4 ms·

It is anything but confirmed. Arstechnica writes an article about an article in the NYT (a paper that doesn't have the best track record reporting about cyber e

by dpeck 14y ago

It is anything but confirmed. Arstechnica writes an article about an article in the NYT (a paper that doesn't have the best track record reporting about cyber events and control system security issues to begin with) that cites no credible sources. Also, you don't "lose control" of something like this, it was designed with many ways to spread. If control was lost it was during the spec/coding phase, not after deployment.

gavinlynch 14y ago
The sources aren't named, but it would be a pretty major, major slip-up to specifically claim to site NSA advisers if it were made up out of whole cloth. As in, career ending for the writer. For example, "...according to members of the president’s national security team who were in the room." Journalists don't drop phrases like that lightly, and you don't have access to several NSA members and high-ranking US officials unless this leak is 100% sponsored by the Administration. It clearly was: one can tell by the quantity and range of officials that were interviewed who demonstrate, at points, first-hand knowledge of the situation. Now, the question of whether these NSA advisers are -lying- as part of a propaganda campaign is a fair question. I wouldn't be shocked if they were, but everything that I have anecdotally read about Stuxnet and just using common sense, tells me--a layman on the outside looking in--that there is a pretty decent probability this is true, or at least pretty close to the truth. Clearly, the timing of this is politically relevant. The President wants to take credit for it to boost his domestic stock in the runup to the election. He can repeat these two key points whenever he is questioned on foreign policy: 1) I killed Bin Laden 2) I'm the guy who set the maniacal Ahmadinejad's nuclear ambitions back. The guy who is preventing the destruction of Israel. Regardless of your political persuasion, these are potent points that have a chance to resonate with the electorate. (fwiw: I'm not particularly in love with the NYTimes. I don't have an affinity for any particular newspaper anymore. I'm not defending the newspaper, just pointing out the likely reality as I understand it)
tptacek 14y ago
When the New York Times prints: “Should we shut this thing down?” Mr. Obama asked, according to members of the president’s national security team who were in the room. It is generally safe to assume, whether you admire the NYT (like me) or don't (like 'patio11), that there's an actual source with a credible claim to have been in the room with the President who did in fact tell David E. Sanger that this happened. People have accused the NYT of bending the truth in lots of ways, but misreporting a White House meeting is not one of those ways. I'm annoyed to have to write this, because I'm one of the people who thought the Stuxnet thing was marvelously overhyped and unlikely to be true. Friends of mine who are much smarter than me thought the worm might have just been a cover for direct sabotage. Nope; it seems like the government was exactly as simultaneously savvy and idiotic as online pundits had claimed it was. Depressing.
- jbooth 14y ago
  Why's it depressing? It seems like it worked, and any failure would have been much less spectacular than US operatives being caught breaking into Natanz.
  - tptacek 14y ago
    Sabotage: good. Sabotage via infiltration of IT: good. Sabotage via infiltration of IT via propagating malware: not so good.
- dpeck 14y ago
  Eh, perhaps. Either way, I think Dale puts my feelings into words better than I would have, http://www.digitalbond.com/2012/06/01/ny-times-historical-fiction-on-stuxnet/ http://www.digitalbond.com/2012/06/01/ny-times-historical-fi.... Misreporting or being given a specific leak that the administration would like to see published? Lots of incentives for the powers that be to pseudo-claim credit for this in a nudge-nudge-wink-wink sort of way.
- lawnchair_larry 14y ago
  Yeah, you and Nate Lawson were totally out to lunch on that. I was honestly amazed that anyone thought it could have been anything else, and still am. But I see nothing idiotic about it.
- FreakLegion 14y ago
  Did your friends who thought it might have been a cover for direct sabotage not examine the code? I assume anyone working in InfoSec at least has access to the binaries. With an appropriate SCADA controller you can see it in action, too. Edit: Actually it looks like these days anyone can grab RE'd source off the intarwebs, though I haven't checked to see if the downloads Google is feeding me are legitimate.
eli 14y ago
How much more do you think you can reasonably expect for an ongoing covert national security program? If the article is wrong, it would be a massive screw up. Huge. Historical. The kind of thing that would prompt a strong rebuke from the named countries and individuals. In fact it's a remarkably well sourced article given the context and a cynical person might speculate on the timing of this revelation in regards to the upcoming election. But yeah, it's confirmed. And I suggest you read the full NYT article (if you haven't). The Ars summary adds little value and elides many details that make the overall story more credible.
- dpeck 14y ago
  You act as if its something that the countries would want to rebuke. Seems like good PR and an orchestrated leak to me.
  - eli 14y ago
    So someone else created Stuxnet, but many months after its discovery the US government orchestrated a leak involving multiple government agencies and a detailed backstory to falsely take credit for it? That seems like a complicated and unnecessary conspiracy theory that runs a very high risk of unraveling in an embarrassing fashion. It is not plausible.
brown9-2 14y ago
the NYT (a paper that doesn't have the best track record reporting about cyber events and control system security issues to begin with) Do you have any citations for what you are referring to here? I'd like to read more about this topic (and the NYT) if you have the info available.

by dpeck 14y ago

gavinlynch 14y ago

The sources aren't named, but it would be a pretty major, major slip-up to specifically claim to site NSA advisers if it were made up out of whole cloth. As in, career ending for the writer. For example, "...according to members of the president’s national security team who were in the room." Journalists don't drop phrases like that lightly, and you don't have access to several NSA members and high-ranking US officials unless this leak is 100% sponsored by the Administration. It clearly was: one can tell by the quantity and range of officials that were interviewed who demonstrate, at points, first-hand knowledge of the situation. Now, the question of whether these NSA advisers are -lying- as part of a propaganda campaign is a fair question. I wouldn't be shocked if they were, but everything that I have anecdotally read about Stuxnet and just using common sense, tells me--a layman on the outside looking in--that there is a pretty decent probability this is true, or at least pretty close to the truth. Clearly, the timing of this is politically relevant. The President wants to take credit for it to boost his domestic stock in the runup to the election. He can repeat these two key points whenever he is questioned on foreign policy: 1) I killed Bin Laden 2) I'm the guy who set the maniacal Ahmadinejad's nuclear ambitions back. The guy who is preventing the destruction of Israel. Regardless of your political persuasion, these are potent points that have a chance to resonate with the electorate. (fwiw: I'm not particularly in love with the NYTimes. I don't have an affinity for any particular newspaper anymore. I'm not defending the newspaper, just pointing out the likely reality as I understand it)

tptacek 14y ago

When the New York Times prints: “Should we shut this thing down?” Mr. Obama asked, according to members of the president’s national security team who were in the room. It is generally safe to assume, whether you admire the NYT (like me) or don't (like 'patio11), that there's an actual source with a credible claim to have been in the room with the President who did in fact tell David E. Sanger that this happened. People have accused the NYT of bending the truth in lots of ways, but misreporting a White House meeting is not one of those ways. I'm annoyed to have to write this, because I'm one of the people who thought the Stuxnet thing was marvelously overhyped and unlikely to be true. Friends of mine who are much smarter than me thought the worm might have just been a cover for direct sabotage. Nope; it seems like the government was exactly as simultaneously savvy and idiotic as online pundits had claimed it was. Depressing.

jbooth 14y ago
Why's it depressing? It seems like it worked, and any failure would have been much less spectacular than US operatives being caught breaking into Natanz.
- tptacek 14y ago
  Sabotage: good. Sabotage via infiltration of IT: good. Sabotage via infiltration of IT via propagating malware: not so good.
dpeck 14y ago
Eh, perhaps. Either way, I think Dale puts my feelings into words better than I would have, http://www.digitalbond.com/2012/06/01/ny-times-historical-fiction-on-stuxnet/ http://www.digitalbond.com/2012/06/01/ny-times-historical-fi.... Misreporting or being given a specific leak that the administration would like to see published? Lots of incentives for the powers that be to pseudo-claim credit for this in a nudge-nudge-wink-wink sort of way.
lawnchair_larry 14y ago
Yeah, you and Nate Lawson were totally out to lunch on that. I was honestly amazed that anyone thought it could have been anything else, and still am. But I see nothing idiotic about it.
FreakLegion 14y ago
Did your friends who thought it might have been a cover for direct sabotage not examine the code? I assume anyone working in InfoSec at least has access to the binaries. With an appropriate SCADA controller you can see it in action, too. Edit: Actually it looks like these days anyone can grab RE'd source off the intarwebs, though I haven't checked to see if the downloads Google is feeding me are legitimate.

eli 14y ago

How much more do you think you can reasonably expect for an ongoing covert national security program? If the article is wrong, it would be a massive screw up. Huge. Historical. The kind of thing that would prompt a strong rebuke from the named countries and individuals. In fact it's a remarkably well sourced article given the context and a cynical person might speculate on the timing of this revelation in regards to the upcoming election. But yeah, it's confirmed. And I suggest you read the full NYT article (if you haven't). The Ars summary adds little value and elides many details that make the overall story more credible.

dpeck 14y ago
You act as if its something that the countries would want to rebuke. Seems like good PR and an orchestrated leak to me.
- eli 14y ago
  So someone else created Stuxnet, but many months after its discovery the US government orchestrated a leak involving multiple government agencies and a detailed backstory to falsely take credit for it? That seems like a complicated and unnecessary conspiracy theory that runs a very high risk of unraveling in an embarrassing fashion. It is not plausible.

brown9-2 14y ago

the NYT (a paper that doesn't have the best track record reporting about cyber events and control system security issues to begin with) Do you have any citations for what you are referring to here? I'd like to read more about this topic (and the NYT) if you have the info available.