Pentagon Silent on Iranian Nuke Virus

[teamnelson]

http://liveshots.blogs.foxnews.com/2010/09/27/pentagon-silent-on-iranian-nuke-virus/

The Pentagon is refusing to comment on widespread accusations that it is responsible for coordinating a cyber-attack against Iran's nuclear facilities. Earlier this month the Iranians acknowledged the "Stuxnet Worm" had invaded software it uses at multiple nuclear production plants.

I hope some E-4 in a dark office in front of a glowing screen somewhere is getting a medal. 

[Hooker]

LOL ahh yup

[powderman]

HEH. Maybe it could be hacked to make all their rockets act like a BOOMerang. POWDERMAN. 

[Pat/Rick]

Perhaps the next u.n. meeting, the USA will give him a statement of denial as it never really happened.     

Maybe that E-4 is now an E-5?   

[powderman]

Maybe that E-4 is now an E-5?



I Hope. POWDERMAN. 

[MGMorden]

You'll see more and more of this as time goes on. Cyberwarfare is becoming increasingly important.

I must say though, how stupid do you have to be to connect a system THAT critical to the INTERNET?  Anything that important should have LAN access only - there should be no trace of network cable that leads from something like that back to the WAN. 

Given that it was Iran twas a good thing mind you - just boggles me that they were that inept.

[teamnelson]

Where I work sorta sets the bar for cyber, and it's not enough to simply be disconnected from the Internet. I'd love to know what all was involved in this caper.

We (the US) are VERY vulnerable, particularly infrastructure like power, transportation, etc. and many of those systems are independent.

[MGMorden]

Where I work sorta sets the bar for cyber, and it's not enough to simply be disconnected from the Internet.

Only other way would be to have an inside agent sneak it in (which certainly is a possibility).  No WAN (Internet) access eliminates remote deployment as an option though, so long as you're sure that there's no direct OR indirect access (ie, even if your server is off the WAN, if it's on the same LAN as other systems with WAN access then if the 2nd system is compromised from outside then you can piggyback to the server).

[teamnelson]

The virus targets siemens industrial hardware at the os level, not strictly computers or servers. It could've been introduced by barcode, IR, microwave, teletext, RFID ... any one of a number atypical "cyber" approaches. And of course wetware. All I can say is, nice shot.

[MGMorden]

The virus targets siemens industrial hardware at the os level, not strictly computers or servers. It could've been introduced by barcode, IR, microwave, teletext, RFID ... any one of a number atypical "cyber" approaches. And of course wetware. All I can say is, nice shot.

Most likely of those would be the wetware option (ie, either an inside agent or some clever social engineering).  Barcodes, IR, RFID etc are typically data-only inputs.  You get information in but without a specific targetable vulnerability such as a possible stack overflow (which would be very difficult for a barcode reader given that input it reads will either be fixed-length or of a very limited-length) you'll never get it to actually execute at all, much less with the privileges needed to access anything critical.  A lot of the more creative methods of delivery are seen in Hollywood films but not so much in real life - just doesn't work that way. 

PS: Yep, just did a bit of research on this one.  It's initially spread through a USB flash drive which would have to be inserted into a computer on-site.  That could have been an inside person. Maybe not.  There was a study recently that showed that a ton of people in a typical office would plug in a USB drive they just found on the ground.

Of interest though: this is a Windows-only virus.  Again, incredibly stupid of them to be running critical infrastructure on one of the most insecure OS's in the world.  I'd bet a pile of nickels that if they'd built this system on OpenBSD the system wouldn't have been compromised.  In the 15 years since it was created, OpenBSD has had only TWO remotely exploitable security vulnerabilities discovered (the last of which was corrected back in 2007).  Compare that with Windows with new ones being discovered seemingly every day (this Stuxnet worm took advantage of 4 different known vulnerabilities).

[saddlebum]

HEH. Maybe it could be hacked to make all their rockets act like a BOOMerang. POWDERMAN. 

YOU CRACK ME UP !!!   

When I read that I got this little Monty Python movie playing in my head of a missle doing a U-turn and heading straight at Achmadoofus.   

[wreckhog]

Nice work Obama. I have no doubt that he signed off on this.

[billy_56081]

Hey I'm going to use someone elses famous line here, I bet the Jews did it. And good for them.

[gypsyman]

I'm with Billy on this one. The big O wouldn't try anything to pi** off his buddies. Isreal did it. gypsyman

[powderman]

I'm with Billy on this one. The big O wouldn't try anything to pi** off his buddies. Isreal did it. gypsyman

YEP. Osamas not going to take that chance. POWDERMAN. 

[wreckhog]

So you prefer to believe that Israel runs the Pentagon not the CINC?

[MGMorden]

So you prefer to believe that Israel runs the Pentagon not the CINC?

If Israel did it then it wasn't the Pentagon.  The only evidence leading back to the US Government is the complexity of the worm and motives.  It would have taken far too much time for a hobbyist to have created this, hence the suspicion that it was a government.  The US is a prime possibility, but Israel and several others are perfectly possible too. 

[wreckhog]

Israel is noted for a lot of ex-military software startups. That is about it. They have never been noted for hacking. More wireless. They do have a couple of nuke plants to test on.

Contrast this with China, where hacking both Chinese and other websites is a national hobby. You can even go into shops and buy viruses.

[SHOOTALL]

Israel is noted for a lot of ex-military software startups. That is about it. They have never been noted for hacking. More wireless. They do have a couple of nuke plants to test on.

Contrast this with China, where hacking both Chinese and other websites is a national hobby. You can even go into shops and buy viruses.

Maybe they haven't got caught .  thus not noted for it !

[MGMorden]

Israel is noted for a lot of ex-military software startups. That is about it. They have never been noted for hacking. More wireless. They do have a couple of nuke plants to test on.

Contrast this with China, where hacking both Chinese and other websites is a national hobby. You can even go into shops and buy viruses.

Trust me, there are smart people in just about every country.  There has been lots of software work being farmed out to poorer parts of Africa recently as India was starting to cost too much for the people outsourcing it.

Pick almost any government on this planet and I'd bet they could assembly a team capable of writing and delivering this.  It's more a question of motive and fear (or lack thereof) of retaliation then looking at the overall technical prowess of the country. 

[wreckhog]

That goes against the premise of the original post. Pretty soon, we are going to be looking for a patriotic 5th grader coding on his school library PC.

[wreckhog]

Fun, possibly true, factoid. Bill Gates, before he dropped out of Harvard, was a high school geek. Instead of mowing lawns and delivering newspapers, he was an independant consultant. Job? Programming control systems for the local utility company. Of course, it was a heck of a lot simpler then.

[MGMorden]

That goes against the premise of the original post. Pretty soon, we are going to be looking for a patriotic 5th grader coding on his school library PC.

Not at all.  The premise of saying it was likely a country is the effort involved.  It would have taken a single person a year - possibly several - working day in and day out to develop something this sophisticated.  A 5th grader isn't likely to have that type of attention span and motive.  Even your run of the mill hacker doing it for fun isn't going to put in that level of effort to specifically spy on technical industry.

The fingers pointing to governments as producing this isn't one of capability, it's one of motivation.  With the work involved you practically have to have some political and/or military motivations behind it.  Mere interest or patriotism isn't likely to cut it.

Fun, possibly true, factoid. Bill Gates, before he dropped out of Harvard, was a high school geek. Instead of mowing lawns and delivering newspapers, he was an independant consultant. Job? Programming control systems for the local utility company. Of course, it was a heck of a lot simpler then.

Not all that rare.  I did much the same thing in high school.  Built and repaired computers for people.  Even wrote a few programs here and there for various companies in the area (simple stuff like something to track their employees clocking in and out of work).  It was good money on the side at that age.

[teamnelson]

The great thing about cyberwar is there are literally millions of hobbyists, many of whom work in private network security, cluttering up the battlespace so actual attribution is near impossible to pin down. And they flood blogs, forums & chatrooms with so much speculation in an officious tone that it serves to obscure the event. It's like the trains in London, predictable & reliable. Serves a purpose.

And I seriously doubt Obama signs off on much of anything my agency or the subordinate units of cybercom specifically does. He personally does not meet the traditional requirements for access to certain information, like Clinton before him, nor does he have the time to be briefed on every activity with so many other priorities.

OBTW, the US was also targeted, as well as Indonesia. Hmm.

[MGMorden]

OBTW, the US was also targeted, as well as Indonesia. Hmm.

And Germany apparently.

[myronman3]

the russians built it for them, took their money, then pushed the  self destruct button after the check cleared.    the bear dont play. 

[wreckhog]

The great thing about cyberwar is there are literally millions of hobbyists, many of whom work in private network security, cluttering up the battlespace so actual attribution is near impossible to pin down. And they flood blogs, forums & chatrooms with so much speculation in an officious tone that it serves to obscure the event. It's like the trains in London, predictable & reliable. Serves a purpose.

And I seriously doubt Obama signs off on much of anything my agency or the subordinate units of cybercom specifically does. He personally does not meet the traditional requirements for access to certain information, like Clinton before him, nor does he have the time to be briefed on every activity with so many other priorities.

OBTW, the US was also targeted, as well as Indonesia. Hmm.

You don't think that O would have to sign off on an attack on Iran? Who would then?

 Viruses attack everywhere. However, their target appears to be Iran. Of course, now that it is out there, every 5th grader will be tweaking it to turn on the sprinklers in the girl's locker room too. Are there girl locker rooms in iran?

[teamnelson]

You don't think that O would have to sign off on an attack on Iran? Who would then?

Obama, like the Bushes before him, was an advocate of the consolidation of all US Cyber efforts under a single command. This may be one of a couple things Obama supports that I agree with, as it is the logical progression of future war. Part of the charter of CYBERCOM is cyber attack, along with cyber protect. No, Obama does not sign off on the millions of single incidences of cyber attack or protect that go on in a given fiscal year - he signed off on the existence of an entity who performs those functions. There are layers of oversight, regulation, including congressional review and DOJ task forces, who define very clearly operational parameters in an effort to keep it accountable.

I think a lot of people are very ignorant of what the President does and does not know. Given the size of government, the complexity of the issues, and how many moving parts are at play, the President doesn't really know much, and this one in particular. At his level its simply, "slow Iran down." and from that all the entities interpret their personal contribution to the effort.

[wreckhog]

So who signs off on a specific attack on Iran? Do some risk management. Have a decimal point in the wrong place and you have another Chernobyl. I have a hard believing that is below anyone's paygrade. Fix the economy, fix healthcare, fix immigration, fix Muslims, fix America, fix the stock market, if that is all you have to say before you go to lunch, anyone could be President, as well as keep their old job.


The President as Commander In Chief gives the US military its orders, which all members of the military are obligated to carry out as ordered. The President out-ranks all other military officers and makes the decisions on the highest level. Or as George W. Bush once said, he is the decider.

[teamnelson]

So who signs off on a specific attack on Iran? Do some risk management. Have a decimal point in the wrong place and you have another Chernobyl. I have a hard believing that is below anyone's paygrade. Fix the economy, fix healthcare, fix immigration, fix Muslims, fix America, fix the stock market, if that is all you have to say before you go to lunch, anyone could be President, as well as keep their old job.

So what you're saying is the US govt is a flat organization, and all of us in it report directly to him and he is personally aware of, guiding & directing every action we take? No. That's not the way it works. And yes, the primary function of the President is only to cast the vision, and surround himself with people who ensure implementation. He does not micromanage all operations. We have checks & balances for this specific reason.

The President as Commander In Chief gives the US military its orders, which all members of the military are obligated to carry out as ordered. The President out-ranks all other military officers and makes the decisions on the highest level. Or as George W. Bush once said, he is the decider.
[/quote]

His orders are in the form of desired-end-state, not in step by step implementation. And he is bound by the Constitution and the balance of power with the Legislative and Judicial branches ... and his oath. And if his desired end state is untenable, then it gets kicked back. To imagine that he issues all direct orders given in a day within the entirety of the government is ludicrous.