Obama Order Sped Up Wave of Cyberattacks Against Iran

http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html

by joejohnson • 14 years ago

287 129 14 years ago

pbrook• 14 years ago

Holy shit. Stuxnet was just confirmed as being developed by the US and Israel.

josteink• 14 years ago

This really makes you wonder at what point do you go from calling something "some digital nudging about between nations" to "war".

To me this seems to qualify as terrorism and sabotage on all accounts. I'm pretty sure I know how the US would react if they had been on the receiving end of this sort of attack.

nyellin3• 14 years ago

I don't know about the states, but we (Israel) have been on the receiving end of actual terrorism and sabotage through Iranian proxy groups. Stuxnet seems mild compared to funding suicide bombings.

xaver• 14 years ago

Relevant: https://www.nytimes.com/2011/06/01/us/politics/01cyber.html

ars9• 14 years ago

It becomes a war when you do it openly.

And this sort of thing is nothing new, see http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage for example, and there is lots more.

The way you react is with total silence - you don't want anyone to know you were vulnerable. And that's also why these types of activities tend not to escalate.

Personally, if countries have to fight I'd prefer they do it quietly like this rather than open war. It's a lot easier to ratchet down the tensions when there has been no rhetoric about the enemy.

For example: http://en.wikipedia.org/wiki/2007_Israeli_airstrike_in_Syria - mostly silence on both parties part and no increase in hostilities.

briandear• 14 years ago

The difference is that the US doesn't threaten to wipe countries off the map. Iran is an evil theocracy and can't be trusted with nuclear weapons. Drawing moral equivalencies between the US and a totalitarian terrorist state is ridiculous. It's like comparing North Korea with Belgium.

potatolicious• 14 years ago

Sabotage sure, but I have a hard time seeing this qualified as terrorism - terrorism is an a violent act against civilians designed to instill fear in the general population.

e.g., bombing trains, airports, buildings, poisoning food supplies, etc.

Actions against the military establishment of a country can hardly be qualified as terrorism.

That said, if the US had been on the pointy end of this stick I'm sure many politicians would not have hesitated to the use the T-word themselves...

hmottestad2• 14 years ago

Terrorism. What about this inflicts terror? I guess you might be a bit scared, but not really all that scared. It's not like someone developed a virus to slowly irradiate people having x-rays.

kmfrk• 14 years ago

I'm sure China have done plenty of - successful - attacks already. The States don't have an interest in disclosing these findings, nor do the Chinese, though.

3143• 14 years ago

Yes, this is an act of war. So what? Is Iran going to declare war on the US?

est• 14 years ago

This is sad. China has one more strong execuse to buff its national firewall.

ars9• 14 years ago

Why is it sad? I'd prefer a cyberwar over a physical one.

And in any case the Chinese national firewall is utterly useless for preventing this.

cmelbye• 14 years ago

What? Their "national firewall" is for censorship of certain websites, what does that have to do with this?

bcn• 14 years ago

"...is based on interviews...with current and former American, European and Israeli officials... None would allow their names to be used..."

Not exactly confirmed, but at least there are a few more details being (intentionally?) leaked. Good ole NYT is always ready to spill the words of unnamed 'officials', but the more interesting question is why, or why now?

steelaz• 14 years ago

Didn't Pentagon said last year that they would consider cyber attacks as acts of war?

rwallace• 14 years ago

Yes. That position has now pretty much lost credibility, which in my view is no bad thing. I've had the good fortune to never experience actual war, but I'm pretty sure nobody with such experience, is in the slightest doubt about the difference between that and sabotaging computers, however annoying the latter might be. If cyber-conflict is going to take place, I think it's in everyone's interest to keep it at that level and stop it spilling over into war.

chubot• 14 years ago

Is this a purposeful leak to take credit for a national security win before the election? Seems like they kept it under wraps pretty well until now.

There was a TED talk by Ralph langer in which he was asked if he thought the Mossad was behind Stuxnet, as that was the common belief. His response was that it must be the only cyber superpower -- the US.

nyellin3• 14 years ago

This is an excerpt from a soon-to-be-published book, so some of the quotes might be much older.

Jach• 14 years ago

Mr. Obama, according to officials in the room, asked a series of questions, fearful that the code could do damage outside the plant. The answers came back in hedged terms. Mr. Biden fumed. “It’s got to be the Israelis,” he said. “They went too far.”

In fact, both the Israelis and the Americans had been aiming for a particular part of the centrifuge plant, a critical area whose loss, they had concluded, would set the Iranians back considerably. It is unclear who introduced the programming error.

I guess it's naive to think they might be using git and could resolve this with a simple `git blame`...

jonknee2• 14 years ago

It's a little different when half the goal is to leave no trace of who wrote the software (and everything is obfuscated to hell).

Achshar3• 14 years ago

But the obfuscation much be done immediately before deployment. obfuscating while writing code does not make much sense.

brainless• 14 years ago

So now countries will fight cyber war, then what? cyber defense systems. So humans will never learn lessons, will they? How far is Skynet?

saraid216• 14 years ago

It's okay. We'll just add this line of code in: http://xkcd.com/534/

fluxon• 14 years ago

I'm a little disappointed by the lack of named sources and/or documents. Most assertions are anonymous paraphrases or quotes. That seems thin, and makes the book seem rushed and exploitative.

redthrowaway• 14 years ago

>The code itself is 50 times as big as the typical computer worm

All else aside, this is a clear pointer to government contractors.

kamaal• 14 years ago

How did they possibly know the code is 50 times that big. Is the code out in the open?

c162• 14 years ago

"Several layers of masking obscured the zero-day exploit inside, requiring work to reach it, and the malware was huge — 500k bytes, as opposed to the usual 10k to 15k." - http://www.wired.com/threatlevel/2011/07/how-digital-detecti...

This is a great read and very informative!

petegrif3• 14 years ago

Yes.

tptacek2• 14 years ago

The relationship between compiled code and source code is not as mysterious as you're making it out to be. This is not a hard analysis to conduct.

Incidentally, from friends who do serious malware reversing work (we do not do any malware work): the "50x bigger, feels like pro contractors" assessment rings true for several other reasons; for instance, the style of programming used in the worm itself.

Achshar3• 14 years ago

I think they are confusing the terms here. What they mean is that the worm itself is 20 mb in size where as average is about 1 mb. So The worm's code is 20x. They probably don't know that worm's size and it's source code are two different things. They are NYT not a tech blog, so i guess this is excusable.

chii7• 14 years ago

but i think they got their point across well enough; technical trvialities don't matter at all in this case.

derrida3• 14 years ago

HB Gary was passed the source in 2010: http://crowdleaks.org/hbgary-wanted-to-suppress-stuxnet-rese... Anonymous scooped the NYTimes.

derrida3• 14 years ago

To defend myself against the downvoters who may not have made the same connections: Aaron Barr talks to Defence Intelligence Agency and DoD about StuxNet in 2010, they had a copy given to them in 2009 that they claim was a US produced binary. Keep in mind stuxnet was 'discovered' in 2010.

First reference to Stuxnet being U.S. government produced?

They had a binary they believed was US produced. It was Stuxnet. It was 2009.

majmun2• 14 years ago

Are there any clues , how many people worked on stuxnet and flame.coding style methodology, how this project was managed etc. ? (Im still not convinced that this is from goverment)

petegrif3• 14 years ago

Semantec has done several detailed analyses of Stuxnet. They are in no doubt this was an extremely well resourced project that was state financed.

majmun2• 14 years ago

Yeah I read that, but nobody seems to mention what coding and project management practices were used in development of this software.

If this software is really done by military then it's development process was following some strict military standards and regulation. and should be similar to existing other software.

Regulations like : How is software partitioned to modules? What interfaces it is using? Are this novel or existing techniques? and things like that.

jgrahamc• 14 years ago

This shouldn't be a surprise to anyone. The set of { countries that are capable of creating something like Stuxnet and getting it into the plant } intersection with the set of { countries fearful of Iran } comes down to { US, Israel }.

You might add UK in there and UK might have assisted the US in the creation of Stuxnet if the US had asked.

excuse-me2• 14 years ago

Although a Billion quid government IT project which was then abandoned 5years later without ever delivering anything would probably be noticed.

gcb• 14 years ago

Or not. That's why they have national security and classified information. So they don't have to tell you were your tax is going.

yaix• 14 years ago

“It turns out there is always an idiot around who doesn’t think much about the thumb drive in their hand.”

Good quote. And there seems to always be a Windows PC around that auto-runs anything you stick into it.

adimitrov2• 14 years ago

The actual exploit stuxnet used to get onto Windows PCs didn't require the computer to have autorun turned on. The exploit runs on all newer versions of Windows (XP-7) and it triggers by browsing the device's contents with Explorer. (Specifically, it exploits a method Explorer uses to show icons on .lnk (Windows' sym-links) files.)

http://www.geek.com/articles/news/new-stuxnet-usb-exploit-th...

morsch• 14 years ago

You're corroborating the grand-parent's point that Windows PCs autorun everything you stick into them. Granted, in this case it's not by design, but still...

excuse-me2• 14 years ago

Good job there are no Windows machines used for any critical infrastructure in our country then.

fdr• 14 years ago

The most interesting information in here to me by far:

    > In an interesting twist, it was discovered that the Stuxnet
    > malware group makes use of device drivers which were digitally
    > signed to make them appear as though they originated from
    > hardware vendor Realtek Semiconductor Corp. The digital
    > certificate has since been revoked but it is worrying that
    > malware writers seemingly had access to a private key issued to
    > a trusted supplier of device drivers.

dminor• 14 years ago

Yeah, but you have to consider they'd also say this even if a double-agent was used.

drzaiusapelord• 14 years ago

Nope, the stuxnet crew had a couple of zero days in their pocket. No need to do anything but stick it in. Limited user account? Doesn't matter, it performed a privledge escalation.

All IT is just gum and bailing wire. I don't even think its possible to truly secure a non-trivial OS. I'm just surprised at how infrequent stuff like this gets found out.

lunchbox• 14 years ago

I'm very curious who gets hired to write the code for a project like this. What caliber are they, what kinds of backgrounds do they come from, and how are they recruited to these positions? Is this more likely to be done by a government agency or a defense contractor?

I have always assumed that the world's most talented hackers work in places like Silicon Valley and Wall Street, but Stuxnet was clearly the work of some brilliant minds, so I'm curious.

ars9• 14 years ago

If it's Israel then they come from the military which is the first place students go after school - so they do in fact have access to the world's most talented hackers. A lot of them go on to create startups after finishing service.

See: http://news.ycombinator.com/item?id=977176 for a bit more.

maukdaddy• 14 years ago

Both agencies and contractors employee people with the skillsets needed to write these kinds of things. While there are a large number of incompetent government employees and contractors, there are also a small number of frighteningly talented developers working in this area.

ImprovedSilence• 14 years ago

It's the same with any big company, and it kind of boils down to the adage: "20% of the people do 80% of the work".

brigade• 14 years ago

I think there are defense contractors that develop and weaponize exploits, rootkits, and so on for the government and while I'm sure some of that work was used in Stuxnet, I think anything specific to Stuxnet was handled by actual governmental agencies. The article names the NSA and an Israeli unit.

As for recruiting, you wouldn't ever get recruited directly to such a project - you'd already need a TS/SCI clearance and to have proven yourself within the NSA. As for recruiting into the general field of classified cybersecurity, it's not too much different from any other field; they post job ads, scour college campuses, probably advertise at defcon, etc. Generally if you're getting hired without a clearance it's not for a specific position - it takes upwards of half a year before you get cleared and can start, at which point they figure out which project to put you in.

As for the most talented hackers, keep in mind the subject area: Wall Street has very little demand for security researchers, and Silicon Valley's demand for them is minuscule compared to the government's.

juuso• 14 years ago

For example this one seems fairly direct to me: http://www.clearancejobs.com/jobs/1536410/cyber-software-eng...

seanp2k2• 14 years ago

VUPEN provides 0-days to governments http://www.vupen.com/english/

krschultz3• 14 years ago

Just a guess, but the public options are basically the NSA and their contractors (ex. Booz Allen Hamilton). There are excellent hackers in those places.

sukuriant• 14 years ago

You'd be surprised how many brilliant hackers are working in department stores for very low wages, just doing tech support or some other job.

kitsune_• 14 years ago

Israel owns companies such as IAI which in turn operate subsidiaries such as IAI ELTA (http://www.iai.co.il/17887-en/Groups_ELTA.aspx)

They also operate a nuclear program.

They have world class technical universities.

The military is a huge employer for engineers and researchers in Israel.

If they can create and market high-tech SIGINT / ELINT / EW / COMINT systems, a nation like Israel should be able to create programs such as STUXNET. They have the know how and expertise.

In response to your question. In Israel, a small country, you have mandatory military service, a close relationship between the private sector, government and military, I think the path for an engineer is very clear cut if he or she wants to enter this domain of work. Vice versa, the government will have no problem finding you.

yukoncornelius• 14 years ago

The work is farmed out to the National Labs and federally funded RDCs from a coordinating office:

"Olympic Games borrowed some for what they termed "destructive testing," essentially building a virtual replica of Natanz, but spreading the test over several of the Energy Department's national laboratories to keep even the most trusted nuclear workers from figuring out what was afoot."

The engineers working on the P-1s are employed by Sandia, ORNL, LANL, Mitre, RAND, SRI, etc and are in the dark about project specifics due to compartmentalization. Want a job:

http://www.sandia.gov/careers/students_postdocs/internships/...

c162• 14 years ago

What amazes me, and please excuse my naïvety, is that the congressmen are constantly pushing for more control online- whether that be monitoring skype, access to our facebook, or what have you. Basically taking our freedom in the name of 'Cyber Security', however on the other hand, they're the ones who are creating these viruses, exploiting systems and posing cyber threats.

What has the world come to?

sethbannon• 14 years ago

How ironic that one of the first major forays into cyber warfare be codenamed "Olympic Games".

strags• 14 years ago

Meanwhile, the US continues to attempt to extradite Garry McKinnon from the UK - without a trace of irony.

tptacek2• 14 years ago

This is like saying that because the US mistakenly invaded Iraq, it no longer has the moral authority to prosecute drive-by shootings. The syllogism holds on a message board but is useless in reality.

hughw• 14 years ago

It appears they "acquired" Realtek's code signing certificate. Can Realtek bring action against the U.S. for stealing the certificate?

Edit: For stealing the private key, I mean.

jcampbell13• 14 years ago

This is clearly an approved leak from the administration. The number of sources and specifics make it very easy to catch whoever leaked this information. If this wasn't approved, the leaker is going to be sitting next to bradly manning within a week, and there is no moral cause to leak this information, so it is safe to assume this was an approved leak.

The real question, is why did the administration leak the story, and why now? Is it politically motivated because Obama wants to seem tough on Iran in an election year? Is it to trick the Iranians into thinking the program is over? Maybe versions 2, 3, and 4 are already in place, and it will be demoralizing to Iran's program if they keep getting setback.

salimmadjd• 14 years ago

I agree...or Sanger has another agenda by leaking this. But either way, this is more purposeful than just trying to break a story.

conradev• 14 years ago

Flame hit the mainstream news not too long ago, that may have something to do with it.

jcampbell13• 14 years ago

Great point, that makes sense to me. Derivative malware is being created, and the administration went public to send a wakeup call to domestic industries to be vigilant. Rather than telling sensitive companies and organizations like Los Alamos, and waiting for a leak, the administration leaked the info to the NYT to control the message. Now that the story is out, the CIA/NSA can work with sensitive industries to contain the fallout of derivative malware like Flame.

The timing makes sense.

grandalf• 14 years ago

Good points. I think the tough on Iran story is probably part of it. Also I think it could be a way to test the public/media reaction to news of US cyber terrorism against other nations.

jsz0• 14 years ago

The real question, is why did the administration leak the story, and why now?

The latest round of multi-lateral talks on Iran's nuclear program just concluded a few days ago in Baghdad. I think they're trying to send the message to Iran that they will never be able to have a clandestine nuclear weapons program. The world is going to know about it. So if a nuclear power option is on the table for Iran this might give them a little extra motivation to accept all international regulations/inspections as a precondition. What are they actually going to be able to hide? Not much apparently.

The other goal here is to make Iran's position that they only want nuclear power, not nuclear weapons, even more difficult to accept. They are enduring sanctions and refusing to accept all of the regulations/inspections for what purpose exactly? They could have had nuclear power years ago if they were willing to accept these conditions. The longer they hide behind 'nuclear power only' the harder it is to believe. At some crucial point I have no doubt we'll be leaking detailed information about their weapons program. When that happens Iran will have to probably admit they do want nuclear weapons and from there the war question pretty much resolves itself.

jcampbell13• 14 years ago

Great point. After reading the article, I completely forgot that Iran was still claiming that they didn't have a weapons program. This now proves that claim is complete nonsense and now that this is public, the US can show the UN security council and infinite amount of data that shows Iran has a weapons program.

nitrogen• 14 years ago

...there is no moral cause to leak this information...

From the article: "Last year, the nation announced that it had begun its own military cyberunit..."

One could argue that a nation's citizens have a moral right to know that their government is exposing them to potential retaliation by sabotaging the facilities of another sovereign nation via cyberattack.

Also from the article: "But there has been scant evidence that it has begun to strike back."

Wasn't the DigiNotar hack used by Iran to obtain fake certificates for Google domains?

goggles99• 14 years ago

Obama will do anything to avoid a conflict right now. If gasoline prices go up any more, his opposition will be running ads replaying the video of him saying he believes that gasoline should be in the $5-$7 range so alternative energy will become more adopted. (everyone knows this so it makes him very weak internationally)

So this should surprise no one. He used technology to get elected, and he will use technology to try and stop Iran without a physical military conflict.

Obama Order Sped Up Wave of Cyberattacks Against Iran

Related Stories