Stuxnet - A cyber terminator

[Ramsayfarian]

The article called a cyber guided missile, but it since it sounds more like Terminator in search of it's Sarah Conner.

http://news.yahoo.com/s/csm/20100921/ts_csm/327178

[HeartsOfFire]

I think 'render inoperable' would've been a better choice of words as opposed to 'destroy.' Although 'sabotage' works just as well.

An interesting tool, though how exactly is this any different from a batch file coded to so something like 'format C:' when activated? Aside from the auto-execute after being plugged in?

[onetwo_threefour]

Sounds like a plot for Rubicon.

[Pinner]

http://www.foxnews.com/scitech/2010/...ear-ambitions/

[Azure]

Israeli involvement?

Either way, pretty damn cool.

[sclitheroe]

Originally Posted by HeartsOfFire

An interesting tool, though how exactly is this any different from a batch file coded to so something like 'format C:' when activated? Aside from the auto-execute after being plugged in?

Because wiping out the systems completely would have forced them to rebuild, at which point the worm would have lost hosts to reside on.

My understanding about what it did to the centrifuges was that rather than drastically alter their operation, as the FoxNews story posted above suggests, it subtly altered their speed over weeks, months, and maybe years, causing them not to fail, but to produce uranium that wasn't properly enriched into anything usable.

In essence, it slowly poisoned the well, rather than destroying the pumps, if that analogy makes any sense. This cost them time, and more importantly, raw materials.

[FlameOn]

Originally Posted by sclitheroe

Because wiping out the systems completely would have forced them to rebuild, at which point the worm would have lost hosts to reside on.

My understanding about what it did to the centrifuges was that rather than drastically alter their operation, as the FoxNews story posted above suggests, it subtly altered their speed over weeks, months, and maybe years, causing them not to fail, but to produce uranium that wasn't properly enriched into anything usable.

In essence, it slowly poisoned the well, rather than destroying the pumps, if that analogy makes any sense. This cost them time, and more importantly, raw materials.

Given how long the Iranians have been delayed getting their centrifuges in working order I think stuxnet found its mark. Though its hard to say if it was just technical issues on their part.

Article link is now dead btw.

[FlameOn]

Iran admits sabotage
http://www.bbc.co.uk/news/world-middle-east-11868596

[Azure]

This is unbelievable.

EXCLUSIVE: Iran's nuclear program is still in chaos despite its leaders' adamant claim that they have contained the computer worm that attacked their facilities, cybersecurity experts in the United States and Europe say.

“The Iranians don’t have the depth of knowledge to handle the worm or understand its complexity,” he said, raising the possibility that they may never succeed in eliminating it.
“Here is their problem. They should throw out every personal computer involved with the nuclear program and start over, but they can’t do that. Moreover, they are completely dependent on outside companies for the construction and maintenance of their nuclear facilities. They should throw out their computers as well. But they can’t,“ he explained. “They will just continually re-infect themselves.”


“With the best of expertise and equipment it would take another year for the plants to function normally again because it is so hard to get the worm out. It even hides in the back-up systems. But they can’t do it,” he said.

Read more: http://www.foxnews.com/scitech/2010/...#ixzz17qc3efJN

[sclitheroe]

If I wanted to continue to develop nukes in peace, I'd continue to pretend I was being ravaged by Stuxnet too. I highly doubt they are so incompetent as to not be able to contain, or find the help to contain, a virus. It's not rocket science, lol. Not yet anyways.

[Blaster86]

Originally Posted by sclitheroe

Not yet anyways.

That's the thing. If this virus is as advanced as the articles imply, then we are at that point now.

[sclitheroe]

Originally Posted by Blaster86

That's the thing. If this virus is as advanced as the articles imply, then we are at that point now.

It's been detected and reverse engineered. We know what exploits it uses, we know what systems it targets, and we know what it does. No magic or rocket science involved. I don't care how crafty you make it, I can still step through it in a debugger, or disassemble it and start looking at the individual instructions being issued to the processor.

It's still a very unique specimen amongst malware variants, I won't debate that though. If anything, it underscores how primitive the average malware an IT guy face is, and how long a sophisticated variant can go undetected if you leave vulnerabilities in place.