8 ms·

A Look at Stuxnet, the World's First Digital Weapon

54 points by ghosh 12y ago

teamhappy 12y ago
This is quite important for the current debates we're having. If you look at the news media, or the Hacker News front page for that matter, you stumble upon articles accusing China and Russia to hack into foreign governments regularly. Similarly, China and other asian countries are often accused of adding backdoors to their hardware (e.g., routers, switches, telco equipment). The only* backdoors ever found in hardware were found in hardware build by US-based companies. And, of course, Stuxnet is the first example of governments (USA and Israel) attacking a foreign country's critical infrastructure with a "digital weapon." I'm not sure how to feel about that. *I'm not sure this is still true today --- Let me add that, when it comes to topics like this one we should probably stick to what we know for sure. Figuring out if code is a backdoor or a bug is already hard enough (not always though). The same goes for attacks. Governments accuse each other of doing a lot of things, and fortunately, sometimes they even admit that they make these claims up. Oh and please don't take my word for any of this. There are well known and respected people who speak very openly about these topics on conferences like CCC, DEFCON, etc.
- kokomo 12y ago
  I 'heard' that stuxnet was responsible for fouling fukushima (scrambling reactor controls) and similarly beta tested at a US reactor in the south somewhere... but I 'heard' it on the interwebs
- kokomo 12y ago
  i think it's been used against Iran's nuclear program as well?
- Dove 12y ago
  I'm not sure how to feel about that. I know how I feel about it: I would much rather wars were fought with code and robots than with tanks and bayonets. And I would rather those than CBRN weapons! Certain countries were going to neutralize that facility. Had to, for survival reasons. The only real question is . . . how? They could have picked a full-scale war. They could have precision-bombed the facility. They could have assassinated the workers. These solutions have all been chosen in the past, in similar scenarios. By comparison with the other options available, Stuxnet achieved the goal in an extremely civilized manner, with no loss of life. They say the purpose of war is to kill people and break things, but really it isn't -- it's to accomplish objectives, to make people do what you want. The killing and breaking is really just a way to make objectives happen. And the better targeted your weapons are, the better you can make what you want to happen happen with less and less extra mess. Cyberweapons are some of the best targeted things ever dreamed of in the history of warfare. You can disable infrastructure without going within miles of harming a human on either side, military or otherwise. I am a big fan.
  - hawkice 12y ago
    To give a concrete example of your excellent point: You could hack into missile guidance systems and have the missiles all route to the Pacific ocean -- having the boards fritz-out is a MUCH less powerful weapon, blowing up the factory for missiles is much less powerful than that. I'm sure if Stuxnet could make the machinery seem to work but not give them good enough materials to build anything worthwhile, (1) those engineers would have done that, and (2) the public would still not know about it. This is perhaps the best argument for cyber-weapons, too (the intelligence/espionage element): it inverts the incentives. You build a gun, I need a better gun. You have a bomb, I need a bigger bomb that kills more people and destroys more and more. But cyber-weapons? Best cyber-weapons change the very least possible to accomplish the actual objective. Breaking the ENIGMA, for instance, didn't change every single tactical choice for the Allies. To do so would eliminate a large portion of the benefits.
    - AlyssaRowan 12y ago
      The drawback is that they require systematic vulnerabilities to work; therefore the rhetoric for state-sponsored malware demands systems deliberately be left vulnerable to attack, either by failing to fix vulnerabilities found or deliberately inserting them (as in by backdoors) This has a global effect. The "enemy" uses the same things you do. A weapon to attack them demands weaknesses in everyone's armour, including your own. They are so easily reverse-engineered and repurposed to attack you or third parties, so easily developed by low-budget or non-state actors, and so easily misattributed, that they exhibit all the same essential properties as biological weapons. I think state-sponsored malware should be banned, by international treaty, and I say this as someone with expertise in the field.
      - hawkice 12y ago
        So, let's tease out a couple ideas here, that way I can address your core idea at its best. >They are so easily reverse-engineered and repurposed to attack you You probably meant just third parties here. No one is checking government machine's patch level and demanding an explanation -- if they have the exploit they probably patched any vulnerable systems before they used it. > I think state-sponsored malware should be banned, by international treaty So, espionage is largely _already_ banned by international treaty, including fairly specific rules about how, if you are a soldier down behind enemy lines you can escape using a disguise but not if you are a spy (I hope this conveys how bizarre international law is, the idea that if a spy is caught that their use of a disguise will play a factor in their fate). Suffice it to say, you want a "soft ban", because you want them to not be used in reality (not just that you don't want them used in threat gestures, etc. -- plus you can't really rely on international law for things like this, as we've seen by recent NSA leaks as well as Merkel's response to learning she was personally wiretapped). ---- Most importantly: you have an argument that is too general. You could make _precisely the same argument_ in defense of banning pistols in any wars. (1) enemy is symmetrically offensive; (2) if there exist defenses, your opponent is likely to use them; (3) this leaves you largely unprotected to isomorphic attacks for all useful versions of this weapon (soldiers can still die from gunshot wounds); (4) similar technology can be devised by your opponents; (5) guns can be developed by low-budget or non-state actors; (6) direct attribution for gun crime is difficult (about half of murders in the US go unsolved, and that's not in a war zone). So governments paying for pistols is too dangerous and should be "soft banned" or banned by international treaty. I believe you have a more complex belief that would provide for much better discussion (subject matter experts typically do). Would you mind expanding on your ideas and sharing?
- pimlottc 12y ago
  > The only* backdoors ever found in hardware were found in hardware build by US-based companies. What was the backdoor, can you provide a link?
  - xenophonf 12y ago
    No one's absolutely certain, but the following article makes a pretty good case for Crypto AG: https://web.archive.org/web/20080101082631/http://www.inteldaily.com/?c=169&a=4686 https://web.archive.org/web/20080101082631/http://www.inteld... Edited to add: I tried chasing down a few of the links mentioned in the comments of https://www.schneier.com/blog/archives/2008/01/nsa_backdoors_i.html https://www.schneier.com/blog/archives/2008/01/nsa_backdoors..., but I hit some dead ends and lack time to give you further detail. Sorry about that. As far as I can tell, the original report comes from Der Spiegel.
  - kbart 12y ago
    Another one: http://www.infoworld.com/article/2608141/internet-privacy/snowden--the-nsa-planted-backdoors-in-cisco-products.html http://www.infoworld.com/article/2608141/internet-privacy/sn...
cafard 12y ago
What about the bogus code that supposedly led to a Soviet gas pipeline explosion years ago?
- eli 12y ago
  I thought those were more like faulty engineering blueprints
  - dmckeon 12y ago
    Looks more like SCADA software than plans: https://en.wikipedia.org/wiki/Siberian_pipeline_sabotage https://en.wikipedia.org/wiki/Siberian_pipeline_sabotage
yuhong 12y ago
One interesting thing about Stuxnet is that it targeted Win2000 but was only discovered just after it went out of support.
- teamhappy 12y ago
  I'm not sure how relevant this is given that people claim the purpose of Stuxnet was to attack Iran's nuclear facilities. Facilities like that usually aren't allowed to install software updates anyway. The reason is certification. They install certified software on a machine, and then it gets locked away and nobody is allowed to touch it. Then again, I don't know if this is true for Iran as much as it is for western countries.
- ganzuul 12y ago
  ...So Microsoft would have maintained code to circumvent detection? Is that the correlation?
dutchievandyk 12y ago
"An look"? Not a native speaker, but shouldn't it be "A look"?
- arh68 12y ago
  I imagine the short limit to titles' lengths forced an omission: An Unprecedented Look at Stuxnet...
- dang 12y ago
  It certainly should. Thanks—fixed.
transpy 12y ago
I have lost the ability to read a long piece. I feel frustrated when I go to the news site and I am presented with a 'narrative' that seems to hide the real information. I need a paragraph that tells me straight forward what this weapon is about, not a long, obfuscated narrative. It's my fault, I'm not complaining.
- presumeaway 12y ago
  I think I know why you're getting down-voted, but it's an interesting and real issue. If you go a while, mostly digesting only tiny chunks of information, your brain optimizes around that and eventually becomes bad at dealing with longer narratives. (Aside: sometimes those narratives are worthwhile, other times they seem like they're just filler to make editors and publishers happy. But that's beside the point.) It's also something we seem to be losing as a society. The good news is, at least in my own experience, it's a skill we can develop (and it's closely related to attention span). When I buckle down and read complex texts for non-Internet periods of time (20-30 minutes), I quickly regain my speed and comprehension. But I find it important to deliberately exercise that part of my brain.
- lcedp 12y ago
  I second that whole-heartedly. Sometimes google/ddg/wikipedia gives the paragraph you are talking about: > Stuxnet is a computer worm that was discovered in June 2010. It was designed to attack industrial Programmable Logic Controllers or PLCs. PLCs allow the automation of electromechanical processes such as those used to control machinery on factory assembly lines, amusement rides, or centrifuges for separating nuclear material. Exploiting four zero-day flaws, Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software. Stuxnet reportedly compromised Iranian PLCs, collecting information on industrial systems and causing the fast-spinning centrifuges to tear themselves apart. Stuxnet's design and architecture are not domain-specific and it could be tailored as a platform for attacking modern SCADA and PLC systems, the majority of which reside in Europe, Japan and the US. Now I know what the hack Stuxnet is. Quite interesting but I'm not feeling like going into details - time saved.
daveriess 12y ago
Here's one of the Siemens forum threads where apparently stux is first encountered by engineers. https://www.automation.siemens.com/forum/guests/PostShow.aspx?PostID=250319&Language=en&PageIndex=1 https://www.automation.siemens.com/forum/guests/PostShow.asp...
- skaevola 12y ago
  Wow... forget dog, I guess nobody on the internet knows if you're an Iranian nuclear engineer.

54 points by ghosh 12y ago

This is quite important for the current debates we're having. If you look at the news media, or the Hacker News front page for that matter, you stumble upon articles accusing China and Russia to hack into foreign governments regularly. Similarly, China and other asian countries are often accused of adding backdoors to their hardware (e.g., routers, switches, telco equipment). The only* backdoors ever found in hardware were found in hardware build by US-based companies. And, of course, Stuxnet is the first example of governments (USA and Israel) attacking a foreign country's critical infrastructure with a "digital weapon." I'm not sure how to feel about that. *I'm not sure this is still true today --- Let me add that, when it comes to topics like this one we should probably stick to what we know for sure. Figuring out if code is a backdoor or a bug is already hard enough (not always though). The same goes for attacks. Governments accuse each other of doing a lot of things, and fortunately, sometimes they even admit that they make these claims up. Oh and please don't take my word for any of this. There are well known and respected people who speak very openly about these topics on conferences like CCC, DEFCON, etc.

kokomo 12y ago
I 'heard' that stuxnet was responsible for fouling fukushima (scrambling reactor controls) and similarly beta tested at a US reactor in the south somewhere... but I 'heard' it on the interwebs
kokomo 12y ago
i think it's been used against Iran's nuclear program as well?
Dove 12y ago
I'm not sure how to feel about that. I know how I feel about it: I would much rather wars were fought with code and robots than with tanks and bayonets. And I would rather those than CBRN weapons! Certain countries were going to neutralize that facility. Had to, for survival reasons. The only real question is . . . how? They could have picked a full-scale war. They could have precision-bombed the facility. They could have assassinated the workers. These solutions have all been chosen in the past, in similar scenarios. By comparison with the other options available, Stuxnet achieved the goal in an extremely civilized manner, with no loss of life. They say the purpose of war is to kill people and break things, but really it isn't -- it's to accomplish objectives, to make people do what you want. The killing and breaking is really just a way to make objectives happen. And the better targeted your weapons are, the better you can make what you want to happen happen with less and less extra mess. Cyberweapons are some of the best targeted things ever dreamed of in the history of warfare. You can disable infrastructure without going within miles of harming a human on either side, military or otherwise. I am a big fan.
- hawkice 12y ago
  To give a concrete example of your excellent point: You could hack into missile guidance systems and have the missiles all route to the Pacific ocean -- having the boards fritz-out is a MUCH less powerful weapon, blowing up the factory for missiles is much less powerful than that. I'm sure if Stuxnet could make the machinery seem to work but not give them good enough materials to build anything worthwhile, (1) those engineers would have done that, and (2) the public would still not know about it. This is perhaps the best argument for cyber-weapons, too (the intelligence/espionage element): it inverts the incentives. You build a gun, I need a better gun. You have a bomb, I need a bigger bomb that kills more people and destroys more and more. But cyber-weapons? Best cyber-weapons change the very least possible to accomplish the actual objective. Breaking the ENIGMA, for instance, didn't change every single tactical choice for the Allies. To do so would eliminate a large portion of the benefits.
  - AlyssaRowan 12y ago
    The drawback is that they require systematic vulnerabilities to work; therefore the rhetoric for state-sponsored malware demands systems deliberately be left vulnerable to attack, either by failing to fix vulnerabilities found or deliberately inserting them (as in by backdoors) This has a global effect. The "enemy" uses the same things you do. A weapon to attack them demands weaknesses in everyone's armour, including your own. They are so easily reverse-engineered and repurposed to attack you or third parties, so easily developed by low-budget or non-state actors, and so easily misattributed, that they exhibit all the same essential properties as biological weapons. I think state-sponsored malware should be banned, by international treaty, and I say this as someone with expertise in the field.
    - hawkice 12y ago
      So, let's tease out a couple ideas here, that way I can address your core idea at its best. >They are so easily reverse-engineered and repurposed to attack you You probably meant just third parties here. No one is checking government machine's patch level and demanding an explanation -- if they have the exploit they probably patched any vulnerable systems before they used it. > I think state-sponsored malware should be banned, by international treaty So, espionage is largely _already_ banned by international treaty, including fairly specific rules about how, if you are a soldier down behind enemy lines you can escape using a disguise but not if you are a spy (I hope this conveys how bizarre international law is, the idea that if a spy is caught that their use of a disguise will play a factor in their fate). Suffice it to say, you want a "soft ban", because you want them to not be used in reality (not just that you don't want them used in threat gestures, etc. -- plus you can't really rely on international law for things like this, as we've seen by recent NSA leaks as well as Merkel's response to learning she was personally wiretapped). ---- Most importantly: you have an argument that is too general. You could make _precisely the same argument_ in defense of banning pistols in any wars. (1) enemy is symmetrically offensive; (2) if there exist defenses, your opponent is likely to use them; (3) this leaves you largely unprotected to isomorphic attacks for all useful versions of this weapon (soldiers can still die from gunshot wounds); (4) similar technology can be devised by your opponents; (5) guns can be developed by low-budget or non-state actors; (6) direct attribution for gun crime is difficult (about half of murders in the US go unsolved, and that's not in a war zone). So governments paying for pistols is too dangerous and should be "soft banned" or banned by international treaty. I believe you have a more complex belief that would provide for much better discussion (subject matter experts typically do). Would you mind expanding on your ideas and sharing?
pimlottc 12y ago
> The only* backdoors ever found in hardware were found in hardware build by US-based companies. What was the backdoor, can you provide a link?
- xenophonf 12y ago
  No one's absolutely certain, but the following article makes a pretty good case for Crypto AG: https://web.archive.org/web/20080101082631/http://www.inteldaily.com/?c=169&a=4686 https://web.archive.org/web/20080101082631/http://www.inteld... Edited to add: I tried chasing down a few of the links mentioned in the comments of https://www.schneier.com/blog/archives/2008/01/nsa_backdoors_i.html https://www.schneier.com/blog/archives/2008/01/nsa_backdoors..., but I hit some dead ends and lack time to give you further detail. Sorry about that. As far as I can tell, the original report comes from Der Spiegel.
- kbart 12y ago
  Another one: http://www.infoworld.com/article/2608141/internet-privacy/snowden--the-nsa-planted-backdoors-in-cisco-products.html http://www.infoworld.com/article/2608141/internet-privacy/sn...

cafard 12y ago

What about the bogus code that supposedly led to a Soviet gas pipeline explosion years ago?

eli 12y ago
I thought those were more like faulty engineering blueprints
- dmckeon 12y ago
  Looks more like SCADA software than plans: https://en.wikipedia.org/wiki/Siberian_pipeline_sabotage https://en.wikipedia.org/wiki/Siberian_pipeline_sabotage

yuhong 12y ago

One interesting thing about Stuxnet is that it targeted Win2000 but was only discovered just after it went out of support.

teamhappy 12y ago
I'm not sure how relevant this is given that people claim the purpose of Stuxnet was to attack Iran's nuclear facilities. Facilities like that usually aren't allowed to install software updates anyway. The reason is certification. They install certified software on a machine, and then it gets locked away and nobody is allowed to touch it. Then again, I don't know if this is true for Iran as much as it is for western countries.
ganzuul 12y ago
...So Microsoft would have maintained code to circumvent detection? Is that the correlation?

dutchievandyk 12y ago

"An look"? Not a native speaker, but shouldn't it be "A look"?

arh68 12y ago
I imagine the short limit to titles' lengths forced an omission: An Unprecedented Look at Stuxnet...
dang 12y ago
It certainly should. Thanks—fixed.

transpy 12y ago

I have lost the ability to read a long piece. I feel frustrated when I go to the news site and I am presented with a 'narrative' that seems to hide the real information. I need a paragraph that tells me straight forward what this weapon is about, not a long, obfuscated narrative. It's my fault, I'm not complaining.

presumeaway 12y ago
I think I know why you're getting down-voted, but it's an interesting and real issue. If you go a while, mostly digesting only tiny chunks of information, your brain optimizes around that and eventually becomes bad at dealing with longer narratives. (Aside: sometimes those narratives are worthwhile, other times they seem like they're just filler to make editors and publishers happy. But that's beside the point.) It's also something we seem to be losing as a society. The good news is, at least in my own experience, it's a skill we can develop (and it's closely related to attention span). When I buckle down and read complex texts for non-Internet periods of time (20-30 minutes), I quickly regain my speed and comprehension. But I find it important to deliberately exercise that part of my brain.
lcedp 12y ago
I second that whole-heartedly. Sometimes google/ddg/wikipedia gives the paragraph you are talking about: > Stuxnet is a computer worm that was discovered in June 2010. It was designed to attack industrial Programmable Logic Controllers or PLCs. PLCs allow the automation of electromechanical processes such as those used to control machinery on factory assembly lines, amusement rides, or centrifuges for separating nuclear material. Exploiting four zero-day flaws, Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software. Stuxnet reportedly compromised Iranian PLCs, collecting information on industrial systems and causing the fast-spinning centrifuges to tear themselves apart. Stuxnet's design and architecture are not domain-specific and it could be tailored as a platform for attacking modern SCADA and PLC systems, the majority of which reside in Europe, Japan and the US. Now I know what the hack Stuxnet is. Quite interesting but I'm not feeling like going into details - time saved.

daveriess 12y ago

Here's one of the Siemens forum threads where apparently stux is first encountered by engineers. https://www.automation.siemens.com/forum/guests/PostShow.aspx?PostID=250319&Language=en&PageIndex=1 https://www.automation.siemens.com/forum/guests/PostShow.asp...

skaevola 12y ago
Wow... forget dog, I guess nobody on the internet knows if you're an Iranian nuclear engineer.