Stuxnet is embarrassing, not amazing

http://rdist.root.org/2011/01/17/stuxnet-is-embarrassing-not-amazing/

by r11t • 16 years ago

72 107 16 years ago

rdist.root.org

geophile2• 16 years ago

I know nothing about malware, but I know a lot about shipping production software.

- Simpler is better than complicated. As pointed out in one of the comments on the article, increasing complexity increases risk of failure.

- Proven techniques are, uhh, proven. Newer techniques are inherently riskier.

- Really speculating here, but maybe impenetrable obfuscation was actually undesirable? I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it. A successful cyber-attack means that future attacks of the same sort are possible, and adds a bargaining chip to the Israeli/US side. This can lead to Iranian concessions down the road. Without a proven success, a similar negotiation tactic would have to be much more difficult.

viraptor• 16 years ago

Alternatively, maybe they just thought it is not that important? They were attacking important infrastructure. They were actually going against a country... which had access to the destination machines. As long as they go through usual AVs and don't do extensive dynamic updates of the malware, how much time would they gain? How many experienced people were really looking at that thing? Since their attack wasn't really done the day after the malware was released, even hiding the payload for a month or more wouldn't make much difference in reality, would it?

gte910h• 16 years ago

>Really speculating here, but maybe impenetrable obfuscation was actually undesirable? I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it.

I think the idea (Making the red team have to put up with expensive and costly countermeasures to malware) is a good one, however I think it is unlikely the reason this was detected.

potatolicious• 16 years ago

> "I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it."

Or perhaps it was engineered to be as complex as necessary to accomplish the job (sabotage), but simple enough that Israel didn't have to show all of its cyber-warfare cards.

There's a good chance that any worm, no matter how engineered, will be detected and reverse engineered. It makes sense not to go all-in on any single one and reveal your techniques unless the difficulty of intrusion calls for it.

NateLawson9• 16 years ago

The technique I describe is actually less-risky in terms of false positives. If you don't get the right combination of inputs right, you literally can't decrypt the payload. Even 1 bit of error gives a completely invalid key. It also isn't a new technique. I've seen it in shipping products for at least 12 years.

The one valid criticism is that it is more work to implement. But it's not that hard.

raganwald2• 16 years ago

No wireless. Less space than a nomad. Lame.

Substitute any of a thousand critiques of <any language except Lisp|Haskell>, Windows, Linux, you name it that is out in the world getting its job done.

tptacek12• 16 years ago

Uncharacteristically facile. The subtext of Nate's post is that while Stuxnet clearly didn't foreclose on Iran's nuclear ambitions, its careless design may have foreclosed on an otherwise viable nonviolent method of shutting down the harmful industrial processes of other rogue states.

Nate is saying, take exactly one step back and look at Stuxnet and you see that it has two jobs: one†, to retard the Iranian nuclear program, and two, to do so at a minimal cost to future intelligence activities. At that second objective it seems to have demonstrably failed; there are teenagers who have done better jobs of concealing the payloads of malware.

† If you believe all the Stuxnet press.

raganwald2• 16 years ago

I like your thinking, but the tone of the post doesn't communicate that point as well as your comment.

Now as to point two, I read elsewhere in these comments that one possible advantage of Stuxnet's simplicity is that whomever launched this attack can launch another one with a higher level of stealth.

You are the expert, not I. I only know that in Sports this is often a good strategy. Hold off on your strongest plays until the opposition has proven they can stop your average plays.

gcb• 16 years ago

You don't want to hide your weapons in an arms race.

nikcub11• 16 years ago

My own theory is that after watching Iran kill themselves for a year trying to figure this thing out, they sent out an update of Stuxnet that made it easier to discover as a way of showing their hand.

By that point, according to most reports, the program had been set back by three years (as effective as what a military strike would have been, according to the NYT article).

It was hidden for almost two years, then suddenly discovered - at which point dozens of security companies around the world deconstructed the worm in a process that took weeks.

fleitz• 16 years ago

The simplicity of the design makes it easy to point fingers at non-US / Israeli sources. Via the simplistic design the US and Israel have plausible deniability. When a piece of malware looks no different than any other released last year then it could well have been developed by bulgarian teenagers. Bulgarian teenagers will raise less international issues than using advanced techniques that only the highly trained CIA / NSA / Mossad operatives have.

mxavier• 16 years ago

Most Bulgarian teenagers don't have access to nuclear centrifuge controller units for the purpose of designing/testing their code.

jcl• 16 years ago

Or perhaps the software got an accidental "early release"?

redthrowaway• 16 years ago

As to the "in a hurry" bit, we know that to be true, or at least we do if we believe the recent NYT article. Obama was, according to that article, briefed on Stuxnet before coming into office. As soon as he was in office, he rushed the program. It may be that he simply removed some bureaucratic hurdles, or he may have told the team that said they needed 9 months to get in done in 4. I suspect we'll never know.

georgieporgie• 16 years ago

I do not understand this criticism at all. Stuxnet worked, right?

MichaelSalib13• 16 years ago

Assuming that Stuxnet was designed to delay Iranian nuclear efforts, there are different degrees of "working". Delaying for a week is better than delaying for a day, etc. If better cloaking would have allowed Stuxnet to remain hidden for longer, than it would have delayed Iranian nuclear efforts more.

eli• 16 years ago

Sending a clear message of, "we have the ability to launch effective cyberattacks against you" may have been a goal as well. Make it too stealthy and it might be a while before anyone realizes they were attacked.

InclinedPlane2• 16 years ago

The current interpretation of events is that Stuxnet is a project of the Israeli government which has been at least partially successful in slowing Iran's attempts to build nuclear weapons.

Considering that the alternative would be bombing of nuclear facilities involving perhaps unauthorized overflights of neighboring countries and the risk of inflaming a hot war in the middle east (through the overflights and the bombings) I don't think I can rate this operation as anything other than a huge success.

rbanffy2• 16 years ago

A huge success would be if it derailed Iran's nuclear program completely and managed to contaminate the installations for the next couple thousand years, with enough warning as to avoid loss of human life, while forcing Iran to rebuild from scratch somewhere else and, at the same time, leave their authorities wondering what kind of bad luck hit them.

Of course, not all Israeli military want to avoid a confrontation. Military don't usually get medals for preventing wars.

kreneskyp• 16 years ago

according to leaked cables some middle eastern countries actually encouraged us to bomb Iran. Otherwise I agree that a non-military solution is at least initially appealing.

  I fear whoever unleashed this has opened a pandora's box of destructive malware.  We've already seen things like China hacking major corporations and manipulating it's currency.  It's not hard to picture a future where malware is used to hurt the competition's production, at either a corporate or state level.

InclinedPlane2• 16 years ago

From the perspective of just about every other country in the region there is a hell of a lot of difference between Israel bombing Iran and the US bombing Iran.

NateLawson9• 16 years ago

All the current interpretations of events commit the fallacy of "if A then B, B therefore A". Just because centrifuges have purportedly been taken offline recently doesn't mean Stuxnet necessarily caused it. There are other potential causes that are more mundane.

ig1• 16 years ago

Stuxnet is a hugely complex piece of code already, and it's something that needed to be as bug free as possible, and that means avoiding unnecessary complexity.

A key part of being a software developer is knowing when to make trade-offs rather than striving for "perfection".

The virus did it's complex job successfully. Building a piece of software of this complexity that has to work in an unknown environment first time is amazing.

marcinw• 16 years ago

Being a software developer and being an exploit developer are two entirely different things. Professional exploit developers DO NOT ship unless it's perfect. Malware authors will ship even if it's not perfect, because the target is not technically advanced and can get away with it. If you're targeting a nation-state, you best not compromise your intent, how you broke in, nor how long you've been there for.

NateLawson9• 16 years ago

Yes, that is the exact point of this article.

danilocampos2• 16 years ago

Real Mossad Operatives Ship.

These guys weren't making a paean to beautiful, hardened software to impress their hacker friends. They needed to get the simplest, most reliable and effective code possible out the door in as short a time as possible.

Israel bought itself a few more years of a nuke-free Iran. This is a successful, amazing, even miraculous outcome. Outside of nerd circles, software is measured by results, not architecture or complexity. Beautiful systems that never ship are fine for weekend projects but, uh, we're talking about stopping a nuclear weapons program here. It's a bit like saying that Apollo 11 was bullshit because the accommodations weren't anywhere near as nice as flying on Pan Am.

Stuxnet is the Jack Bauer of software. Rough edges but badass and gets the job done under impossible circumstances.

MichaelSalib13• 16 years ago

Israel bought itself a few more years of a nuke-free Iran.

Do we actually know that? Is there any evidence that this delayed the program by "years" rather than a few months?

tkahn66• 16 years ago

Seems like they really messed them up.

According to Western intelligence reports, Russian scientists warned the Kremlin that they could be facing "another Chernobyl" if they were forced to comply with Iran's tight deadline to activate the complex this summer.

http://www.telegraph.co.uk/news/worldnews/europe/russia/8262...

rdtsc3• 16 years ago

> Real Mossad Operatives Ship.

How do you know that?

neworbit• 16 years ago

I suspect your question is "how do you know that they're behind stuxnet" for which none of us probably have the answer - or if one of our loyal HN readers does, they're not really likely to divulge it.

The statement quoted in general, though, seems pretty true. That particular agency has a track record for being rather active rather than just quietly/passively gathering intel.

gruseom3• 16 years ago

we're talking about stopping a nuclear weapons program here.

But the unanimous consensus ("with high confidence") of all 16 US intelligence agencies remains that Iran does not have a nuclear weapons program. I haven't seen that mentioned once in any discussion of this subject here. That's just weird.

I don't follow this stuff closely and obviously have no idea what's going on behind the scenes, but it seems likely that everything about this business is stuffed to the gills with propaganda. Is there any credibly objective source anywhere?

rprasad• 16 years ago

Yet. The unanimous consensus was that Iran does not yet have a nuclear weapons program, but that it was attempting to establish one.

The purpose of Stuxnex was to push back Iran's progress by a few years.

Confusion• 16 years ago

  But the unanimous consensus ("with high confidence") of 
  all 16 US intelligence agencies remains that Iran does 
  not have a nuclear weapons program.

Israel has enough to worry about without Iran developing nuclear weapons. I sincerely doubt they would keep bringing it up if it obviously wasn't the case. They really don't need it for their case. So I would like to see the evidence for your assertion.

TrevorJ• 16 years ago

Source please.

bane• 16 years ago

But the unanimous consensus ("with high confidence") of all 16 US intelligence agencies remains that Iran does not have a nuclear weapons program _anymore thanks to stuxnet_

FTFY

kenjackson3• 16 years ago

Real Mossad Operatives Ship

Someone needs to do that t-shirt, with the Stuxnet code on the back. I'd get one... although I'd probably be too afraid to wear it :-)

simonsarris• 16 years ago

Afraid of whom?

I've never heard of someone afraid to be pro-Israel/Mossad, only the opposite.

rdtsc3• 16 years ago

Just pointing out that you would be wearing a t-shirt of an agency that doesn't mind assassinating and torturing people.

tptacek12• 16 years ago

That's a nice-sounding narrative, but no assessment of Stuxnet indicates that it foreclosed on Iran's nuclear capability, and if it actually is an intelligence service attack on a foreign industrial process, the fact that it's been analyzed in the New York Times seems to suggest that it wasn't very competently done.

A big part of Nate's point in this article is that the virus and DRM communities have known for over a decade how to take programs like this and make them hard to analyze. Nate is pointing out that nothing like that seems to have been done here.

Note that Nate was a key contributor to the as-yet-unbroken† Blu-Ray BD+ DRM scheme, which he worked on in his last couple years at Paul Kocher's infamous Cryptography Research. Here he is going out of his way to cite well known, public sources for methods that would have allowed an intelligence agency to carry out this attack without broadcasting to the world "AIR GAP ALL YOUR NUCLEAR FACILITIES IMMEDIATELY OR YOU WILL LOSE YOUR CENTRIFUGES". He's not even suggesting that the authors needed to be world-class content protection experts; only that they would have benefited greatly from a book you can get off the shelf at Barnes and Noble.

The C.W. on Hacker News might be that it makes sense for Iran's enemies to brag about destroying centrifuges without a costly military intervention. But real intelligence services don't brag, if only because they'd like to be able to repeat the same trick against Myanmar or Belarus or Syria or whoever the next proliferation threat is.

† BD+ is interesting because it was designed to be broken easily and then renewed easily; there are numerous individual disk breaks, but so far as I know no break against the whole BD+ scheme that would enable a bypass of any studio update. BD+ may be the first such renewable content protection scheme ever deployed.

sskates• 16 years ago

If that was his point then title of the article shouldn't have been "Stuxnet is embarrassing, not amazing" rather "Here's how Stuxnet could have been even better"

danilocampos2• 16 years ago

> real intelligence services don't brag

Not being heads of state, I don't think either of us is qualified to guess on the 8-dimensional chess being played here. Israel, if they are indeed behind this, is home to some of the brightest computer scientists on the planet. They already pulled off an impressive feat. It's pretty obvious that accomplishing the obfuscation described would not be outside their abilities.

So if they didn't bother, I have a hunch they had their reasons. They could be technical, and that would be the simplest explanation. They could just as well be political or otherwise strategic. I don't know, and neither does anyone else outside of the Israeli and US intelligence communities.

But whatever their reasoning, it's cheap, Monday morning quarterbacking to call an unprecedented and successful operation like Stuxnet embarrassing. Its exposure in the Times has nothing to do with technical competence and everything to do with the fast pace of information flow in the 21st century.

We all know about Operations Opera, Spring of Youth or Wrath of God, it's possible to read about them at length and I'm not sure anyone can dispute the competence on display there.

anateus• 16 years ago

I think that is quite inconclusive that Israel is the source.

If it is, it's likelier that Stuxnet is the creation of Unit 8200 rather than the Mossad.

Reference: http://en.wikipedia.org/wiki/Unit_8200

nikcub11• 16 years ago

Stuxnet worked. Very well. It was out in the wild, by best estimates, for over two years before it was detected. During that time it caused complete chaos within the Iranian nuclear program (to the point where some officials were executed on the suspicion of espionage).

This post and its backhanded compliments are very arrogant in a way that epitomizes everything that is wrong with the security industry. It is a game of one-upmanship amongst those who can talk the talk but not walk the walk. This blog post is basically:

Dear most successful team of virus and backdoor writers in history who completely changed the paradigm for what worms can do, I suggest you read this book that I probably know nothing about or haven't read and definitely do not understand. Ps. here are a ton of links to stuff I googled that you didn't do, pss. isn't it awesome that you are anonymous and can't respond to my criticism? psss. Did you get the part about me being smart?

Pathetic. To make it worse, the entire industry is full of such assholes.

m0nastic2• 16 years ago

I don't happen to share Nate's opinion that Stuxnet is embarrassing, but I think your characterization of him based on his blog post is pretty off-base.

nikcub11• 16 years ago

It wasn't a specific characterization of Nate, but rather a generalized, overly sarcastic and sweeping view of the security industry as a whole.

Many in security are just far too condescending, as this post was (not just wrong, but smug to boot).

For some reason there is a constant, tense competition between netsec bloggers and personalities for absolutely no reason. It is ridiculous.

MichaelSalib13• 16 years ago

Stuxnet worked. Very well. It was out in the wild, by best estimates, for over two years before it was detected.

How long it was out in the wild doesn't matter though: what matters is how long it infected the target machines.

During that time it caused complete chaos within the Iranian nuclear program (to the point where some officials were executed on the suspicion of espionage).

How do we know that the people being executed were innocent as opposed to people committing espionage? I mean, if Stuxnet caused Iranian counterintelligence to discover an Israeli operative, then I'm not sure that's a win: delaying the program by an unspecified amount of time at the cost of lots of dollars and the loss of some operatives doesn't seem like a win to me. But this is all very speculative, so who knows.

Is there a good source justifying the "complete chaos" claim? Or the executions?

nikcub11• 16 years ago

"I mean, if Stuxnet caused Iranian counterintelligence to discover an Israeli operative, then I'm not sure that's a win"

I should have clarified. The Iranians, according to reports, resorted to firing, jailing and executing their own scientists and engineers because they couldn't figure out why the operation was going so wrong.

Apparently they replaced all equipment, re-programmed the centrifuges etc. etc. until they thought they eliminated everything except for the actual people involved - at which point they became paranoid and the firing, jailing, executions started.

tptacek12• 16 years ago

Nate Lawson is not trying to one-up anyone in the security industry. He works on a level above most of the rest of us, spending most of his time on hardware and cryptosystem projects. To imply that he's part of the Black Hat vulnerability research bugfinding rate race is to betray a comprehensive lack of understanding of how our field is structured.

I'd challenge you to find any reputable party in that field to challenge this summary. There's a whole Twitterverse of security experts that will back me up on this. Nate's not an egotist, and that's not where this post is coming from.

The place Nate is coming from is one of skepticism. He's challenging the near-hagiographic conventional wisdom that Stuxnet's sophistication is a clear sign of its intelligence lab origins. If Stuxnet isn't particularly sophisticated, that doesn't mean it wasn't set into motion by nation-state actors, or that it was ineffective, but it does knock down one factor in most of the discussions about the importance of "cyber warfare". Maybe Iran's nuclear plants were simply absurdly exposed to IT-based attacks due to sheer incompetence.

nikcub11• 16 years ago

I'd challenge you

I don't understand, what are you challenging me to? That was the entire point of my rant.

geophile2• 16 years ago

He's challenging the near-hagiographic conventional wisdom that Stuxnet's sophistication is a clear sign of its intelligence lab origins.

I thought this conventional wisdom was based on the success of stuxnet, once delivered, at having the desired effect on the centrifuge. The article appears to be based on techniques used in delivery of the payload, not the payload itself.

NateLawson9• 16 years ago

I'm sorry you think it's arrogant. If I were to talk to the authors, I'm sure they'd say either: "yeah, it wasn't our cleanest work but we had a tight deadline" or "thanks for the tip, we never heard of secure triggers."

Any high-end agency would never say the latter, so either there were severe time pressures or this was Team B. The narrative that this is highly polished work of a high-end agency (4! I mean 3 0-days!) is not supported by evidence.

jessriedel• 16 years ago

Most of the comments here seem to be of the form "Well, maybe Stuxnet isn't that elegant, but it got the job done and that's what matters", but is it really that bad of software? All the technical people I've heard discuss the software in person gush over how advanced and clever it is. Can anyone point me toward a more technical discussion of Stuxnet which could confirm/dispute the OP's view?

NateLawson9• 16 years ago

Well, you can compare the Symantec analysis for Stuxnet to other malware (say, Conficker, the previous media darling).

http://www.symantec.com/content/en/us/enterprise/media/secur...

http://www.malwareinfo.org/files/W32.DownadupThreat.pdf

You'll notice that most of the gushing has devolved to focusing on the payload and not the infection mechanism. That's because the worm itself is surprisingly average.

rbanffy2• 16 years ago

I think it's safe to assume Iran will no longer control their nuclear facilities with Windows boxes...

kenjackson3• 16 years ago

Nor use OpenBSD ;-)

GHFigs• 16 years ago

It may be that the authors did not want to telegraph their true capabilities to other state actors with cyberwarfare units. Although Iran is one such nation, the outcome suggests they're too far behind to constitute a threat.

More sophisticated states are looking at this and either learning: 1) that Israeli/US offensive cyberwarfare capability is much weaker than they previously believed, or 2) nothing, because they already know better.

Tycho• 16 years ago

I don't see what the problem is... I thought everyone was in favour of launching with a minimal viable product these days.

But seriously, maybe the thing was cobbled together from a whole bunch of government workers/contractors who didn't really know what they were building. Sort of like that film, Cube. Hence the lack of finesse.

Or, maybe they wanted it to be analysed so other factions would be less wary of it. I mean, who knows.

shareme• 16 years ago

Consider this:

-Obfuscation is often used to obscure the operative. I submit the conclusion that Stuxnet was 'dumbed' down on purpose to obscure which country wrote it. Also by obfuscation of the virus one can also send a strong message of 'You do not know who attacked and you will never know'

Stuxnet is embarrassing, not amazing

Related Stories