have been a message like "we'll get you no matter what" in order to bring them to the table or something.
night-rider 4y ago
Exactly. Nothing wrong with going for a bunch of low hanging fruit in an attack. If the simple stuff doesn’t work you need to do obfuscation and have good OPSEC
DisjointedHunt 4y ago
Exactly. The cost of failure was deemed greater than the cost of success with attribution. It's just the way covert ops works. If you asked the leaders of this op, in retrospect, if they were starting off from scratch, would they accept the result we saw where Irans nuclear enrichment capabilities were delayed long enough for more information about their secret work to be known with more certainty. . .all of them would take it in a heartbeat.
gnuvince 4y ago
Yeah, the author of the article sounds like a teenager/young adult who seems unable to evaluate objects along multiple dimensions.
px43 4y ago
Yeah, the author definitely doesn't really have a clue what the requirements are for various forms of intelligence operation. It should be noted, however, that there apparently was a significant amount of animosity from the NSA towards unit 8200 for "turning up the volume" on the payload. Usually NSA really really really doesn't like catching attribution for stuff, and Mossad is more known for trying to send a message with obvious attributions (motorcycle assassinations etc). It was supposedly delivered from TAO to 8200 as a very covert weapon, and 8200 stripped off a bunch of the limitations in order to increase the odds of successfully completing the mission. I'm not actually referencing the Wikipedia article, so I don't know if what I'm saying is reflected in there, but it's a good read either way: https://en.wikipedia.org/wiki/Operation_Olympic_Games https://en.wikipedia.org/wiki/Operation_Olympic_Games
- mike_d 4y ago
  Stuxnet was assembled from a standard implant framework that is shared across "Five Eyes" countries. Everyone writes modules of various types that implement a standard API and share them across teams. For example, if the Australians need to compromise a diplomatic machine in Singapore, the UK may have a module already written a keylogger that hooks Pinyin (software for typing in Mandarin). When the Israeli's pushed it to 11 they brought down a ton of scrutiny on the framework as a whole. Which is why people started discovering links to other sophisticated malware families - like Kaspersky's discovery that Stuxnet and Flame used the same LNK vulnerability which was not known to the public at the time. The "QWERTY" keylogger in the Snowden leaks was identified as part of the Regin malware family. They effectively gave every nation on the planet a trail of breadcrumbs to either find western espionage tools, or strongly attribute tools they had previously found. This also refutes most of the articles points, they _could_ have done all these things but SOP is to do the least amount of shady shit to get the job done. Being extra cool guy just makes it more likely to trigger an anti-virus system that detects a specific trick.
- Lammy 4y ago
  I wonder if the "Olympic Games" name is in reference to a USB-stick jumping the airgap by being handed off like the Olympic Torch Relay.
bee_rider 4y ago
I'm not in the field, so it is definitely possible that my way of looking at it is just completely wrong-headed, but -- what about repeating the attack? If the program had remained hidden, maybe they could re-use some parts? Also, is it possible that other parties (badguys) gained some capability by analyzing the program?
- axg11 4y ago
  How could it remain hidden? The programme heads would think it was an accident? This was a devastating setback to the entire programme. There would surely be an investigation to ensure a repeat could not happen.
  - ncmncm 4y ago
    They could have used it on somebody else. Iran is not going to brag about having been hacked.
deleted 4y ago
[deleted]

by axg11 4y ago

sokoloff 4y ago

Exactly. All that matters is that the scoreboard reads "Stuxnet - 1; Iran - 0 (Final)"

spacemanmatt 4y ago
Yeah, effective trumps every possible hindsight criticism.
hotpotamus 4y ago
Considering that Iran went on to develop uranium enrichment capabilities it hardly seems like Stuxnet was a final win, though it certainly delayed them.
- cronix 4y ago
  Delaying has always been the point, whether it's Stuxnet or technology export bans or assassinating 4 scientists in the streets working on the program.
- axg11 4y ago
  Long term effects of Stuxnet are unclear. In the short term, it was a huge win in delaying the programme and sending a message that even air gapped systems are at risk. In the long term, Stuxnet put the programme and every adversary on notice that they should increase focus on security practices.
  - moistly 4y ago
    And yet we leave our own infrastructure connected to the internet. It’s like we want our power grid to fail, our dams to release a flood, our water supply to be over-floridated.
    - eru 4y ago
      Didn't we just talk about how Stuxnet showed that even airgaps aren't 100% secure? The benefits of being connected to the Internet are the same as before; but the benefits of the airgap are smaller than we expected them to be. Hence we would expect our preferred trade-off to swing in favour of more connections?
      - moistly 4y ago
        And the lock on your house isn’t particularly effective either, yet we don’t see you going on vacation whilst leaving the door fully open.
        eru 4y ago
        If there was a high chance I would come home to my house being devastated whether I lock up or not, I would probably not bother locking up.
        daniel-cussen 4y ago
        I live in Chile. In practice you would lock up (and even set up your lights with an endemic light timer so it looks like you're home) and the alternative is homelessness. Actual homelessness, not eviction. You still pay rent, only there's no roof over your head. You'd be homeless, not evicted. The ruins of your former house are a better home than the street. Shit in the corner, rebuild, that sort of thing. In practice you would not leave for vacations and for sure exercise right to bear arms, that's what's up. The police will ALWAYS tell you you're in safe hands with them don't get a gun in urban areas. They'll say it'll be used against you. I guess it could if you're a wimp. Yeah I'm such a wimp, the thug will walk right up while I do nothing but hold the gun, suck the bullets out of the barrel with his powerful lungs, and spit them out back at me!
- twbarr 4y ago
  The damage goes way beyond delaying them one time, it also makes it way harder to use COTS hardware in the future. It's going to be a lot harder to get work done when you can't just buy a computer off Amazon.
- mike_d 4y ago
  In World War 2 the British developed "exploding rats." The idea was to pack rats with explosives and leave them near boilers. The person shoveling fuel would eventually find the rat and shovel it in to the furnace to dispose of it - where a relatively small explosion would cause the pressure vessel to rupture and take out an entire train or industrial facility. A single shipment of 100 explosive rats was sent across the border and was intercepted. What resulted was a massive amount of German energy spent on trying to detect rat shipments and having to consider exploding rats in their threat model for every further operation. Stuxnet not only delayed the the Iranian nuclear efforts, it made everything a hundred times more complex going forward because they realized not even air gapped computers were safe. Not to mention they no longer trust any of their monitoring or instrumentation, which Stuxnet made a point of faking... imagine trying to debug even the smallest issue when you don't trust a single piece of data.
- GekkePrutser 4y ago
  They already had enrichment capabilities. What stuxnet targeted was and I believe is an active enrichment plant. I don't think it did more than delay production and destroy some really expensive centrifuges but it could have been a message like "we'll get you no matter what" in order to bring them to the table or something.

night-rider 4y ago

Exactly. Nothing wrong with going for a bunch of low hanging fruit in an attack. If the simple stuff doesn’t work you need to do obfuscation and have good OPSEC

DisjointedHunt 4y ago

Exactly. The cost of failure was deemed greater than the cost of success with attribution. It's just the way covert ops works. If you asked the leaders of this op, in retrospect, if they were starting off from scratch, would they accept the result we saw where Irans nuclear enrichment capabilities were delayed long enough for more information about their secret work to be known with more certainty. . .all of them would take it in a heartbeat.

gnuvince 4y ago

Yeah, the author of the article sounds like a teenager/young adult who seems unable to evaluate objects along multiple dimensions.

px43 4y ago

Yeah, the author definitely doesn't really have a clue what the requirements are for various forms of intelligence operation. It should be noted, however, that there apparently was a significant amount of animosity from the NSA towards unit 8200 for "turning up the volume" on the payload. Usually NSA really really really doesn't like catching attribution for stuff, and Mossad is more known for trying to send a message with obvious attributions (motorcycle assassinations etc). It was supposedly delivered from TAO to 8200 as a very covert weapon, and 8200 stripped off a bunch of the limitations in order to increase the odds of successfully completing the mission. I'm not actually referencing the Wikipedia article, so I don't know if what I'm saying is reflected in there, but it's a good read either way: https://en.wikipedia.org/wiki/Operation_Olympic_Games https://en.wikipedia.org/wiki/Operation_Olympic_Games

mike_d 4y ago
Stuxnet was assembled from a standard implant framework that is shared across "Five Eyes" countries. Everyone writes modules of various types that implement a standard API and share them across teams. For example, if the Australians need to compromise a diplomatic machine in Singapore, the UK may have a module already written a keylogger that hooks Pinyin (software for typing in Mandarin). When the Israeli's pushed it to 11 they brought down a ton of scrutiny on the framework as a whole. Which is why people started discovering links to other sophisticated malware families - like Kaspersky's discovery that Stuxnet and Flame used the same LNK vulnerability which was not known to the public at the time. The "QWERTY" keylogger in the Snowden leaks was identified as part of the Regin malware family. They effectively gave every nation on the planet a trail of breadcrumbs to either find western espionage tools, or strongly attribute tools they had previously found. This also refutes most of the articles points, they _could_ have done all these things but SOP is to do the least amount of shady shit to get the job done. Being extra cool guy just makes it more likely to trigger an anti-virus system that detects a specific trick.
Lammy 4y ago
I wonder if the "Olympic Games" name is in reference to a USB-stick jumping the airgap by being handed off like the Olympic Torch Relay.

bee_rider 4y ago

I'm not in the field, so it is definitely possible that my way of looking at it is just completely wrong-headed, but -- what about repeating the attack? If the program had remained hidden, maybe they could re-use some parts? Also, is it possible that other parties (badguys) gained some capability by analyzing the program?

axg11 4y ago
How could it remain hidden? The programme heads would think it was an accident? This was a devastating setback to the entire programme. There would surely be an investigation to ensure a repeat could not happen.
- ncmncm 4y ago
  They could have used it on somebody else. Iran is not going to brag about having been hacked.

deleted 4y ago

[deleted]