Stuxnet's Secret Twin

http://www.foreignpolicy.com/articles/2013/11/19/stuxnets_secret_twin_iran_nukes_cyber_attack

by hangonhn • 13 years ago

137 56 13 years ago

foreignpolicy.com

swashboon• 13 years ago

Website requires registration/login to view content. No thanks.

computer• 13 years ago

No such issue here. Try disabling javascript.

fla• 13 years ago

Or open your web inspector and delete the node.

hangonhn• 13 years ago

Try this link if you get hit with registration:

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...

thesimpsons1022• 13 years ago

that one requires registration as well.

sp3322• 13 years ago

Full text http://pastebin.com/z7XxVHVx

orenbarzilai• 13 years ago

display:none; works like a charm

Double_Cast• 13 years ago

1. right-click paywall

2. "inspect element"

3. right-click highlighted html

4. "delete node"

5. ???

6. profit

dsl• 13 years ago

Right Click on the background, AdBlock..., Block This Ad

xfax• 13 years ago

Here you go: http://www.readability.com/read?url=http%3A//www.foreignpoli...

D9u• 13 years ago

That link also presents a registration form. Thanks anyway.

TrainedMonkey• 13 years ago

Click readability view on top and it will go away.

nitrogen• 13 years ago

You can just right click the overlay, click Inspect Element, then delete the div that contains the overlay.

cwal37• 13 years ago

This is incredibly interesting and extremely important. It has clear implications for infrastructure and security, particularly energy infrastructure which I am most interested in.

This is the future of war.

at-fates-hands• 13 years ago

My Dad used to write software for large technology companies. When he was with Control Data, they had just finished a huge project where they automated a ton of processed for the local energy company to make it more efficient.

When I was in college and the internet got big I and I was touting all this cool stuff you could do, he told me about this project they did way back in the 70's. He said it terrified him at the time because it took the human element out of the equation. If something went wrong, it could do some serious damage. A misplaced decimal point here and it could basically bring down an entire region of the power grid.

He always said the software was great, but it made the people using it lazy - which is where the real danger is.

ChuckMcM• 13 years ago

The original report, of which the Foreign Policy Article is a summary, is here: http://www.langner.com/en/wp-content/uploads/2013/11/To-kill...

bdamm• 13 years ago

Here's the Foreign Policy Article, linked so there's no registration banner: http://www.foreignpolicy.com/articles/2013/11/19/stuxnets_se...

vhost-• 13 years ago

Thanks! I was using firebug to kill the overlay.

davidgerard3• 13 years ago

Serious question:

Why THE FUCK are industrial controllers connected to the Internet still running Windows?

What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

tcoppi• 13 years ago

If you'd bother to read the article, you'd know that the infection vector was not direct Internet access to the affected systems.

davidgerard3• 13 years ago

The point stands.

fragsworth• 13 years ago

They were able to connect to the centrifuges through the internal facility by infected machines.

I remember reading that one of the methods Stuxnet used to transmit data through the facility between two infected machines that were not networked: sound cards and microphones.

dlctr• 13 years ago

That's because a lot of industrial "control" is still done via classic OPC [1] for communication. That's Microsoft DCOM. I kid you not!!

And afaik they didn't have internet access directly for the control boxes at Natanz. Stuxnet got into the plant via USB sticks.

[1] http://en.wikipedia.org/wiki/OLE_for_process_control

ufmace2• 13 years ago

Oh god, DCOM memories. I've spent days in a futile attempt to get that working. The best demo of how bad DCOM is would be the existence of OPC Tunneler:

http://www.matrikonopc.com/products/opc-data-management/opc-...

DCOM is such a headache that these guys sell a $1000 program whose sole purpose is to make it easy to make remote DCOM connections. And I've recommended it as a screaming deal at that price. Given what it costs to get myself or a proper tech to a remote site for a day, I'd much rather use that and spend my time solving the actual problem than spend a day trying to get DCOM working before working on the actual problem.

andylei• 13 years ago

someone should have told the iranians that linux computers have no security vulnerabilities

davidgerard3• 13 years ago

They are seriously less insecure by design than Windows.

http://philosecurity.org/2009/01/12/interview-with-an-adware...

Don't tell me you aren't familiar with this.

ufmace2• 13 years ago

I have a little experience in industrial control systems. Near as I can tell, both support and demand in the industry for controlling these devices with anything but Windows XP is basically nonexistent. Support for Windows 7 seems half-hearted at best, even now, when XP is nearly EOL. The package I have used the most, GE iFix, is so tightly tied in with Microsoft technologies, including OPC, DCOM, VBA, and ActiveX, that it's tough to imagine a port to anything else happening anytime soon. If you're interested in the industry, look up info on this, and stuff like Wonderware.

Most of the people working on these devices are far from being computer experts. I went to an advanced class for them, where the instructor took pains to advise the class that it was an advanced class and you would probably be lost if you hadn't taken the beginner class. I hadn't, and I breezed right through all of their material. Not that I'm that much smarter than anyone there, just from having experience using and figuring out a lot of different types of computer systems. This type of software is made for people who are experts in stuff like chemical plant operations, but who think Excel would be a great way to program their control systems. I'd bet that not one of them have even heard of the Nataz attack.

Given the total lack of interest or experience in computer security that seems to be prevalent in the industry, I expect it will get a lot worse before it gets better.

TheCapn• 13 years ago

If a government entity was willing to pay for 0-day exploits to target a specific system and infrastructure I don't think it really mattered what OS was behind the controllers since they'd be building the super-virus to the needs of the assignment.

Zigurd3• 13 years ago

I don't think that conclusion, or the more general one, that endpoint security can't be a significant barrier, can be drawn yet. The level of good security practices in this case is very low. Once the air gap was breached they were done.

dsuth2• 13 years ago

It's a great question, and as someone heavily involved in industrial control systems, I ask myself and others that a lot.

The only real reason I've heard comes down to cost and support. It's easy to develop software for Windows, easy to find developers, easy to support the operating system, easy (debatable) to use in an industrial environment. It's a known factor.

Always remember that people on the shop floor (or hydrocarbons refinery equally) aren't interested in maintaining a PC they don't understand, and their management aren't interested in maintaining a well-educated IT department. It's a simple cost/benefit equation, and so far the benefits have been completely ignored.

Likewise, vendors of control systems don't want to put the time and effort in to develop their IDE's, display tools etc for a Unix variant. System integrators (ICS programmers and configurators)... well, we'd be cool with a Linux-based control system, if it worked well.

That's why you see Windows in industrial control environments. Couple this with the extremely conservative nature of industry, and you have a huge, glaring problem. We (ICS engineers) know it's a problem, clients are starting to realise it's a problem, but the wheels move slowly.

At least Stuxnet has made the wider industrial community aware of just how deep the shit is. Now begins the slow process of crawling back out of it.

gcb12• 13 years ago

what proves that running windows is the least concern. they would have added some suid crap listening out for reason had this been linux or anything else. this is just negligence. it is the same as bridge falling it two trucks drive there at the same time. everyone would be fine blaming the architect, engineer, construction company, politician that paid for etc... that happens in software, it is nobody business.

atmosx• 13 years ago

Sorry but in this scenario maintaining a 5-person skilled IT department was/is imperative. The TCO should of the IT department, even if you hire D. Hartmeier[1] to configure the firewalls, should be negligible compared to the operation's TCO.

That said, in this case I believe that the software to manage the centrifuges is made by Siemens (Germany) and it's written on Windows. So partially it wasn't the consumer's choice to use windows. Even if they used linux, is not hard to think that the NSA could have written a Linux clone worm. The only thing that can keep away such threats is "security" as Schneir mentions here[2] "security is a process" and that process can secure any operating system out there imho.

[1] http://www.benzedrine.cx/index.html

[2] https://www.schneier.com/crypto-gram-0005.html

rsync• 13 years ago

"Why THE FUCK are industrial controllers connected to the Internet still running Windows?"

A followup question I have is this:

When all is said and done how much will autorun.inf cost humanity ? Seriously. Is it in the hundreds of billions ?

We're almost 20 years into the lifespan of that file and it's still making front page mainstream news.

ldubinets• 13 years ago

Q: Disabling AutoRun in Windows will stop USB worms, right?

A: Wrong. There are several other spreading mechanisms USB worms use. The LNK vulnerability used by Stuxnet would infect you even if AutoRun and AutoPlay were disabled.

http://www.f-secure.com/weblog/archives/00002040.html

walshemj• 13 years ago

They where not the controllers where SCADA - which appears to have less security than windows 3.1

Why SCADA doesn't have the equivalent of a write protect switch so that you can physically disable updates is the more interesting Q.

cnvogel3• 13 years ago

They did have write protection in the past... if I remember correctly, some of these memory cards really had an old-school Eprom you had to erase by UV light and externally erase using a high-voltage parallel programmer:

http://www.classicautomation.com/Siemens_EPROMs.aspx

JabavuAdams2• 13 years ago

Why THE FUCK are industrial controllers connected to the Internet?

Fixed that for you.

dsuth2• 13 years ago

Not really, since the control system wasn't connected to the internet. They did, however, rely on "air gap" security, as you appear to be proposing.

Defense in depth is the only valid model of protection, but this requires intentional inclusion of cyber security concerns in the design stage of your plant, and on-going maintenance and auditing by a skilled IT team, and training of all your employees against social engineering, and...

This is a lot harder to do than just unplugging the Internets and giving a thumbs up.

cleaver• 13 years ago

It was a while ago, but I worked for a place that was writing software for boxes that could be used to collect telephone toll data from old bar switches in an Eastern European country. The sales manager thought it would sell better if it was on Windows 95. I suggested to him that they could at least use NT so you could lock down access better. His response was: "Oh, I told them that now their staff can use Windows 95 whenever they want." #facepalm

Another bright idea was that rather than just collect the information and forward it to a central hub (the ultimate destination), the data would be transferred according to the organizational structure... first area level, then regional, etc.

The culture at this shop was like this... sales spec'd the software and there was no push-back allowed from the technical staff. Fortunately, I didn't work on that project.

_sh• 13 years ago

The industrial controllers were not connected to the internet. Part of Stuxnet's sophistication was crossing the air gap via USB sticks that were infected through two never-seen-before 0-day attacks, the infamous shortcut icon attack vector, and autorun trojans.

Why were the control systems running Windows? Because it has a GUI. This helps when monitoring control systems, and of course is the only platform Siemens' monitoring systems run on.

angrydev• 13 years ago

Readability link: http://www.readability.com/articles/6ycbi4jx

I highly recommend downloading this extension for websites with crappy overlays like this one!

jafaku• 13 years ago

I just removed the overlay with firebug :p

But that's a great service, I didn't know I could use it without registering. I will use the bookmarklet from now on, thanks!

0xdeadbeefbabe• 13 years ago

Q: How could governments get something so complex right?

A: Trick question. Nice. Next question.

-http://www.f-secure.com/weblog/archives/00002040.html

Stuxnet's Secret Twin

Related Stories