Worm Was Perfect for Sabotaging Centrifuges

[Elmore Furth]

Source: NY Times

Experts dissecting the computer worm suspected of being aimed at Iran’s nuclear program have determined that it was precisely calibrated in a way that could send nuclear centrifuges wildly out of control.

Their conclusion, while not definitive, begins to clear some of the fog around the Stuxnet worm, a malicious program detected earlier this year on computers, primarily in Iran but also India, Indonesia and other countries.

The paternity of the worm is still in dispute, but in recent weeks officials from Israel have broken into wide smiles when asked whether Israel was behind the attack, or knew who was. American officials have suggested it originated abroad.

The new forensic work narrows the range of targets and deciphers the worm’s plan of attack. Computer analysts say Stuxnet does its damage by making quick changes in the rotational speed of motors, shifting them rapidly up and down.



Read more: http://www.nytimes.com/2010/11/19/world/middleeast/19stuxnet.html?_r=1&hp

[aquart]

1. Well, a strangled guffaw from me, too. And a smothered chortle.

Somewhere out there are some programmers I don't ever want annoyed with me. Geeks rule.

[TheWraith]

2. These aren't random programmers.

There's hallmarks in the code indicating that it's point of origin was Israel, most likely the Mossad.

[LanternWaste]

29. What are the...?

What are the precise and relevant hallmarks of the code which point implicitly to Israel?

[bemildred]

32. An excellent question.

Computer languages do not have dialects, and one presumes the 'worm' is an executable, since it (supposedly) resides on a thumb drive. It's true it could be a script, but still, how do Israeli scripts stand out? Are there special Israeli algorithms or special Israeli ways of doing things? I doubt that.

[Catherina]

3. Programmers? This was deliberate sabotage by a government entity.

My vote is joint US-Israel action to lead up to war as we've seen in the past.

[hack89]

7. Given the possible alternatives, this is a good thing

a non-violent solution to nuclear proliferation.

[CTPatriot]

8. Excuse me??

Did I just see someone on a progressive blog suggesting that the passive nuclear annihilation of a Iran, a country that poses a threat to noone, that has not attacked another country in centuries, who is NOT at this time capable of or trying to build nuclear weapons, and who has every right to peaceful uses of nuclear energy as a signer of the NNPT, would be acceptable? Did you really say that?

[hack89]

9. Having problems with comprehension?

a worm designed to sabotage centrifuges. Centrifuges used only to produce weapons grade plutonium. I think the idea of fewer nuclear armed countries is a progressive ideal. If it can achieved without a military attack, then it is a good thing. Non-violent solutions are progressive.

[Turborama]

14. What do you think would happen if the centrifuges exploded?

Here's a clue...

Those fluctuations, nuclear analysts said in response to the report, are a recipe for disaster among the thousands of centrifuges spinning in Iran to enrich uranium, which can fuel reactors or bombs. Rapid changes can cause them to blow apart. Reports issued by international inspectors reveal that Iran has experienced many problems keeping its centrifuges running, with hundreds removed from active service since summer 2009.

Here's another comprehension test for you...

You said they are, "centrifuges used only to produce weapons grade plutonium".

They are used to produce weapons grade uranium. However, the uranium is also used for something else. What is that?

[hack89]

15. Too bad - hide your nuclear program from UN inspectors

and you don't get the benefit of the doubt as to your intentions.

Your snip implies that some may have already exploded - didn't seem to cause a major catastrophe.

The world has offered many times to sell nuclear fuel to Iran for peaceful nuclear power - in every case they have refused the offer. Instead they hide their program from inspectors - why would they do that if it was not a weapons program? What are they hiding?

[Turborama]

17. That excerpt was from the NYT article in the OP.

Here it is again with the previous paragraph added to help you understand the context. It didn't imply "that some may have already exploded", it clearly said there were problems keeping some running.

Changing the speed “sabotages the normal operation of the industrial control process,” Eric Chien, a researcher at the computer security company Symantec, wrote in a blog post.

Those fluctuations, nuclear analysts said in response to the report, are a recipe for disaster among the thousands of centrifuges spinning in Iran to enrich uranium, which can fuel reactors or bombs. Rapid changes can cause them to blow apart. Reports issued by international inspectors reveal that Iran has experienced many problems keeping its centrifuges running, with hundreds removed from active service since summer 2009.

http://www.nytimes.com/2010/11/19/world/middleeast/19stuxnet.html?_r=1&hp

You essentially said "it is a good thing" if a worm purposefully triggers an explosion in a nuclear refinery. You do know what the consequences of such an explosion would be, don't you?

You also accused someone of lacking comprehension skills. You should re-read my replies above to see where your comprehension failed a few times.

[hack89]

22. I don't agree that centrifuge explosion

equals nuclear explosion. So they contaminate the room where the centrifuges are - why is that a bad thing? It would shut down their program in a heart beat.

[bananas]

24. k&r

Iran may have other secret enrichment facilities.
It's obvious they're trying to develop nuclear weapons capabilities.
They are in violation of the NPT and they are not negotiating in good faith.

[Turborama]

25. I don't know...

...exactly what would happen if the uranium enriching centrifuges exploded after being attacked by a worm. Do you?

However, if it just contaminated a room it's hardly going to stop Iran from enriching uranium forever. If it isn't just a contaminated room, and actually causes a nuclear explosion, the consequences would be unimaginable.

[bananas]

27. Too fucking bad for them - nuclear energy is dangerous

If they follow proper safety and qa procedures, an explosion is unlikely. If they haven't followed proper safety and qa procedures, they were headed for an accident anyway and shouldn't be operating the centrifuges in the first place.

[Turborama]

28. I'm not supporting what Iran are doing

I'm not supporting possibly triggering off a nuclear explosion with a computer virus, either.

[sally cat]

31. So little centrifuges aren't what make nuclear weapons explode? Who knew?

[Odin2005]

33. Nukes are the only fail-safe deterent to US imperialist agression.

I can't blame the Iranians for wanting nukes.

[boppers]

38. Hide your WMD program from UN inspectors...

and you don't get the benefit of the doubt as to your intentions.

Yeah, how'd that work out for Saddam, and the US starting an illegal war?

I can't believe people will fall for this shit twice in a row.

[DeadEyeDyck]

49. is that as bad as if they crossed

the streams of the flux-compacitors?

[boppers]

35. "Centrifuges used only to produce weapons grade plutonium"

Wow. Nuclear engineer, you're not.

[bemildred]

39. Hey, they have little stickers: "for weapons grade enrichment only".

:thumbsup:

[boppers]

42. Heck, I want to know how to make Plutonium in a centrifuge.

That's got to be some neat trick.... are they spinning a neutron source at the same time?

[bemildred]

50. LOL.

:thumbsup:

[bananas]

26. Fuck nuclear energy

Iran is in violation of it's NPT agreements and is trying to development nuclear weapons capabilities.
Proliferation is one of the main problems with nuclear energy.
Nuclear energy is dirty, dangerous, and expensive.
There is no need for it, it's not needed for solving global warming or peak oil.

[Odin2005]

34. leabe it to the anti-nuke people to turn this thread into an anti-nuclear energy rant.

:eyes:

[boppers]

43. Nah, this was a Blaster variant/spinoff. Nothing too sophisticated about it.

There was a bunch of breathless "government attack" reporting by non-tech reporters, until some of us geeks stepped in and pointed out that this is a generic multi-vector worm.

[TheeHazelnut]

4. a virus to cause nuclear accidents?

what if this affects computers outside of Iran, causing nuclear accidents elsewhere in the world? holy crap.

[4saken]

5. It's designed to infect converters from 2 specific companies.

[Posteritatis]

36. Botching enrichment isn't exactly Chernobyl

It isn't even a Three Mile Island. Messing with these types of centrifuges has the main goal of resulting in stuff that simply isn't useful in nuclear warheads.

[boppers]

45. Oh no, Uranium Hexafouride gas is released!

The horrors!

[sendero]

6. This is a harbinger of the future...

.. where lots of "war" is going to be conducted via computer. Frankly, if Iran's nuclear program could be stopped with malware, I'm all for it.

This little internet diversion through China in April is cause for huge concern, and people need to understand the gravity of this sort of thing.

[Nihil]

11. Maybe just a reminder ...

> This little internet diversion through China in April is cause for huge concern

... that the US & Israel aren't the only countries with power ...

[Pavulon]

23. No, but we are the best.

DARPA invented it, ever major innovation comes from the US. China copies, if it runs on a router, switch, DS, we wrote it and own it.

[boppers]

46. ...and everybody can use it.

In that sense, it's the reverse of an arms race. We invented guns, gave them to everybody and said "play nice, folks".

When people do not play nice, they get the metaphorical banhammer.

[boppers]

44. "This little internet diversion through China" is bullshit.

It was bad routing table advertisements.

That's it. End of story. Happens ALL THE TIME.

You know what happens when it's noticed? The routers get blackholed.

[NickB79]

10. Are the centrifuges even connected to an outside network?

The last time this was discussed, it was implied that the only way to insert this worm into the system was via an infected thumb drive, which would imply a covert operation to gain access to the facility.

If the centrifuges aren't connected to any network, this entire worm has been blown way out of proportion, IMO.

[hack89]

12. Don't you think the Iranian nuclear program

has been infiltrated by the US and Israel by now?

[AngryAmish]

13. Stuxnet was a very promiscuous program

They are finding it everywhere. So they did not need to sneak into the facility and plug in their thumbdrive. The facility has lots of outside contractors (german, russian) and they bring in the thumbdrives, most probably unbeknownst to them.

Also IIRC, the facility is run on windows - bootleg copies of windows. Since Microsoft is a US company and Iran is on our shitlist, the patches and the ilk get there slow. Security was terrible.

Iran has to develop their own OS (which they can't do) if they want to prevent this sort of thing.

[boppers]

47. It can jump the air-gap.

So, the worm uses a bunch of vectors, and one of the more clever ones was that it infects PLC's via SCADA systems.

Since that means nothing to most people, I'll put it this way:
1. A secretary gets an email with a cute bunny picture, and opens it, infecting her machine.
2. Since she's connected to the payroll server for her daily time clock punch-in/out, the payroll server gets infected.
3. Since engineers also use the time clock, they get infected.
4. If one of those engineers is working on designing chips for centrifuges, her machine can be infected, and thus, the chip she's programming can be infected.

Now, this is the interesting part:

5. Even if the machine (a centrifuge, for example) that the chip goes into is *NOT* connected to a network in any way, shape, or form, because the chip design was infected, it doesn't matter if there isn't a network connection.

[Joanne98]

16. Wasn't this kinda RISKY?

[Posteritatis]

37. In what way? (nt)

[bemildred]

18. I find this implausible.

And very irresponsible if true. You need a series of unlikely events to infect the target, you cause lots of harm globally, and even if you succeed you only get a temporary setback of indeterminate proportions.

If you assume for example, that the centrifuge system runs Windoze, that there is an insider who can infect the centrifuge system with a thumb drive, then you have to ask why is it on the web? As camoflage?

Bootleg Windoze is not the only free operating system, and some of the others are much better for real-time work, just saying.

[Ian David]

19. The give-away would be if the worm doesn't sabotage on Saturdays. n/t

[boppers]

40. ....

:rofl:

[hunter]

20. It's all shits and giggles until it crashes your own stuff.

Maybe it already has.

[Pavulon]

21. Old tradecraft with new twist

we fed the USSR bogus information and they spent money using it. Now we broke Iranian systems. C# is better than a GBU..

[boppers]

48. C# is shite.

Just registering my opinion in the code wars. :)

(I'm a C person. Not C++, or any of that drag-ass-slow-bloated-OO crap.... C.)

Of course, if you are saying that C# (or even C++) is more destructive than a Guided Bomb Unit, I concur. Millions of wasted hours and effort to do even the most simple things, because a huge level of abstraction has been layered on top of even the most simple tasks.

[bemildred]

51. Now, now, C++ can be useful once in a while.

Not often, but there are cases.

I like this one:

"In C++ it's harder to shoot yourself in the foot, but when you do, you blow off your whole leg." — Bjarne Stroustrup.

Although it is in fact very easy to shoot yourself in the foot with any programming language.

I have been amazed at how often devout C++ programmers clearly do not understand what the language really does. As you say "a huge level of abstraction" has been slathered on top. And the last thing one needs in software development is to make things more complicated and opaque.

C# is indeed useless shite.

[daleo]

30. il companies could use something like this against wind turbines

There are all kinds of commercial applications, once you normalize this type of thing. Today its an industrial attack on your (undeclared) enemy, tomorrow...

[unkachuck]

41. was Ahmadinejad right?

http://www.reuters.com/article/idUSTRE6AB1Q420101112

....not good for confidence building....