11 ms·
Obama Order Sped Up Wave of Cyberattacks Against Iran
- chubot 14y agoIs this a purposeful leak to take credit for a national security win before the election? Seems like they kept it under wraps pretty well until now. There was a TED talk by Ralph langer in which he was asked if he thought the Mossad was behind Stuxnet, as that was the common belief. His response was that it must be the only cyber superpower -- the US.
- nyellin 14y agoThis is an excerpt from a soon-to-be-published book, so some of the quotes might be much older.
- pbrook 14y agoHoly shit. Stuxnet was just confirmed as being developed by the US and Israel.
- est 14y agoThis is sad. China has one more strong execuse to buff its national firewall.
- ars 14y agoWhy is it sad? I'd prefer a cyberwar over a physical one. And in any case the Chinese national firewall is utterly useless for preventing this.
- johnchristopher 14y agoIt's all fun and games until a nuclear plant blows up. I know, nuclear plant don't blow up, but you get my point.
- ars 14y ago> but you get my point. No I don't. A physical war can also blow things up. How is a cyberwar worse? This is not a game, it's a covert attack.
- johnchristopher 14y agoI didn't say it was worse or better. My point is: "cyberwar" can be responsible for painful and "real" physical damage in the physical world. In that regard it is in no way "better" than the "usual/conventionnal" physical wars.
- ars 14y ago> can be responsible for painful and "real" physical damage in the physical world Well of course, that's the entire point! They are not trying to do entirely virtual actions à la Star Trek's A Taste of Armageddon. However, you have to concede that at least so far the physical damage is far lower, and therefor unlike you I do regard it as better.
- pooriaazimi 14y agoImagine I could blow MasterCard and every single bit of data they possess up. Its consequences are worse than 15 nuclear bombs.
- krschultz 14y agoReally? Lets say you did blow Mastercard up. Worst case, the government prints money to pay off all the debts (a 'bailout' if you will). We've done this for far less than a cyber attack. There is some inflation, a lot of hand wringing about cyber security, and the world goes on. GDP might drop a bit, maybe it triggers a recession, but a year later we're back on our feet. 15 nuclear bombs could kill millions of people. Entire cities could be wiped out with 300+ years of history, architecture, irreplacable museum artifacts, etc. People in general would flee cities en mass. It would fundamentally shake the country and likely lead to the US retaliating in a nuclear war, or at least a large scale general war not seen since WW2. The US would probably roll a million man plus army across the middle east or north korea to destroy whatever country allowed the bombs to be built. That war would not be the (relatively) white gloved affair that are the current rules of engagement. I understand hyperbole, but that statement is just false.
- deleted 14y ago[deleted]
- tzs 14y ago> I'd prefer a cyberwar over a physical one As long as we heed the lesson from Star Trek, episode 23, "A Taste of Armageddon" and don't make cyberwars so clean that no one bothers to end them.
- cmelbye 14y agoWhat? Their "national firewall" is for censorship of certain websites, what does that have to do with this?
- deleted 14y ago[deleted]
- josteink 14y agoThis really makes you wonder at what point do you go from calling something "some digital nudging about between nations" to "war". To me this seems to qualify as terrorism and sabotage on all accounts. I'm pretty sure I know how the US would react if they had been on the receiving end of this sort of attack.
- nyellin 14y agoI don't know about the states, but we (Israel) have been on the receiving end of actual terrorism and sabotage through Iranian proxy groups. Stuxnet seems mild compared to funding suicide bombings.
- sleepyhead 14y agoAnd Iraq had weapons of mass destruction.
- nyellin 14y agoI could be wrong, but I don't think this is speculation: * Iran funds Hezbolla: http://en.wikipedia.org/wiki/Funding_of_Hezbollah http://en.wikipedia.org/wiki/Funding_of_Hezbollah * Iran funds the Islamic Jihad: http://en.wikipedia.org/wiki/Islamic_Jihad_Organization http://en.wikipedia.org/wiki/Islamic_Jihad_Organization * Iran funds Hamas: http://en.wikipedia.org/wiki/Iran%E2%80%93Israel_relations#Iranian_Funding_of_Hamas_and_Hezbollah http://en.wikipedia.org/wiki/Iran%E2%80%93Israel_relations#I... * Example of suicide bombing by the Islamic Jihad: http://www.dailymail.co.uk/news/article-2145621/Family-Daniel-Wultz-awarded-332M-judgement-Iran-Syria-Israeli-suicide-bombing.html http://www.dailymail.co.uk/news/article-2145621/Family-Danie... I understand this is a highly-loaded political issue in the states, but, for Israel, Iranian funded terrorism is a threat in and of itself, nuclear weapon or not.
- derrida 14y agoBoth sides commit terrorism, where terrorism is defined as "politically motivated violence against civilians".
- bcn 14y ago"...is based on interviews...with current and former American, European and Israeli officials... None would allow their names to be used..." Not exactly confirmed, but at least there are a few more details being (intentionally?) leaked. Good ole NYT is always ready to spill the words of unnamed 'officials', but the more interesting question is why, or why now?
- steelaz 14y agoDidn't Pentagon said last year that they would consider cyber attacks as acts of war?
- rwallace 14y agoYes. That position has now pretty much lost credibility, which in my view is no bad thing. I've had the good fortune to never experience actual war, but I'm pretty sure nobody with such experience, is in the slightest doubt about the difference between that and sabotaging computers, however annoying the latter might be. If cyber-conflict is going to take place, I think it's in everyone's interest to keep it at that level and stop it spilling over into war.
- Jach 14y agoMr. Obama, according to officials in the room, asked a series of questions, fearful that the code could do damage outside the plant. The answers came back in hedged terms. Mr. Biden fumed. “It’s got to be the Israelis,” he said. “They went too far.” In fact, both the Israelis and the Americans had been aiming for a particular part of the centrifuge plant, a critical area whose loss, they had concluded, would set the Iranians back considerably. It is unclear who introduced the programming error. I guess it's naive to think they might be using git and could resolve this with a simple `git blame`...
- jonknee 14y agoIt's a little different when half the goal is to leave no trace of who wrote the software (and everything is obfuscated to hell).
- brainless 14y agoSo now countries will fight cyber war, then what? cyber defense systems. So humans will never learn lessons, will they? How far is Skynet?
- saraid216 14y agoIt's okay. We'll just add this line of code in: http://xkcd.com/534/ http://xkcd.com/534/
- fluxon 14y agoI'm a little disappointed by the lack of named sources and/or documents. Most assertions are anonymous paraphrases or quotes. That seems thin, and makes the book seem rushed and exploitative.
- jkeogh 14y agoLets not forget, when the government does it, it's OK. Can we get over the "our leaders are altruistic" thing? Once power is obtained they cite "saving the people from n" as the excuse for power expansion. Isn't using fear to control societies going to get old at some point? The path we are on can be traced from the "Tower and Fundamental Physics".
- redthrowaway 14y ago>The code itself is 50 times as big as the typical computer worm All else aside, this is a clear pointer to government contractors.
- kamaal 14y agoHow did they possibly know the code is 50 times that big. Is the code out in the open?
- c16 14y ago"Several layers of masking obscured the zero-day exploit inside, requiring work to reach it, and the malware was huge — 500k bytes, as opposed to the usual 10k to 15k." - http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/all/1 http://www.wired.com/threatlevel/2011/07/how-digital-detecti... This is a great read and very informative!
- ArbitraryLimits 14y agoYes it is, but your parent post was asking how they knew how large the source code was. This quotation is reporting the size of the final binary.
- schiffern 14y agoWhere did the article say 'source code'? Machine code is still 'code'. You have to consider the audience the NY Times is targeting. Just knowing what a compiler is puts one in relatively sparse company.
- petegrif 14y agoYes.
- tptacek 14y agoThe relationship between compiled code and source code is not as mysterious as you're making it out to be. This is not a hard analysis to conduct. Incidentally, from friends who do serious malware reversing work (we do not do any malware work): the "50x bigger, feels like pro contractors" assessment rings true for several other reasons; for instance, the style of programming used in the worm itself.
- derrida 14y agoHB Gary was passed the source in 2010: http://crowdleaks.org/hbgary-wanted-to-suppress-stuxnet-research/ http://crowdleaks.org/hbgary-wanted-to-suppress-stuxnet-rese... Anonymous scooped the NYTimes.
- derrida 14y agoTo defend myself against the downvoters who may not have made the same connections: Aaron Barr talks to Defence Intelligence Agency and DoD about StuxNet in 2010, they had a copy given to them in 2009 that they claim was a US produced binary. Keep in mind stuxnet was 'discovered' in 2010. First reference to Stuxnet being U.S. government produced? They had a binary they believed was US produced. It was Stuxnet. It was 2009.
- majmun 14y agoAre there any clues , how many people worked on stuxnet and flame.coding style methodology, how this project was managed etc. ? (Im still not convinced that this is from goverment)
- petegrif 14y agoSemantec has done several detailed analyses of Stuxnet. They are in no doubt this was an extremely well resourced project that was state financed.
- majmun 14y agoYeah I read that, but nobody seems to mention what coding and project management practices were used in development of this software. If this software is really done by military then it's development process was following some strict military standards and regulation. and should be similar to existing other software. Regulations like : How is software partitioned to modules? What interfaces it is using? Are this novel or existing techniques? and things like that.
- Achshar 14y agoThe code was (obviously) obfuscated and encrypted in every way possible so that it's origin or any details about it's inception cannot be read if someone catches the code. To expect a readme file saying "managed by git on mac" in stuxnet's root directory is laughable.
- deleted 14y ago[deleted]
- jgrahamc 14y agoThis shouldn't be a surprise to anyone. The set of { countries that are capable of creating something like Stuxnet and getting it into the plant } intersection with the set of { countries fearful of Iran } comes down to { US, Israel }. You might add UK in there and UK might have assisted the US in the creation of Stuxnet if the US had asked.
- excuse-me 14y agoAlthough a Billion quid government IT project which was then abandoned 5years later without ever delivering anything would probably be noticed.
- gcb 14y agoOr not. That's why they have national security and classified information. So they don't have to tell you were your tax is going.
- yaix 14y ago“It turns out there is always an idiot around who doesn’t think much about the thumb drive in their hand.” Good quote. And there seems to always be a Windows PC around that auto-runs anything you stick into it.
- deleted 14y ago[deleted]
- adimitrov 14y agoThe actual exploit stuxnet used to get onto Windows PCs didn't require the computer to have autorun turned on. The exploit runs on all newer versions of Windows (XP-7) and it triggers by browsing the device's contents with Explorer. (Specifically, it exploits a method Explorer uses to show icons on .lnk (Windows' sym-links) files.) http://www.geek.com/articles/news/new-stuxnet-usb-exploit-threatens-windows-users-20100719/ http://www.geek.com/articles/news/new-stuxnet-usb-exploit-th...
- morsch 14y agoYou're corroborating the grand-parent's point that Windows PCs autorun everything you stick into them. Granted, in this case it's not by design, but still...
- adimitrov 14y agoThat's kinda the point: blaming autorun will make people who are "smart" enough to switch off autorun feel secure. But they aren't. There are vulnerabilities far more insidious than autorun.
- excuse-me 14y agoGood job there are no Windows machines used for any critical infrastructure in our country then.
- fdr 14y agoThe most interesting information in here to me by far: > In an interesting twist, it was discovered that the Stuxnet > malware group makes use of device drivers which were digitally > signed to make them appear as though they originated from > hardware vendor Realtek Semiconductor Corp. The digital > certificate has since been revoked but it is worrying that > malware writers seemingly had access to a private key issued to > a trusted supplier of device drivers.
- lunchbox 14y agoI'm very curious who gets hired to write the code for a project like this. What caliber are they, what kinds of backgrounds do they come from, and how are they recruited to these positions? Is this more likely to be done by a government agency or a defense contractor? I have always assumed that the world's most talented hackers work in places like Silicon Valley and Wall Street, but Stuxnet was clearly the work of some brilliant minds, so I'm curious.
- ars 14y agoIf it's Israel then they come from the military which is the first place students go after school - so they do in fact have access to the world's most talented hackers. A lot of them go on to create startups after finishing service. See: http://news.ycombinator.com/item?id=977176 http://news.ycombinator.com/item?id=977176 for a bit more.
- maukdaddy 14y agoBoth agencies and contractors employee people with the skillsets needed to write these kinds of things. While there are a large number of incompetent government employees and contractors, there are also a small number of frighteningly talented developers working in this area.
- ImprovedSilence 14y agoIt's the same with any big company, and it kind of boils down to the adage: "20% of the people do 80% of the work".
- chii 14y agoi sometimes wish that there's some sort of darwinian selection system that could be put in place, in order to improve the overall efficiency and productivity of companies...but then again, i m writing this from my work terminal...
- brigade 14y agoI think there are defense contractors that develop and weaponize exploits, rootkits, and so on for the government and while I'm sure some of that work was used in Stuxnet, I think anything specific to Stuxnet was handled by actual governmental agencies. The article names the NSA and an Israeli unit. As for recruiting, you wouldn't ever get recruited directly to such a project - you'd already need a TS/SCI clearance and to have proven yourself within the NSA. As for recruiting into the general field of classified cybersecurity, it's not too much different from any other field; they post job ads, scour college campuses, probably advertise at defcon, etc. Generally if you're getting hired without a clearance it's not for a specific position - it takes upwards of half a year before you get cleared and can start, at which point they figure out which project to put you in. As for the most talented hackers, keep in mind the subject area: Wall Street has very little demand for security researchers, and Silicon Valley's demand for them is minuscule compared to the government's.
- c16 14y agoWhat amazes me, and please excuse my naïvety, is that the congressmen are constantly pushing for more control online- whether that be monitoring skype, access to our facebook, or what have you. Basically taking our freedom in the name of 'Cyber Security', however on the other hand, they're the ones who are creating these viruses, exploiting systems and posing cyber threats. What has the world come to?
- sethbannon 14y agoHow ironic that one of the first major forays into cyber warfare be codenamed "Olympic Games".
- deleted 14y ago[deleted]
- strags 14y agoMeanwhile, the US continues to attempt to extradite Garry McKinnon from the UK - without a trace of irony.
- tptacek 14y agoThis is like saying that because the US mistakenly invaded Iraq, it no longer has the moral authority to prosecute drive-by shootings. The syllogism holds on a message board but is useless in reality.
- hughw 14y agoIt appears they "acquired" Realtek's code signing certificate. Can Realtek bring action against the U.S. for stealing the certificate? Edit: For stealing the private key, I mean.
- jcampbell1 14y agoThis is clearly an approved leak from the administration. The number of sources and specifics make it very easy to catch whoever leaked this information. If this wasn't approved, the leaker is going to be sitting next to bradly manning within a week, and there is no moral cause to leak this information, so it is safe to assume this was an approved leak. The real question, is why did the administration leak the story, and why now? Is it politically motivated because Obama wants to seem tough on Iran in an election year? Is it to trick the Iranians into thinking the program is over? Maybe versions 2, 3, and 4 are already in place, and it will be demoralizing to Iran's program if they keep getting setback.
- salimmadjd 14y agoI agree...or Sanger has another agenda by leaking this. But either way, this is more purposeful than just trying to break a story.
- conradev 14y agoFlame hit the mainstream news not too long ago, that may have something to do with it.
- jcampbell1 14y agoGreat point, that makes sense to me. Derivative malware is being created, and the administration went public to send a wakeup call to domestic industries to be vigilant. Rather than telling sensitive companies and organizations like Los Alamos, and waiting for a leak, the administration leaked the info to the NYT to control the message. Now that the story is out, the CIA/NSA can work with sensitive industries to contain the fallout of derivative malware like Flame. The timing makes sense.
- gaius 14y ago"That thing we're illegally doing to other countries, they might do to us, it's not fair!"
- deleted 14y ago[deleted]
- goggles99 14y agoObama will do anything to avoid a conflict right now. If gasoline prices go up any more, his opposition will be running ads replaying the video of him saying he believes that gasoline should be in the $5-$7 range so alternative energy will become more adopted. (everyone knows this so it makes him very weak internationally) So this should surprise no one. He used technology to get elected, and he will use technology to try and stop Iran without a physical military conflict.