Development and testing of the Stuxnet worm

http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html?pagewanted=all

by jonburs • 16 years ago

137 78 16 years ago

dmix2• 16 years ago

It's seemingly safe to believe that there is a very high probability that the US and Israel are behind Stuxnet.

According to Wikipedia, if this is true than 2010 had the first occurrence of cyber-warfare between nation states in our history.

http://en.wikipedia.org/wiki/Stuxnet

bootload• 16 years ago

"... 2010 had the first occurrence of cyber-warfare between nation states in our history ..."

Estonia reported in 2007 - "Russia accused of unleashing cyberwar to disable Estonia" Ian Traynor, Guardian, 17 May 2007 ~ http://www.guardian.co.uk/world/2007/may/17/topstories3.russ...

askar_yu• 16 years ago

2008's conflict between Russia and Georgia had also a had cyber aspect.

http://bits.blogs.nytimes.com/2008/08/11/georgia-takes-a-bea...

tsotha2• 16 years ago

>It's seemingly safe to believe that there is a very high probability that the US and Israel are behind Stuxnet.

I guess, if you're willing to take the word of unidentified people who may or may not even exist. Though you did include a lot of weasel words in that sentence...

nir3• 16 years ago

Quite a few of the people quoted in the article are identified, seem to be in position to know what they're talking about and definitely exist.

By "weasel words" you mean OP (and NYT) don't state as facts things which are, while very likely, not confirmed to be facts?

btilly2• 16 years ago

The first occurrence? Very unlikely.

It goes back farther than you'd think. The first incident that I've heard about was in 1982. See http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage for details.

rdl• 16 years ago

Electronic and signals warfare has an even longer history; RDF in WW1 and earlier, and of course Enigma/Colossus and the RADAR war of ww2. I wouldn't consider these unrelated to cyberwarfare.

endtime2• 16 years ago

Why is it so surprising/impressive that the worm was tested on centrifuges similar to those it was targeting? More than once, the article emphasizes that this is unusual and interesting...am I missing something?

metachris• 16 years ago

They are complicated, large and extremely expensive. Nothing one could do in a garage.

endtime2• 16 years ago

Okay...I didn't know anyone was still considering the possibility that Stuxnet was developed in a garage.

jaydz• 16 years ago

This story would be more interesting if Microsoft and/or Siemens actually helped develop this malware.

kenjackson• 16 years ago

I think the story would be more interesting if the malware appeared to have come from aliens from outside our solar system who knew that Iran getting nuclear capability would destroy the world and eventually set the galaxy out of balance. They send a virus back through time to stop Iran.

This reporter finds evidence of this in the virus, and additionally finds indications of future events that have yet to unfold, but which this virus will also disrupt.

Otherwise, I think you're left with a pretty mundane story.

nir3• 16 years ago

The story could definitely use some Nicholas Cage.

tomjen3• 16 years ago

Siemens did help them by giving the us access to their machines for "security" reasons.

extension4• 16 years ago

I haven't decided yet how to feel about Stuxnet. On one hand, good guys don't release viruses into the wild, period. On the other hand, only good has come from this. Iran doesn't get nukes until later and industry figures out that they need to lock down their machine controllers, without any real damage.

atomical2• 16 years ago

Aren't people worried Iran could potentially develop something similar to target oil rigs? Is there a guy at the CIA saying, "Oh don't worry about it boys; it's a one off, they'll never be able to figure it out or respond in kind."

At one point Persians were one of the most educated minorities in the US. They have good universities in Iran and I wouldn't put it past them to develop the capabilities to push back against this attack.

extension4• 16 years ago

If Iran is going to do, or is already doing, cyberwarfare then they'll do it whether or not they get attacked first. But now, everyone will be on guard.

I think for the most part, Stuxnet will be a one of a kind event in history. Though it's a nasty thing to do, only one team ever gets to do it, and I'd rather it be us than them.

forensic7• 16 years ago

All the educated Persians I know hate the crap out of the Iranian government and are happy about Stuxnet

MichaelSalib5• 16 years ago

Iran doesn't get nukes until later

So, we're not going to change the end-game, we're just going to piss of Iran....and you think that's good?

Consider things from the Iranian's perspective. Back in the day, they were establishing a legitimate democratically elected government. The US overthrew that government and pushed a brutal dictator into power, who tortured and murdered many Iranians. From their perspective, the US is an evil nation that does evil things. Nuclear weapons look like the only thing that could give them security against the US. And we're hellbent on stopping them. Heck, the US has never even apologized for overthrowing their government and installing a murderous dictator: can you really blame the Iranians for believing that the US government is trying to screw with their country?

The only way this ends well is with a deal and deals require trust. Does Stuxnet promote that trust? Or does Stuxnet just provide further evidence that the hardliners are right, that the US is trying to screw with their country?

industry figures out that they need to lock down their machine controllers

This seems like wishful thinking. We have a terrible track record of getting large scale systems secured, even in areas where those systems are under continuous public attack. Industrial software is not one of those areas, so developers of such software are unlikely to take security very seriously. But even if they did: we don't know how to get them to build secure systems.

Microsoft spends a huge amount of developer time and money on system security. They're not very successful. But they devote a much larger fraction of their budget to that goal than any industrial software shop. So expecting industrial software shops to produce code that is even as secure as Microsoft's seems...unlikely.

extension4• 16 years ago

So, we're not going to change the end-game, we're just going to piss of Iran....and you think that's good?

All I want is for nobody to get nuked. I think it's more likely that nobody will get nuked if Iran doesn't have nukes. But you're right that Stuxnet is a dirty move that erodes trust, that's why I'm conflicted.

We have a terrible track record of getting large scale systems secured, even in areas where those systems are under continuous public attack. Industrial software is not one of those areas, so developers of such software are unlikely to take security very seriously.

Surely going from complete obliviousness to awareness is the biggest step the industry will ever take to being secure, even if subsequent progress is slow. But I think they will fare better than corporate or home users, because there are less of them and they are more technically inclined and disciplined.

ecuzzillo2• 16 years ago

The Iran political situation is not exactly about to topple, but it's not the most stable situation in the world, either. Four-plus years is a really long time when we're talking about the CIA's/US's/Israel's ability to topple a potentially vulnerable regime.

btilly2• 16 years ago

Heck, the US has never even apologized for overthrowing their government and installing a murderous dictator...

The closest the US has come to an apology that I am aware of is Obama's 2009 speech in Cairo where he said, In the middle of the Cold War, the United States played a role in the overthrow of a democratically elected Iranian government. See http://www.whitehouse.gov/the-press-office/remarks-president... for the full speech.

forensic7• 16 years ago

You're speaking as if that hypothetical person in Iran actually exists and is immortal.

The Iranians in 1953 are not the same Iranians today.

The situation today is that you have a sabre rattling theocracy that funds terrorism trying to get nuclear weapons.

What possible concession could the West make to get Iran to stop striving for nukes? Nothing. Iranian leadership wants nukes before their rule is overthrown by the people in favour of a democracy. Before the hearts and minds of a sufficient majority move for change away from totalitarianism.

It's very important to stop them from getting nuclear weapons. 1953 has no bearing on this situation 60 years later.

bueller3• 16 years ago

i guess you haven't seen Hackers

rdouble• 16 years ago

good guys don't release viruses into the wild, period.

Didn't one of the guys from Y Combinator once release a virus into the wild?

edanm2• 16 years ago

http://en.wikipedia.org/wiki/Morris_worm

It was an accident, though.

rdtsc5• 16 years ago

> On the other hand, only good has come from this

Are you completely sure of that?

bueller3• 16 years ago

the net positive is that cyber-security is brought to the forefront for the US gov, more importantly this will be a great movie staring colin farrell as an Israeli ruby developer that came up with the plan

bueller3• 16 years ago

http://en.wikipedia.org/wiki/Unit_8200

Dove• 16 years ago

Also, http://en.wikipedia.org/wiki/Twenty-Fourth_Air_Force

This stuff isn't new -- it's just new to most people.

Estragon• 16 years ago

I probably shouldn't be surprised by willful ignorance anymore, but it amazes me that everybody in the article can celebrate this achievement and at the same time admit that it's just "pushing back the clock." Israel's still going to get hit by a nuclear weapon some time, because the technology to build one is just going to keep getting cheaper and more accessible.

btmorex2• 16 years ago

You think it's inevitable that Israel gets nuked? I find that very unlikely, especially since the attacking nation would definitely be destroyed as well.

Iran doesn't want nukes so that they can destroy Israel. They wants nukes, because obtaining them immediately makes them powerful on the world stage. (and I say that as someone who really doesn't want to see them get nukes too because they're a crazy religious theocracy)

yassersouri3• 16 years ago

Think for one minute. Who is the craziest nation in this regard? Who has used nukes twice to murder people. US of course.

icarus_drowning• 16 years ago

Its certainly probably that Iran doesn't want nukes in order to use them against Israel. But that doesn't mean you get to discount their rhetoric about destroying Israel, and the fact that such rhetoric aligns horrifically neatly with the notion of a nuclear Iran.

Still, the prospect of an Iran that is powerful on the world stage and the inevitable proliferation that will result probably increases the chances that someone crazy enough to nuke an Israeli city will get ahold of enough material to do so exponentially.

So this doesn't make it inevitable, just a hell of a lot more likely.

edanm2• 16 years ago

"You think it's inevitable that Israel gets nuked? I find that very unlikely, especially since the attacking nation would definitely be destroyed as well."

The biggest fear isn't that Iran attacks Israel. The biggest fear is that they'll make a few nuclear weapons, give them to terrorists that aren't officially affiliated with them, and let the terrorists nuke Israel.

In a case where there is a terrorist nuclear attack on Israel, that can't be directly tied to Iran, I'm not sure what Israel could do.

nir3• 16 years ago

>I find that very unlikely, especially since the attacking nation would definitely be destroyed as well.

You're talking about a region where suicide bombing is perhaps the most common attack method now. I think its clear that our definition of rationality is different from Iran's regime (as opposed to Iranian people).

I agree Israel is a relatively minor issue. The real conflict here is Sunni-Shiite and Farsi-Arab (Iran-Iraq war alone probably had more casualties than the entire 100 year Arab-Israeli conflict). If Iran has a nuclear capability, it's unthinkable that Saudi Arabia or Egypt or, at a later stage, Iraq, will not strive to have it as well. You will get a multi-lateral arms race in the most volatile region in the world.

On the other hand, it's impossible to stop Iran forcefully. The best you could hope for is to delay it, hoping that the current regime will be replaced by a more rational one.

_szvt• 16 years ago

You Americans don't get it. Israel and US murder our scientists. They try to stop our progress towards nuclear energy. They put sanction on us so we can't buy things like air planes and our planes are old and they crash and people die. ... All because of what? Because they believe we want to build stupid nuclear bomb -which we don't- and they have no evidence of it. So we stay in a war. Peace is never going to become a reality. And It's Americans fault.

Peaker2• 16 years ago

Why is Iran developing long-range missiles with the capability of carrying nuclear warheads in parallel to its nuclear program?

Iran has been involved in multiple wars by proxy for a while now, it is unlikely an opportunity to arm itself with nukes will arise and they will not take it.

ryoshu• 16 years ago

Most likely because it is a non-Arab power in the Middle East that is threatened on two sides by the world's only standing super power -- a super power that has routinely threatened invasion of Iran. Look at the WikiLeaks cables that exposed the pressure from other Middle Eastern governments for the US to invade Iran. Given the geopolitics, Iran's desire for nuclear weapons is perfectly rational.

forensic7• 16 years ago

Trust is not easy.

If you were the Prime Minister of Israel what would you do?

adrianwaj3• 16 years ago

Stuxnet: forcing Israel haters everywhere to come sulking out of the woodwork.

Development and testing of the Stuxnet worm

Related Stories