12 ms·
Engineer Used Water Pump to Get $1B Stuxnet Malware into Iranian Nuclear Plant
- vlovich123 3y agoWhy is the name of an asset being leaked? Doesn’t this put a target on this guys back and make it less likely for other assets to cooperate?
- ecnahc515 3y agoHe’s dead. He died in a motorcycle accident according to the article.
- bmitc 3y ago"Accident." Even still, it outs his family, including his Iranian wife.
- vlovich123 3y agoThe timing on that is quite the coincidence. > Van Sabben passed away in the United Arab Emirates two weeks after the Stuxnet attack as a result of a motorcycle accident.
- foobarian 3y agoAssuming the news reporting is true, of course. Would be a convenient way to protect the real asset.
- vlovich123 3y agoI missed the last sentence at the end.
- RohanAlexander 3y agoFrom the article: "Van Sabben [the engineer] passed away in the United Arab Emirates two weeks after the Stuxnet attack as a result of a motorcycle accident."
- salynchnew 3y agoThis fact gives the whole story "Operation Mincemeat" vibes, tbh.
- rdtsc 3y ago> Van Sabben passed away in the United Arab Emirates two weeks after the Stuxnet attack as a result of a motorcycle accident. Well, that’s not suspicious at all. Any of the parties involved could conceivably benefit from his accident.
- iwontberude 3y agoI agree to the first point that it isn't suspicious given how dangerous motorcycle accidents are. These accidents have a staggering 80% injury or death rate.
- lwhi 3y agoYep, the perfect way to dispatch him without raising too much suspicion.
- iwontberude 3y agoBut it's occams razor that says its more likely to be in a wreck because he commutes on a motorcycle.
- mlyle 3y agoI don't know whether commuting on a motorcycle or working for foreign intelligence to sabotage a hostile state is more dangerous. Either one can cause what looks like a typical accident.
- noqc 3y agoNeither Occam's nor Hanlon's razor are to be used in strategic pursuits.
- mardifoufs 3y agoYou're applying Occam's razor for the most involved and complicated cyber attack in history, that was organized by some of the most powerful intelligence agencies in the world? Talk about stretching an already over stretched "rule of thumb"
- bmitc 3y agoWould be nice to know more details. The mention of water pump is pretty useless, especially one person saying "uh huh" and the other saying "nuh huh". I am assuming it came with an industrial controller that connected via Ethernet which spread the malware.
- boomboomsubban 3y agoA recent discussion on the same story https://news.ycombinator.com/item?id=38909220 https://news.ycombinator.com/item?id=38909220
- runnr_az 3y agoIf one spends $1B on Malware, how does that money get used? Seems like a lot of dev time...
- neverartful 3y agoIf they told you, you would also have a fatal accident.
- dotancohen 3y agoProbably to acquire the equipment that the code needs to run on.
- shmatt 3y agoAn Israeli 8200 engineer makes $350/month for 24/7 availability. Must be the Americans making all the money
- mardifoufs 3y agoHuh? Salaries are that low in Israel? That's cheap even for some African countries lol
- oh_sigh 3y agoIt's not a salary - the "8200" is Unit 8200 - part of the intelligence corps of the IDF. So, it the pay for soldiers, and soldiers in the IDF don't get a salary, but they do get "pocket money".
- dgrin91 3y agoconspiracy hat on I wonder if he ain't dead and they faked his death incase his name ever got out (like this)
- muststopmyths 3y agoIn the middle of the article: >Ralph Langner, a researcher who conducted an in-depth analysis of Stuxnet after the malware’s existence came to light, noted that “a water pump cannot carry a copy of Stuxnet”. In his Xitter post he also says the infiltration timeline doesn't match his analysis. https://twitter.com/langnergroup/status/1744389845638635727 https://twitter.com/langnergroup/status/1744389845638635727 who to believe ?
- ksjskskskkk 3y agolove how the article ends with a bunch of Xitter links disproving everything it said.
- kurthr 3y agoIt's almost as if plausible deniability is all it's about.
- iamthirsty 3y ago> For anybody getting worked up about the Stuxnet article in de Volkskrant: A water pump cannot carry a copy of Stuxnet Erik van Sabben's visit to Iran allegedly happened end of 2018, whereas we assume initial infiltration in 2017. Well, that's all the proof I needed — a twitter post with no further information. Obviously he may be right as he is a researcher and most likely actually did the research, but an non-sourced definitive statement on social media is not what I consider "proof".
- huitzitziltzin 3y agoThis article simultaneously says “here are a bunch of things we claim happened” and then paragraphs later quotes experts who say they could not have or did not happen that way. Why is this valuable? I know as little as I did before reading it.
- reactordev 3y ago“I know as little as I did before reading it” Maybe that was the point. To throw more mis/disinformation to cause more guessing on how it happened instead of who.
- bmicraft 3y agoThe amount of people still thinking about it more than a decade later had to new minimal, surely.
- theginger 3y agoI don't really understand the point being made. It just seems to basically a story about a baseless rumor, the CIA could not confirm or deny, so it must be true, except an independent expert has suggested it's not even possible. Have I missed anything?
- quotz 3y agoWhy would the CIA even respond to this publicly?
- stefanos82 3y agoWhile I was reading it, I couldn't stop myself from thinking "Bourne franchise".
- poundofshrimp 3y agoFor all we know, the death could have been fabricated and the guy is still alive under another identity. This isn’t entirely unreasonable given Iran would have probably tried to kill him anyway, so this could have been agreed by him and the government beforehand to protect his life.
- LanceH 3y agoOr he's completely uninvolved and it's now pinned on him.
- photochemsyn 3y agoThe story I read was that the perpetrators had access to the physical centrifuge control center for a while, and used a thumb drive carried by a contract engineer to plant the malware. Then they lost that physical access, and the centrifuge center replaced all its computers or re-installed the OS, and so they tried to use a viral worm (Stuxnet) to get in and deliver the malware to the target system, which somehow escaped onto the web, resulting in Stuxnet getting detected. Here's a past discussion on HN: "Unilateral Israeli changes to Stuxnet caused its exposure, angering US" 2016, 132 comments: https://news.ycombinator.com/item?id=11108748 https://news.ycombinator.com/item?id=11108748 The key point is in the Ralph Langer pdf in the top comment there (To Kill a Centrifuge, 2013): > "Stuxnet’s early version had to be physically installed on a victim machine, most likely a portable engineering system, or it could have been passed on a USB stick carrying an infected configuration file for Siemens controllers. Once that the configuration file was opened by the vendor’s engineering software, the respective computer was infected. But no engineering software to open the malicious file, equals no propagation." > "That must have seemed to be insufficient or impractical for the new version, as it introduced a method of self-replication that allowed it to spread within trusted networks and via USB sticks even on computers that did not host the engineering software application. The extended dropper suggests that the attackers had lost the capability to transport the malware to its destination by directly infecting the systems of authorized personnel." On the positive side, this event led to a lot of job creation in the energy-related cybersecurity sector. This is an informative read from the time: https://nuclear.duke-energy.com/2012/02/07/stuxnet-and-cybersecurity https://nuclear.duke-energy.com/2012/02/07/stuxnet-and-cyber...
- Amorymeltzer 3y agoI'll point to a NYT story from 2012: <https://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html https://www.nytimes.com/2012/06/01/world/middleeast/obama-or...> >Getting the worm into Natanz, however, was no easy trick. The United States and Israel would have to rely on engineers, maintenance workers and others — both spies and unwitting accomplices — with physical access to the plant. “That was our holy grail,” one of the architects of the plan said. “It turns out there is always an idiot around who doesn’t think much about the thumb drive in their hand.” >In fact, thumb drives turned out to be critical in spreading the first variants of the computer worm; later, more sophisticated methods were developed to deliver the malicious code. >The first attacks were small, and when the centrifuges began spinning out of control in 2008, the Iranians were mystified about the cause, according to intercepts that the United States later picked up. “The thinking was that the Iranians would blame bad parts, or bad engineering, or just incompetence,” one of the architects of the early attack said. I have it saved for that quote: "It turns out there is always an idiot around who doesn’t think much about the thumb drive in their hand."
- WhackyIdeas 3y ago$1-2 Billion… At that moment I thought this article is probably complete trash. I’m not that gullible (even though the word ’gullible’ was removed from the English dictionary in 2021, I am still fond of it). But, seriously. No chance on earth. It’s just PR. And the pump thing is probably just psychological warfare… ‘if they can put it into a water pump, they can put it into anything…’. It was more likely just a mundane USB stick. Every computer has a usb port.
- deleted 3y ago[deleted]
- pseingatl 3y agoAnd a few months later, a similar attack against Saudi Aramco wiped out all of their computer systems, including back-ups. Saudi Aramco management had to rely on employees who kept unauthorized external drives to back-up data. Much was lost. Iran is suspected but: were they able to isolate, turn around an weaponize Stuxnet for their own use?
- fullspectrumdev 3y agoNo, the Shamoon wiper used against Aramco was distinctly different.
- NelsonMinar 3y agoThe original Dutch language reporting: https://www.volkskrant.nl/kijkverder/v/2024/sabotage-in-iran-een-missie-in-duisternis~v989743/ https://www.volkskrant.nl/kijkverder/v/2024/sabotage-in-iran...
- ARandomerDude 3y ago> Stuxnet, which reportedly cost $1-2 billion to develop Wow. Arguably worth it but that is a staggering figure.
- LAC-Tech 3y agoI mean it's a great deal for Israel, to get the US to fund efforts to sabotage your rivals nuclear program. But it's hard to imagine it being worth it to the American taxpayer. Remember it's arguable whether Iran would have bothered pursuing this at all, except Israel itself is a nuclear power, which the United States allowed (see Taiwan in the 1980s for what the US does when other allies try and start their own programs).
- mr_mitm 3y agoIs it worth it, to set back Iran's nuclear program only for two years? Obviously I know nothing about foreign nuclear policy, but 1b still sounds like a lot.
- bongodongobob 3y agoGhandi is usually who I worry about, but I'll definitely spend 0.01 of my gold per to turn to slow down their science tree progression.
- krisoft 3y ago> Is it worth it, to set back Iran's nuclear program only for two years? Dr Jeffrey Lewis (an American expert in nuclear nonproliferation) answers this with a no. Not on monetary grounds, but on the grounds that the setback is only momentary. (While as he proposes diplomacy can bring lasting change.) I recommend his podcast "The Deal": https://www.middlebury.edu/deal-podcast https://www.middlebury.edu/deal-podcast Season 1 and season 2 are entirely about the promise and the collapse of the nuclear deal with Iran. Season 2 episode 4 talks about Stuxnet.
- tslmy 3y agoWhat's that North Korean flag doing there in the cover image?
- padjo 3y ago2 billion? Did they sit on diamond chairs while they coded or something?
- slicktux 3y agoA stuxnet update I see!
- c_o_n_v_e_x 3y agoA water pump cannot carry Stuxnet.... but the Variable frequency drive (VFD) that runs the motor which runs the pump in theory could host malware within the drive's firmware. Or perhaps the VFD was interdicted and had some custom hardware installed? This is all assuming that it's a variable speed pump and not a fixed speed, in which case it's basically directly wired to line voltage with big electrical switch for on/off control. VFDs are connected to the process control system through a variety of interfaces... simple voltage or current loops, serial buses like BACnet, modbus, or ethernet interfaces like modbus TCP.
- deleted 3y ago[deleted]
- doobiedowner 3y agoHacked VFD firmware makes the most sense to me. The PLC/PAC is giving a reference of xx Hz, the hacked VFD overrides the speed reference to destroy the centrifuge but reports back that everything is tickety-boo.
- hoofhearted 3y agoIt was a Siemens system, so PXC.
- kumarvvr 3y agoI think Stuxnet was much more sophisticated, and the pump (along with VFD) could be an entry point into their network. The centrifuges that were destroyed are not driven by pumps. Motors, yes, but not pumps.
- nyxtom 3y agoIt's a great book/story https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196 https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp...
- fuhcghxd 3y ago$1 billion water pump or $3.98 usb flash drive left in the parking lot?
- coretx 3y agoI bet my ass that the recent re-emergence of the Stuxnet story has got everything to do with liability. Who is going to pay for all the damage done outside of Iran ? Questions are tabled in Dutch parliament... The focus on a guy with a USB stick and access to shitty SIEMENS/SCADA systems makes a nice james bond story but I don't see the actual relevance.
- top_sigrid 3y agoCan you elaborate, what kind of liability you are referring to and what the current case is in the Netherlands with regards to that?
- coretx 3y agohttps://www.tweedekamer.nl/kamerstukken/kamervragen/detail?id=2024Z00083&did=2024D00201 https://www.tweedekamer.nl/kamerstukken/kamervragen/detail?i... Here you go! ( Tweedekamer is Dutch parliament ) The news article resulting in the questions: https://www.volkskrant.nl/kijkverder/v/2024/sabotage-in-iran-een-missie-in-duisternis~v989743/ https://www.volkskrant.nl/kijkverder/v/2024/sabotage-in-iran... Looks like NL is going to do a "wir haben ess nicht gewusst" in order to not be liable for collateral damage. "The Americans did it".
- not2b 3y agoMaybe, but I'm skeptical. Also, credibly blaming the infiltration on someone who is no longer alive could be a good way of protecting the spy who really did it and is still alive.
- hiddencost 3y agolol. I love how people can't believe it costs intelligence $1B to do this. I suspect they don't understand that intelligence and the military function by pouring money on a problem until it gets solved despite profound, systemic failures.
- mr_mitm 3y agoWhy don't you share your knowledge for those of us who would like to understand?
- markus_zhang 3y ago> Van Sabben passed away in the United Arab Emirates two weeks after the Stuxnet attack as a result of a motorcycle accident. I'm afraid he was not told the truth of the operation...
- palmfacehn 3y agoImagine the chaos they could cause by putting $1B into bounties and letters of marque style privateer actions.
- euroderf 3y ago"Blame the dead guy" always works.
- romwell 3y agoThere might be reasons why he's dead. Him dying in a motorcycle accident is awfully convenient for whoever hired him if he was, indeed, involved in the operation.
- octocop 3y agoWhy make it a worm that spread all over the world if they had access to the water pumps directly, doesn't make any sense. Now that it's so long ago, I guess a lot of people want their name on Stuxnet because of how sophisticated the attack was.
- bilekas 3y agoI'm sure it's nothing but the conspiracy theorists in me is fascinated that he passed only two weeks after the attack by an accidental crash.
- world2vec 3y ago"Van Sabben passed away in the United Arab Emirates two weeks after the Stuxnet attack as a result of a motorcycle accident." Well, what an unfortunate coincidence.