South Capitol Street

Have governments got cyberwarfare all wrong? A new study argues that the United States and United Kingdom have never figured out a proper definition of cyberwar and that a “true cyber war” will never happen.

But it’s not all good news: In order to prevent a combination of cyberwarfare, conventional war and other disasters from causing future, the scholars behind the project argue that an internet equivalent of the Nuclear Non-Proliferation Treaty is needed to protect against worms, distributed denial of service (DDoS) attacks and hackers.

The study was written for the Organisation for Economic Cooperation and Development by Peter Sommer of the London School of Economics and Ian Brown of Oxford University. In it, Brown and Sommer claim that governments — including the United States — have been too quick to label a wide assortment of criminal behaviors, espionage activities and economic skirmishes as “cyberwarfare.” But while genuine cyberwarfare does exist, the study finds that there is relatively little risk of Stuxnet-like worms being used due to the difficulty involved in crafting them.

But there is bad news. Sommer and Brown argue that embedded malware and DDoS attacks are likely to be used in future cyberwarfare by both governmental and non-governmental actors.

And this cyberwarfare threat also extends to third parties. According to Jillian York of Harvard University’s Berkman Center for Internet & Society, which just published a report on DDoS attacks against human rights groups, “DDoS attacks — as well as other types of attacks and intrusions — on human rights sites and independent media are becoming increasingly common. As a result, such sites — which frequently lack skilled personnel and/or funding — are often effectively silenced as a result of these attacks, because they become a liability to their hosting providers.”

A recent New York Times article on Stuxnet — a worm that infected Iranian nuclear facilities and damaged centrifuges — alleged that the infamous worm was a joint American-Israeli cyberwarfare project. A simultaneous investigation by Wired indicates that the worm had its origins in al Qaeda attempts to explore security flaws in U.S. infrastructure and the American response — which was both to identify the security holes and try to hack a system themselves.

However, there are those who doubt that America was behind Stuxnet or that cyberwarfare isn’t that big a concern for the country. Jeffrey Carr, a security consultant and the author of Inside Cyber Warfare (and a noted skeptic of the Israeli-American Stuxnet theory), told TPM that the OECD study was “very light and didn’t do justice to their ambition.” Carr also criticized what he saw as a lack of attention to threats to power grids and the potential applications of complexity and chaos theory to cyberwar analysis.

OECD’s report is part of a series called “Future Global Shocks” that examines threats such as a collapse of the global financial system, large-scale pandemics and worldwide weather change.

TPMMuckraker

Sweet.

Greenlit by Dubya, accelerated by Obama. Or at least, that’s what the cyborg time travelers who brought the worm back from the future would have you believe. The evidence is only circumstantial, but … there’s an awful lot of it. Behind Dimona’s barbed wire, the experts say, Israel has spun nuclear centrifuges virtually identical to […]

Read this post »

Hot Air » Top Picks

There have been many theories advanced over the past several months about the origins of the Stuxnet worm, which has apparently played havoc with Iran’s nuclear weapons research program. Now, The New York Times is out with an investigative report that seems to indicate a U.S-Israeli fingerprint on the project:

The Dimona complex in the Negev desert is famous as the heavily guarded heart of Israel’s never-acknowledged nuclear arms program, where neat rows of factories make atomic fuel for the arsenal.

Over the past two years, according to intelligence and military experts familiar with its operations, Dimona has taken on a new, equally secret role — as a critical testing ground in a joint American and Israeli effort to undermine Iran’s efforts to make a bomb of its own.

Behind Dimona’s barbed wire, the experts say, Israel has spun nuclear centrifuges virtually identical to Iran’s at Natanz, where Iranian scientists are struggling to enrich uranium. They say Dimona tested the effectiveness of the Stuxnet computer worm, a destructive program that appears to have wiped out roughly a fifth of Iran’s nuclear centrifuges and helped delay, though not destroy, Tehran’s ability to make its first nuclear arms.

“To check out the worm, you have to know the machines,” said an American expert on nuclear intelligence. “The reason the worm has been effective is that the Israelis tried it out.”

Though American and Israeli officials refuse to talk publicly about what goes on at Dimona, the operations there, as well as related efforts in the United States, are among the newest and strongest clues suggesting that the virus was designed as an American-Israeli project to sabotage the Iranian program.

There are other clues, including the fact that the German-made controllers that help operate the Iranian centrifuges were examined for security vulnerabilities by a classified Energy Department laboratory in Idaho several years ago, and that the information regarding the vulnerabilities in the controllers was then used to create the effects that Stuxnet has had. The virus itself, is actually fairly amazing from a computer engineering standpoint, which argues strongly that it had to have come from a nation capable of creating such a program:

The worm itself now appears to have included two major components. One was designed to send Iran’s nuclear centrifuges spinning wildly out of control. Another seems right out of the movies: The computer program also secretly recorded what normal operations at the nuclear plant looked like, then played those readings back to plant operators, like a pre-recorded security tape in a bank heist, so that it would appear that everything was operating normally while the centrifuges were actually tearing themselves apart.

The attacks were not fully successful: Some parts of Iran’s operations ground to a halt, while others survived, according to the reports of international nuclear inspectors. Nor is it clear the attacks are over: Some experts who have examined the code believe it contains the seeds for yet more versions and assaults.

And the political angle is just as interesting:

The project’s political origins can be found in the last months of the Bush administration. In January 2009, The New York Times reported that Mr. Bush authorized a covert program to undermine the electrical and computer systems around Natanz, Iran’s major enrichment center. President Obama, first briefed on the program even before taking office, sped it up, according to officials familiar with the administration’s Iran strategy. So did the Israelis, other officials said. Israel has long been seeking a way to cripple Iran’s capability without triggering the opprobrium, or the war, that might follow an overt military strike of the kind they conducted against nuclear facilities in Iraq in 1981 and Syria in 2007.

Two years ago, when Israel still thought its only solution was a military one and approached Mr. Bush for the bunker-busting bombs and other equipment it believed it would need for an air attack, its officials told the White House that such a strike would set back Iran’s programs by roughly three years. Its request was turned down.

Now, Mr. Dagan’s statement suggests that Israel believes it has gained at least that much time, without mounting an attack. So does the Obama administration.

By some estimates, the damage caused by Stuxnet has set back the Iranian nuclear program several years at least, to the point where it is now estimated that it would be 2015 before they’d be able to construct even a rudimentary bomb. That’s arguably better than what we could have accomplished with a military strike, and it comes without the international political implications, not to mention potential terrorist blowback, that a U.S. or Israeli military strike on Iran could have created.

But, there’s also something about this story that should give us pause:

“It’s like a playbook,” said Ralph Langner, an independent computer security expert in Hamburg, Germany, who was among the first to decode Stuxnet. “Anyone who looks at it carefully can build something like it.” Mr. Langner is among the experts who expressed fear that the attack had legitimized a new form of industrial warfare, one to which the United States is also highly vulnerable.

Now that we know what a properly designed computer worm can do to a nation’s industrial capacity, one would hope that someone out there is working on securing these systems. Otherwise, we could be dealing with a Stuxnet-like problem of our own some day.

Outside the Beltway

Forget Iran, Hizbullah, or any of the other armed-and-raring-to-go hostile countries and terrorist organizations. According to Peace Now’s Director-General, the biggest threat to Israel is…Israeli Foreign Minister Avigdor Liberman.

Thousands of activists from left-wing movements and human rights organizations marched in Tel Aviv on Saturday in protest of the Knesset’s decision to set up a committee of inquiry to probe the funding sources of leftist groups.

The protest march, under the headline “Demonstration (since it’s still possible) for democracy”, left from Tel Aviv’s Meir Park toward the plaza in front of the Tel Aviv Museum of Art, where a rally took place in which Knesset members from Kadima, Meretz, and Hadash as well as officials from Peace Now and human rights groups delivered speeches.

Protesters chanted in support of democracy and free speech, and carried signs with slogans such as “Awaiting Democracy”, “Danger! End of Democracy Ahead”, “Fighting the Government of Darkness” and “Democracy is Screaming for Help”.

Peace Now Director-General Yariv Oppenheimer said during the rally that “the Lieberman threat” is more serious than the Iranian threat.

“The Lieberman threat should worry us all. It is a greater threat than Iran. We must go out and protest,” said Oppenheimer.

If only Israel could invent something like Stuxnet to deal with this stupidity and moral bankruptcy.

Israellycool

What we do with the time granted us by the success of this worm matters more than its development.
American Thinker Blog

What we do with the time granted us by the success of this worm matters more than its development.
American Thinker Blog

According to a top Computer expert from Germany the Stuxnet virus which as been wreaking havoc on the Iranian nuclear program is just as effective as a military strike. Actually it is more effective,  it has set back Iran’s quest for nuclear capability by at least two years which is the best that can be hoped for with a military strike. And it was done without all the “mess” and human suffering which comes with a military strike

Little by little scientists are beginning to understand Stuxnet a computer worm developed with the sole purpose of doing what sanctions were not able to do, slow down the Iranian march to nuclear weapons. During the past year, Stuxnet the computer worm with a message from the biblical Queen Esther, not only crippled Iran’s nuclear program but has caused  a major rethinking of computer security around the globe (if you want to know how Stuxnet works click here).

According to a report in the Sunday NY Times, Stuxnet was tested in the Dimona facility in Israel’s Negev desert. Dimona is the (officially non-existent)plant where Israel runs its (officially non-existent) nuclear weapons program

Over the past two years, according to intelligence and military experts familiar with its operations, Dimona has taken on a new, equally secret role — as a critical testing ground in a joint American and Israeli effort to undermine Iran’s efforts to make a bomb of its own.

Behind Dimona’s barbed wire, the experts say, Israel has spun nuclear centrifuges virtually identical to Iran’s at Natanz, where Iranian scientists are struggling to enrich uranium. They say Dimona tested the effectiveness of the Stuxnet computer worm, a destructive program that appears to have wiped out roughly a fifth of Iran’s nuclear centrifuges and helped delay, though not destroy, Tehran’s ability to make its first nuclear arms.

“To check out the worm, you have to know the machines,” said an American expert on nuclear intelligence. “The reason the worm has been effective is that the Israelis tried it out.”

Officially US and Israeli officials will not discuss what has been going in the middle of the Negev, but new clues point to the fact that thevirus was designed as an American-Israeli project to sabotage the Iranian program.

In recent days, the retiring chief of Israel’s Mossad intelligence agency, Meir Dagan, and Secretary of State Hillary Rodham Clinton separately announced that they believed Iran’s efforts had been set back by several years.  Clinton cited the “weak” sanctions, which have supposedly damaged Iran’s ability to buy components.  Dagan, told the Israeli Knesset in recent days that Iran had run into technological difficulties (Stuxnet) that could delay a bomb until 2015.

As the virus continues to infect Iranian computers computer experts across the world are trying to figure out where Stuxnet came from. There is nothing but circumstantial evidence and it all points to the US and Israel). For example

In early 2008 the German company Siemens cooperated with one of the United States’ premier national laboratories, in Idaho, to identify the vulnerabilities of computer controllers that the company sells to operate industrial machinery around the world — and that American intelligence agencies have identified as key equipment in Iran’s enrichment facilities. Seimens says that program was part of routine efforts to secure its products against cyberattacks. Nonetheless, it gave the Idaho National Laboratory — which is part of the Energy Department, responsible for America’s nuclear arms — the chance to identify well-hidden holes in the Siemens systems that were exploited the next year by Stuxnet.

There is also the fact that computer scientists who are analyzing the computer worm have found a file name that seemingly refers to the Biblical Queen Esther.  Deep inside the computer worm that some specialists suspect is aimed at slowing Iran’s race for a nuclear weapon lies what could be a fleeting reference to the Book of Esther, the Old Testament narrative in which the Jewish Queen Esther pre-empts a Persian plot to kill all the Jews. One of the key files in Stuxnet was named “Myrtus” (myrtle) by the unknown designer. The biblical Esther’s original name was Hadassah, which is Hebrew for myrtle.

Officially, neither American nor Israeli officials will even utter the name of the malicious computer program, much less describe any role in designing it.

But Israeli officials grin widely when asked about its effects. Mr. Obama’s chief strategist for combating weapons of mass destruction, Gary Samore, sidestepped a Stuxnet question at a recent conference about Iran, but added with a smile: “I’m glad to hear they are having troubles with their centrifuge machines, and the U.S. and its allies are doing everything we can to make it more complicated.”

One interesting part of the program is that it was put in motion by President Bush. Yes liberals, this time you can say it, Bush did it.

The project’s political origins can be found in the last months of the Bush administration. In January 2009, The New York Times reported that Mr. Bush authorized a covert program to undermine the electrical and computer systems around Natanz, Iran’s major enrichment center. President Obama, first briefed on the program even before taking office, sped it up, according to officials familiar with the administration’s Iran strategy. So did the Israelis, other officials said. Israel has long been seeking a way to cripple Iran’s capability without triggering the opprobrium, or the war, that might follow an overt military strike of the kind they conducted against nuclear facilities in Iraq in 1981 and Syria in 2007.

The construction of the worm was so advanced, it was “like the arrival of an F-35 into a World War I battlefield,” says Ralph Langner, the computer expert who was the first to sound the alarm about Stuxnet. Langner, who runs a small computer security company in a suburb of Hamburg, had his five employees focus on picking apart the code and running it on the series of Siemens controllers neatly stacked in racks, their lights blinking.

He quickly discovered that the worm only kicked into gear when it detected the presence of a specific configuration of controllers, running a set of processes that appear to exist only in a centrifuge plant. “The attackers took great care to make sure that only their designated targets were hit,” he said. “It was a marksman’s job.”

For example, one small section of the code appears designed to send commands to 984 machines linked together.

Curiously, when international inspectors visited Natanz in late 2009, they found that the Iranians had taken out of service a total of exactly 984 machines that had been running the previous summer.

Interesting coincidence?

But as Mr. Langner kept peeling back the layers, he found more — what he calls the “dual warhead.” One part of the program is designed to lie dormant for long periods, then speed up the machines so that the spinning rotors in the centrifuges wobble and then destroy themselves. Another part, called a “man in the middle” in the computer world, sends out those false sensor signals to make the system believe everything is running smoothly. That prevents a safety system from kicking in, which would shut down the plant before it could self-destruct.

“Code analysis makes it clear that Stuxnet is not about sending a message or proving a concept,” Mr. Langner later wrote. “It is about destroying its targets with utmost determination in military style.”

This was not the work of hackers, he quickly concluded. It had to be the work of someone who knew his way around the specific quirks of the Siemens controllers and had an intimate understanding of exactly how the Iranians had designed their enrichment operations.

The reason why Stuxnet had knowledge of the workings of the Iranian centrifuges may have to do with the fact that those same type of centrifuges showed up in Dimona.

The account starts in the Netherlands. In the 1970s, the Dutch designed a tall, thin machine for enriching uranium. As is well known, A. Q. Khan, a Pakistani metallurgist working for the Dutch, stole the design and in 1976 fled to Pakistan.

The resulting machine, known as the P-1, for Pakistan’s first-generation centrifuge, helped the country get the bomb. And when Dr. Khan later founded an atomic black market, he illegally sold P-1’s to Iran, Libya, and North Korea.

The P-1 is more than six feet tall. Inside, a rotor of aluminum spins uranium gas to blinding speeds, slowly concentrating the rare part of the uranium that can fuel reactors and bombs.

How and when Israel obtained this kind of first-generation centrifuge remains unclear, whether from Europe, or the Khan network, or by other means. But nuclear experts agree that Dimona came to hold row upon row of spinning centrifuges.

“They’ve long been an important part of the complex,” said Avner Cohen, author of “The Worst-Kept Secret” (2010), a book about the Israeli bomb program, and a senior fellow at the Monterey Institute of International Studies. He added that Israeli intelligence had asked retired senior Dimona personnel to help on the Iranian issue, and that some apparently came from the enrichment program.

“I have no specific knowledge,” Dr. Cohen said of Israel and the Stuxnet worm. “But I see a strong Israeli signature and think that the centrifuge knowledge was critical.”

…Dr. Cohen said his sources told him that Israel succeeded — with great difficulty — in mastering the centrifuge technology. And the American expert in nuclear intelligence, who spoke on the condition of anonymity, said the Israelis used machines of the P-1 style to test the effectiveness of Stuxnet.

The expert added that Israel worked in collaboration with the United States in targeting Iran, but that Washington was eager for “plausible deniability.”

One thing can’t be denied, the Stuxnet worm has been a major obstacle to Iran’s desire to obtain nuclear weapons, saving Israel from having to attack Iran at least for a while.  Who ever developed the virus lets hope they are working on a follow-up because 2015 is not that far away.

Please email me at [email protected] to be put onto my mailing list.
Feel free to reproduce any article but please link back to http://yidwithlid.blogspot.com

YID With LID

A fascinating NYT article on Stuxnet:

The Dimona complex in the Negev desert is famous as the heavily guarded heart of Israel’s never-acknowledged nuclear arms program, where neat rows of factories make atomic fuel for the arsenal.

Over the past two years, according to intelligence and military experts familiar with its operations, Dimona has taken on a new, equally secret role — as a critical testing ground in a joint American and Israeli effort to undermine Iran’s efforts to make a bomb of its own.

Behind Dimona’s barbed wire, the experts say, Israel has spun nuclear centrifuges virtually identical to Iran’s at Natanz, where Iranian scientists are struggling to enrich uranium. They say Dimona tested the effectiveness of the Stuxnet computer worm, a destructive program that appears to have wiped out roughly a fifth of Iran’s nuclear centrifuges and helped delay, though not destroy, Tehran’s ability to make its first nuclear arms.

“To check out the worm, you have to know the machines,” said an American expert on nuclear intelligence. “The reason the worm has been effective is that the Israelis tried it out.”

…
The project’s political origins can be found in the last months of the Bush administration. In January 2009, The New York Times reported that Mr. Bush authorized a covert program to undermine the electrical and computer systems around Natanz, Iran’s major enrichment center. President Obama, first briefed on the program even before taking office, sped it up, according to officials familiar with the administration’s Iran strategy. So did the Israelis, other officials said. Israel has long been seeking a way to cripple Iran’s capability without triggering the opprobrium, or the war, that might follow an overt military strike of the kind they conducted against nuclear facilities in Iraq in 1981 and Syria in 2007.

Two years ago, when Israel still thought its only solution was a military one and approached Mr. Bush for the bunker-busting bombs and other equipment it believed it would need for an air attack, its officials told the White House that such a strike would set back Iran’s programs by roughly three years. Its request was turned down.

Now, Mr. Dagan’s statement suggests that Israel believes it has gained at least that much time, without mounting an attack. So does the Obama administration.
…
[Security expert Langer] quickly discovered that the worm only kicked into gear when it detected the presence of a specific configuration of controllers, running a set of processes that appear to exist only in a centrifuge plant. “The attackers took great care to make sure that only their designated targets were hit,” he said. “It was a marksman’s job.”

For example, one small section of the code appears designed to send commands to 984 machines linked together.

Curiously, when international inspectors visited Natanz in late 2009, they found that the Iranians had taken out of service a total of exactly 984 machines that had been running the previous summer.

Read the whole thing.

(h/t Challah Hu Akbar)

Elder of Ziyon

I’ve written before that Obama used the threat of an Israeli attack on Iranian reactors to get China to agree to sanctions.

Well, if Obama can use that possibility to pressure China-who is to say that Israel itself cannot use that same prospect to provide a reason to other countries, including the US, to help stop Iran?

There are reports now that the CIA and M16 are helping the Mossad to sabotage Iran’s nuclear program:

US and UK intelligence services are cooperating with the Mossad to sabotage Teheran’s nuclear program in exchange for Israel agreeing not to launch a military strike on Iran, the French weekly Le Canard enchaîné reported on Thursday, quoting French intelligence sources.

Acts of sabotage carried out in the past year in Iran were conducted by Israel with the help of the CIA and MI6, the sources said.

The sabotage included, according to the report, the introduction of the Stuxnet computer virus into 30,000 computers in Iran’s nuclear reactors and explosions in October in which 18 Iranian technicians were killed at a factory in the Zagros mountains that manufactured Shihab missiles.

The idea that Israel is getting help makes sense, according to a FoxNews article-assuming that in fact Stuxnet is in fact a product of Israel-because of the wide range of knowledge necessary to allow the Stuxnet worm to bring the Iranian nuclear program to a grinding halt:

Langer argues that no single Western intelligence agency had the skills to pull this off alone. The most likely answer, he says, is that a consortium of intelligence agencies worked together to build the cyber bomb. And he says the most likely confederates are the United States, because it has the technical skills to make the virus, Germany, because reverse-engineering Siemen’s product would have taken years without it, and Russia, because of its familiarity with both the Iranian nuclear plant and Siemen’s systems.

Based on the blog of French Journalist Vincent Jauvert, the cooperation with both the CIA and M16 should not be surprising-Stuxnet appears to be a natural outgrowth of the US policy that started with President Bush:

Beyond assumptions Stuxnet, a certainty for all services Western lead a secret war against the very active Iranian nuclear program. Since the discovery of Natanz in 2002, is for them a priority mission. In his latest book, journalist Bob Woodward reveals the list of covert operations sponsored by the Bush administration and ongoing. They are ranked in order of importance. The actions of the CIA to “stop or impede” the nuclear activities of the Islamic Republic came second, just behind the operations against Al Qaeda. Same thing in British MI6. October 28, his boss, Sir John Sawers, left his legendary reserve just to talk about Iran. The spymaster caused a stir by publicly declaring that it was necessary “to conduct joint operations of intelligence services to make it more difficult [in Tehran] the development of nuclear weapons.”

On behalf of this historic mission is the sacred union of all the secret agents. Even in Israel. “The Iranian case has caused a cultural revolution within the Aman [military intelligence] and the Mossad, said the journalist Ronen Bergman, who is preparing a book on the secret of the Mossad. Their leaders have agreed to cooperate fully with foreign services, friends or not, unlike the traditional doctrine that emphasizes the work solo. ” In France, too, the prevailing cordial. “The Iranian nuclear issue is one of the few subjects with terrorism, about which there is no squabble between the DGSE, the DRM and the DCRI, but otherwise exemplary coordination at the highest level, ” explains the expert Francois Heisbourg, following these sensitive issues. [translated using Google Translate]

Jauvert also ties in Germany’s BND, which fits according to the FoxNews article above.

I’ve read that now it will be 3 years before Iran acquires nuclear capabilities.
Let’s hope that prediction is overly optimistic.

Hat tip: Israel Matzav

Technorati Tag: Stuxnet.

Daled Amos

The Mullahs are stil trying to cope with the depredations of the evil Stuxnet computer worm on their illegal nuclear program,and some experts are saying it might have set them back as much as two years.

A German computer expert was quoted by the Jerusalem Post as saying, “This was nearly as effective as a military strike, but even better since there are no fatalities and no full-blown war. From a military perspective, this was a huge success.”

“It is extremely difficult to clean up installations from Stuxnet, and we know that Iran is no good in IT [information technology] security, and they are just beginning to learn what this all means,” he said. “Just to get their systems running again they have to get rid of the virus, and this will take time, and then they need to replace the equipment, and they have to rebuild the centrifuges at Natanz and possibly buy a new turbine for Bushehr.”

While I think two years is optimistic, there’s no doubt this was a major setback.So who was responsible?

The Israelis are widely suspected, and as a matter of fact they do have a secret unit that’s proven itself to be very effective at cyberwarfare.

The US is also a prime suspect, and as the expert the Post spoke to speculated, it might even have been a joint effort,although I doubt it.

“We can say that it must have taken several years to develop, and we arrived at this conclusion through code analysis, since the code on the control systems is 15,000 lines of code, and this is a huge amount.”

“This piece of evidence led us to conclude that this is not by a hacker,” he continued. “It had to be a country, and we can also conclude that even one nation-state would not have been able to do this on its own.”

One fact against the supposition of a joint effort is the fact that no details have leaked out yet.The Israelis are notoriously good at keeping these sort of things quiet, the Americans not so much. And as the old Sicilian saying goes, a secret is something only two people keep only when one of them is dead.

One interesting bit of speculation was forwarded tome via Joshua’s Army member Dan Friedman. According to another expert, Jeffrey Carr writing at Forbes, the real culprit was the Chinese.. and he presents some pretty compelling evidence, based on several Chinese companies involved, China having access to a full Windows Source code, China having little or no evidence of Stuxnet problems even though they should have had vulnerability and the fact that the Iranian centrifuges may actually be a Chinese design.

According to Carr, the benefit for the Chinese is to keep a major oil supplier to China pumping out crude while sabotaging Iran’s nuclear program to keep Israel or the US from a military attack that might interdict the oil flow to China not only from Iran but the entire Persian Gulf.

(an additonal hat tip to Joahua’s Army member Louie Louie on this one)

please donate…it helps me write more gooder!

J O S H U A P U N D I T

Dude?
Hot Air » Top Picks

BLACKFIVE

According to a top Computer expert from Germany the Stuxnet virus which as been wreaking havoc on the Iranian nuclear program is just as effective as a military strike. Actually it is more effective,  it has set back Iran’s quest for nuclear capability by at least two years which is the best that can be hoped for with a military strike, without all the “mess” and human suffering due to war.

Little by little scientists are beginning to understand Stuxnet a computer worm developed with the sole purpose of doing what sanctions were not able to do, slow down the Iranian march to nuclear weapons. During the past year, Stuxnet the computer worm with a biblical calling card, not only crippled Iran’s nuclear program but has caused  a major rethinking of computer security around the globe (if you want to know how Stuxnet works click here)

“It will take two years for Iran to get back on track,” Langer said in a telephone interview [with Jpost]  from his office in Hamburg, Germany. “This was nearly as effective as a military strike, but even better since there are no fatalities and no full-blown war. From a military perspective, this was a huge success.”

Langer spoke to the Post amid news reports that the virus was still infecting Iran’s computer systems at its main uranium enrichment facility at Natanz and its reactor at Bushehr.

Last month, the International Atomic Energy Agency (IAEA), the United Nation’s nuclear watchdog, said that Iran had suspended work at its nuclear-field production facilities, probably as result of the Stuxnet virus.

Because it benignly hides in computers and back up systems,  some scientists have claimed that there is only one way of getting rid of the virus, throw out every computer involved with the Iranian nuclear program and get new ones, otherwise they will continually be re-infecting themselves. Langer agrees.

According to Langer, Iran’s best move would be to throw out all of the computers that have been infected by the worm, which he said was the most “advanced and aggressive malware in history.” But, he said, even once all of the computers were thrown out, Iran would have to ensure that computers used by outside contractors were also clean of Stuxnet.

“It is extremely difficult to clean up installations from Stuxnet, and we know that Iran is no good in IT [information technology] security, and they are just beginning to learn what this all means,” he said. “Just to get their systems running again they have to get rid of the virus, and this will take time, and then they need to replace the equipment, and they have to rebuild the centrifuges at Natanz and possibly buy a new turbine for Bushehr.”

It is unlikely that Iran would take the time (a year or more) to take that drastic step.

Widespread speculation has named Israel’s Military Intelligence Unit 8200, known for its advanced Signal Intelligence (SIGINT) capabilities, as the possible creator of the software, as well as the United States.

No one knows for sure where the virus came from, but there is evidence that Israel is probably behind the Stuxnet worm, evidence of biblical proportions. If not Israel maybe the virus is a sign from God. Computer Scientists who are analyzing the computer worm have found a file name that seemingly refers to the Biblical Queen Esther, the heroine from the Book of Esther the Old Testament narrative in which the Jews pre-empt a Persian plot to destroy them (ancient Persia is today’s Iran).

Langer said that in his opinion at least two countries – possibly Israel and the United States – were behind Stuxnet.

Israel has declined comment on its suspected involvement in the Stuxnet virus, as they traditionally decline to comment on any possible military action, whether they are involved or not. 

“We can say that it must have taken several years to develop, and we arrived at this conclusion through code analysis, since the code on the control systems is 15,000 lines of code, and this is a huge amount,” Langer said.

“This piece of evidence led us to conclude that this is not by a hacker,” he continued. “It had to be a country, and we can also conclude that even one nation-state would not have been able to do this on its own.”

Last week we reported that Stuxnet was still damaging the computers running the Iranian nuclear computers.

How do we know? Because a US site that has been studying the Stuxnet worm has been inundated with requests for information from Iran:

Eric Byres, a computer expert who has studied the worm, said his site was hit with a surge in traffic from Iran, meaning that efforts to get the two nuclear plants to function normally have failed. The web traffic, he says, shows Iran still hasn’t come to grips with the complexity of the malware that appears to be still infecting the systems at both Bashehr and Natanz.

“The effort has been stunning,” Byres said. “Two years ago American users on my site outnumbered Iranians by 100 to 1. Today we are close to a majority of Iranian users.”

He said that while there may be some individual computer owners from Iran looking for information about the virus, it was unlikely that they were responsible for the vast majority of the inquiries because the worm targeted only the two nuclear sites and did no damage to the thousands of other computers it infiltrated.

At one of the larger American web companies offering advice on how to eliminate the worm, traffic from Iran has swamped that of its largest user: the United States.

Perhaps more significantly, traffic from Tehran to the company’s site is now double that of New York City.

Ron Southworth, who runs the SCADA (the Supervisory Control and Data Access control system that the worm specifically targeted) list server, said that until two years ago he had clearly identified users from Iran, “but they all unsubscribed at about the same time.” Since the announcement of the Stuxnet malware, he said, he has seen a jump in users, but few openly from Iran. He suspects there is a cat-and-mouse game going on that involves hiding the e-mail addresses, but he said it was clear his site was being searched by a number of users who have gone to a great deal of effort to hide their country of origin.

Byres said there are a growing number of impostors signing on to Stuxnet security sites.

“I had one guy sign up who I knew and called him. He said it wasn’t his account. In another case a guy saying he was Israeli tried to sign up. He wasn’t.”

The implication, he says, is that such a massive effort is a sign of a coordinated effort.

Who ever created the Virus, the fact that it has set back the Iranian nuclear program without requiring a military strike should earn them a massive bonus. No matter what country they come from.

Please email me at [email protected] to be put onto my mailing list.
Feel free to reproduce any article but please link back to http://yidwithlid.blogspot.com

YID With LID

Some great new details in the JPost about Stuxnet:

The Stuxnet virus, which has attacked Iran’s nuclear facilities and which Israel is suspected of creating, has set back the Islamic Republic’s nuclear program by two years, a top German computer consultant who was one of the first experts to analyze the program’s code told The Jerusalem Post on Tuesday.

“It will take two years for Iran to get back on track,” Langer said in a telephone interview from his office in Hamburg, Germany. “This was nearly as effective as a military strike, but even better since there are no fatalities and no full-blown war. From a military perspective, this was a huge success.”

…Eric Byres, a computer security expert who runs a website called Tofino Security, which provides solutions for industrial companies with Stuxnet-related problems, told the Post on Tuesday that the number of Iranians visiting his site had jumped tremendously in recent weeks – a likely indication that the virus is still causing great disarray at Iranian nuclear facilities.

“What caught our attention was that last year we maybe had one or two people from Iran trying to access the secure areas on our site,” Byres said. “Iran was never on the map for us, and all of a sudden we are now getting massive numbers of people going to our website, and people who we can identify as being from Iran.”

“There are a large number of people trying to access the secure areas directly from Iran and other people who are putting together fake identities,” he said. “We are talking about hundreds. It could be people who are curious about what is going on, but we are such a specialized site that it would only make sense that these are people who are involved in control systems.”

I think it is time to release a specialized patch, custom made just for these Iranians who are trying to clean up the virus….

Elder of Ziyon

A Forbes blogger  has a fascinating theory:

I uncovered a connection between two of the key players in the Stuxnet drama: Vacon, the Finnish manufacturer of one of two frequency converter drives targeted by this malware; and RealTek, who’s digital certificate was stolen and used to smooth the way for the worm to be loaded onto a Windows host without raising any alarms. A third important piece of the puzzle, which I’ll discuss later in this article, directly connects a Chinese antivirus company which writes their own viruses with the Stuxnet worm.

…China has an intimate knowledge of Iran’s centerfuges since, according to one source quoted above, they’re of Chinese design.

China has better access than any other country to manufacturing plans for the Vacon frequency converter drive made by Vacon’s Suzhou facility and specifically targeted by the Stuxnet worm (along with an Iranian company’s drive).

China has better access than any other country to RealTek’s digital certificates through it’s Realsil office in Suzhou and, secondarily, to JMicron’s office in Taiwan.

China has direct access to Windows source code, which would explain how a malware team could create 4 key zero day vulnerabilities for Windows when most hackers find it challenging to develop even one.

…As far as China goes, I’ve identified 5 distinct ties to Stuxnet that are unique to China as well as provided a rationale for the attack which fits China’s unique role as Iran’s ally and customer, while opposing Iran’s fuel enrichment plans. There’s still a distinct lack of information on any other facilities that suffered damage, and no good explanations for why there was such massive collateral damage across dozens of countries if only one or two facilities in one nation state were the targets however based solely on the known facts, I consider China to be the most likely candidate for Stuxnet’s origin.

I don’t think this is altogether convincing, but it is certainly worth consideration. If you are into Stuxnet, read the whole thing.

(h/t Clark)

Elder of Ziyon