Stuxnet, DuQu, Flame and Cyber War

[Rebel Yellow]

The New York Times ran an article today claiming (what many already believed) that the United States and Israel are behind the Stuxnet virus which attacked the Iranian nuclear plant Natanz's centrifuges. This is just coming out as another huge piece of malware, Flame, was found in the wild. What do you think about the prospect of Cyberwar which can cause destruction in the real world? How does this change the face of war? Did the US make a huge mistake in creating, or establishing this type of weapon?

More on the story: http://arstechnica.com/tech-policy/2...control-of-it/

More on Stuxnet: http://www.wired.com/threatlevel/201...-stuxnet/all/1

More on Flame:

Quote:

A massive, highly sophisticated piece of malware has been newly found infecting systems in Iran and elsewhere and is believed to be part of a well-coordinated, ongoing, state-run cyberespionage operation.

The malware, discovered by Russia-based antivirus firm Kaspersky Lab, is an espionage toolkit that has been infecting targeted systems in Iran, Lebanon, Syria, Sudan, the Israeli Occupied Territories and other countries in the Middle East and North Africa for at least two years.

Dubbed “Flame” by Kaspersky, the malicious code dwarfs Stuxnet in size — the groundbreaking infrastructure-sabotaging malware that is believed to have wreaked havoc on Iran’s nuclear program in 2009 and 2010. Although Flame has both a different purpose and composition than Stuxnet, and appears to have been written by different programmers, its complexity, the geographic scope of its infections and its behavior indicate strongly that a nation-state is behind Flame, rather than common cyber-criminals — marking it as yet another tool in the growing arsenal of cyberweaponry.

The researchers say that Flame may be part of a parallel project created by contractors who were hired by the same nation-state team that was behind Stuxnet and its sister malware, DuQu.

“Stuxnet and Duqu belonged to a single chain of attacks, which raised cyberwar-related concerns worldwide,” said Eugene Kaspersky, CEO and co-founder of Kaspersky Lab, in a statement. “The Flame malware looks to be another phase in this war, and it’s important to understand that such cyber weapons can easily be used against any country.”

Early analysis of Flame by the Lab indicates that it’s designed primarily to spy on the users of infected computers and steal data from them, including documents, recorded conversations and keystrokes. It also opens a backdoor to infected systems to allow the attackers to tweak the toolkit and add new functionality.

The malware, which is 20 megabytes when all of its modules are installed, contains multiple libraries, SQLite3 databases, various levels of encryption — some strong, some weak — and 20 plug-ins that can be swapped in and out to provide various functionality for the attackers. It even contains some code that is written in the LUA programming language — an uncommon choice for malware.
http://www.wired.com/threatlevel/2012/05/flame/

[BenBurch]

Chinese worms and viruses are being used daily to attack American industrial firms and have the capabilities described for this payload. My company has had to take fairly drastic action to combat them.

[Rebel Yellow]

And how do you think this will run politically with the Republicans trying to saying Obama is doing nothing about Iran's enrichment ambitions?

[BenBurch]

Originally Posted by Rebel Yellow

And how do you think this will run politically with the Republicans trying to saying Obama is doing nothing about Iran's enrichment ambitions?

Possibly they will spin it as Obama playing computer games while Iran makes an Islamic Bomb.

[theprestige]

Originally Posted by Rebel Yellow

What do you think about the prospect of Cyberwar which can cause destruction in the real world?

"Cyber" just means computers. Computers aren't some special fairyland where nothing real ever happens, where you need to do something magical to affect the real world. Computers are the real world.

"Cyber war" is only interesting in the same way that "air war" is interesting, or "sea war" is interesting.

Quote:

How does this change the face of war?

It doesn't. War never changes.

The real question is, how do computers and computer networks change the face of society?

Once you understand how computers fit into society, you'll understand how computer warfare will impact society.

Quote:

Did the US make a huge mistake in creating, or establishing this type of weapon?

Did the US make a huge mistake in creating, or establishing tanks? Submarines? Automatic rifles? Spy satellites?

What, exactly, do you think is so magically special about "cyber weapons"? What, exactly, do you think is notable about the US having them? Do you think it's notable that the US has hand grenades and howitzers?

[BenBurch]

Originally Posted by theprestige

"Cyber" just means computers. Computers aren't some special fairyland where nothing real ever happens, where you need to do something magical to affect the real world. Computers are the real world.

...

And we are being attacked daily.

[theprestige]

Originally Posted by BenBurch

And we are being attacked daily.

You mean, flame and stuxnet aren't a new and unusual form of warfare, introduced gratuitously upon an unsuspecting world by the US and Israel, ushering in a new era of previously unheard-of war crimes?

[BenBurch]

Originally Posted by theprestige

You mean, flame and stuxnet aren't a new and unusual form of warfare, introduced gratuitously upon an unsuspecting world by the US and Israel, ushering in a new era of previously unheard-of war crimes?

People would be surprised how far back this goes.

[BenBurch]

Book about this due out soon; http://www.amazon.com/Confront-Conce.../dp/B006LTIS7G

[theprestige]

Originally Posted by BenBurch

People would be surprised how far back this goes.

I gotta tell you, it's so weird to be agreeing with you. I keep thinking I should argue with you anyway!

[BenBurch]

Originally Posted by theprestige

I gotta tell you, it's so weird to be agreeing with you. I keep thinking I should argue with you anyway!

It's OK, really.

This may be related to the whole cyberwar thing;

http://www.reuters.com/article/2012/...8500IH20120601

[Pantaz]

Originally Posted by BenBurch

Book about this due out soon; http://www.amazon.com/Confront-Conce.../dp/B006LTIS7G

The NY Times piece is "adapted" from the book, as stated at the end of the article.

I just skimmed the article, but I didn't see any citation of references, or mention of fact-checking.

[Muldur]

Originally Posted by theprestige

What, exactly, do you think is so magically special about "cyber weapons"? What, exactly, do you think is notable about the US having them? Do you think it's notable that the US has hand grenades and howitzers?

Cyber "weapons" are the most cost-efficient and potentially effective weapons in our arsenal for non-conventional warfare. Conversely, as we are finding out, the same goes for the bad guys.

A single hacker with a $1200 computer in some seedy back room in Beijing can do as much damage to a US city as a nuclear device if he hits the right target, such as crashing the power grid.

Or he could totally shut down the economy by trashing the information exchanges that handle all our electronic funds transfers both on the commercial (bank) and retail (individual) level.

Tom Clancy predicted a major cyber attack would be a potential component of a future strike against the US in "Debt of Honor".

[BenBurch]

Originally Posted by Muldur

Cyber "weapons" are the most cost-efficient and potentially effective weapons in our arsenal for non-conventional warfare. Conversely, as we are finding out, the same goes for the bad guys.

A single hacker with a $1200 computer in some seedy back room in Beijing can do as much damage to a US city as a nuclear device if he hits the right target, such as crashing the power grid.

Or he could totally shut down the economy by trashing the information exchanges that handle all our electronic funds transfers both on the commercial (bank) and retail (individual) level.

Tom Clancy predicted a major cyber attack would be a potential component of a future strike against the US in "Debt of Honor".

Thing is we know this, and we have rooms full of engineers in well-lit offices and with all the support they could need working on preventing those things from happening. And part of preventing that is source destruction.

[Alareth]

Originally Posted by Rebel Yellow

And how do you think this will run politically with the Republicans trying to saying Obama is doing nothing about Iran's enrichment ambitions?

The program that resulted in Stuxnet was initiated under Bush, so I think they will take the "Obama screwed up important Bush initiative" route since it was discovered on his watch.

[Rebel Yellow]

Originally Posted by theprestige

"Cyber" just means computers. Computers aren't some special fairyland where nothing real ever happens, where you need to do something magical to affect the real world. Computers are the real world.

Nobody thought that. What I meant was that you can use cyber weapons to physically destroy objects that exist outside of the cyberworld. An example of this is what was done with the centrifuges at Natanz. Another possibility is shutting down the controllers, which Stuxnet did, of all kinds of machinery, effectively creating a bomb.

"In other ways, though, Stuxnet seemed routine and unambitious in its aims. Experts determined that the virus was designed to target Simatic WinCC Step7 software, an industrial control system made by the German conglomerate Siemens that was used to program controllers that drive motors, valves and switches in everything from food factories and automobile assembly lines to gas pipelines and water treatment plants." [source]

Originally Posted by theprestige

Did the US make a huge mistake in creating, or establishing tanks? Submarines? Automatic rifles? Spy satellites?

What, exactly, do you think is so magically special about "cyber weapons"?

Nobody said anything about "cyber weapons" being magically special. They are however, in the case of Stuxnet, able to attack a vulnerable sector of the world economy.

"Step7 has a nice, Windows-based interface for programming and monitoring a device called a Programmable Logic Controller. PLCs are essentially small computers, generally the size of a toaster, that control everything from motors in packaging assembly lines to critical valves in gas pipelines. To communicate with and program a PLC, plant workers plug their Step7 Windows machines into the PLC and send commands to it or receive data reports." [source]

Originally Posted by theprestige

What, exactly, do you think is notable about the US having them? Do you think it's notable that the US has hand grenades and howitzers?

I never said anything was notable about the US having them, it just so happened that the US having them was the context of the article. And do you not think it's an interesting question of whether this is opening a can of worms. You seem to be assuming you know my position on this but I was just asking questions of the community on this event.

[Rebel Yellow]

Originally Posted by theprestige

You mean, flame and stuxnet aren't a new and unusual form of warfare, introduced gratuitously upon an unsuspecting world by the US and Israel, ushering in a new era of previously unheard-of war crimes?

Again, you are assuming that I, or whoever thinks this question interesting, is coming from the position of the US as a bad guy who unleashed a weapon of destruction on the world, you couldn't be more wrong. No one said anything of this nature, it is however a valid question of whether or not the cost is worth the benefits. Of which, I think it was perfectly acceptable to go this route; I have very little problem with the US partaking in this type of action as you appear to assume I do. But there are costs and benefits.

These attacks are, no matter how sarcastic and omniscient you perceive yourself to be, the largest and generally first of their kind. Stuxnet being a first and Flame be massive, highly sophisticated piece of malware.

[rcfieldz]

Turn off the pc and back away slowly...

[BenBurch]

Rebel Yellow; No, Flame is not a first. The Chinese have been deploying something like it for almost a decade. Seriously. If you work for an American industrial firm, your firm has been infected at some point.

[Chaos]

Originally Posted by Muldur

Tom Clancy predicted a major cyber attack would be a potential component of a future strike against the US in "Debt of Honor".

Tom Clancy also predicted that Japan would go to war with the US to take back the Marianes, and a bioterrorism attack on the Sydney Olympics. So I´d take what he predicts with a couple of grains of salt.

[Beerina]

It's common for attacks against the US in stories to have a magical component that disables a big chunk of the US military.

[Muldur]

Originally Posted by Chaos

Tom Clancy also predicted that Japan would go to war with the US to take back the Marianes,

Well, no, he predicted that a conspiracy on the part of Japanese ultra-nationalists coulc manipulate the US and Japan into such a war (which was more true then than it is now, but still not impossible)

Quote:

and a bioterrorism attack on the Sydney Olympics. So I´d take what he predicts with a couple of grains of salt.

The scenario he posits for such a bio-attack are still entirely feasable, just as the earlier attempt by the Iranians in his book was and still is.

I'd also point out that he also predicted the use of airliners as suicide weapons.

Clancy has (or at least had) a good nose for the possible in terms of international politics and warfighting. He's gotten a bit lax in terms of keeping up with the state of the world now that he's concentrating of promoting his "brand", rather than actually researching and thinking about how current scenarios might play out.

[Muldur]

Originally Posted by Beerina

It's common for attacks against the US in stories to have a magical component that disables a big chunk of the US military.

"Magic", or a good inside knowledge of the limitations of certain technological and operational decisions on the part of the military leadership.

For example, the continued growth in leveraging computer technology as a force enhancer. All well and good, but what happens when your computer network breaks down or is incapacitated by a virus? How do you give orders to the troops? How do you track supplies and disbursements?

There have been people saying for several years that the future of the Air Force is remote-operated drones. Great, but what happens when the other side figures out how to jam your operating signals?

These are serious issues. As the saying goes "the more you overthink the plumbing, the easier it is to stop up the drain".

[theprestige]

Originally Posted by Muldur

There have been people saying for several years that the future of the Air Force is remote-operated drones. Great, but what happens when the other side figures out how to jam your operating signals?

Something tells me the Air Force won't be particularly surprised by the idea of electronic warfare.

[BenBurch]

Originally Posted by theprestige

Something tells me the Air Force won't be particularly surprised by the idea of electronic warfare.

Nope. Nor the idea of embedding disabling back doors in weaponry firmware...

[Bikewer]

Today's Fresh Air show was with the author of the book, good interview.

[BenBurch]

Originally Posted by Bikewer

Today's Fresh Air show was with the author of the book, good interview.

I have the book on pre-order. Should have it tomorrow.

[BenBurch]

I was just privileged to learn a whole lot more about the attacks.

It's worse than you might imagine, and better-coordinated than you think.

And now that I have seen this information, that is the last I will say about it.

[steve s]

NPR's Science Friday talked with Wired's Kim Zetter about the Flame virus today.

http://sciencefriday.com/segment/06/...-computer.html

Steve S