Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Development and testing of the Stuxnet worm

nytimes.com

Post reply on HN
Print view View original

11–20 of 89 posts

Re: Development and testing of the Stuxnet worm

#11

Post by adlep »

atomical wrote: post #10
extension wrote: post #8

I haven't decided yet how to feel about Stuxnet. On one hand, good guys don't release viruses into the wild, period . On the other hand, only good has come from this. Iran doesn't get nukes until later and industry figures out that they need to lock down their machine controllers, without any real damage.

Aren't people worried Iran could potentially develop something similar to target oil rigs? Is there a guy at the CIA saying, "Oh don't worry about it boys; it's a one off, they'll never be able to figure it out or respond in kind." At one point Persians were one of the most educated minorities in the US. They have good universities in Iran and I wouldn't put it past them to develop the capabilities to push back again…

Starting a precedence like that is never a good idea, although it looks like the US and Israel had very little choice - as the only option to stop the Iran's nuke program is an all out war. So I guess, a very sophisticated but non deadly cyberwar is a better alternative to a conventional war or strike.

Re: Development and testing of the Stuxnet worm

#12

Post by extension »

atomical wrote: post #10
extension wrote: post #8

I haven't decided yet how to feel about Stuxnet. On one hand, good guys don't release viruses into the wild, period . On the other hand, only good has come from this. Iran doesn't get nukes until later and industry figures out that they need to lock down their machine controllers, without any real damage.

Aren't people worried Iran could potentially develop something similar to target oil rigs? Is there a guy at the CIA saying, "Oh don't worry about it boys; it's a one off, they'll never be able to figure it out or respond in kind." At one point Persians were one of the most educated minorities in the US. They have good universities in Iran and I wouldn't put it past them to develop the capabilities to push back again…

If Iran is going to do, or is already doing, cyberwarfare then they'll do it whether or not they get attacked first. But now, everyone will be on guard.

I think for the most part, Stuxnet will be a one of a kind event in history. Though it's a nasty thing to do, only one team ever gets to do it, and I'd rather it be us than them.

Re: Development and testing of the Stuxnet worm

#13

Post by MichaelSalib »

extension wrote: post #8

I haven't decided yet how to feel about Stuxnet. On one hand, good guys don't release viruses into the wild, period . On the other hand, only good has come from this. Iran doesn't get nukes until later and industry figures out that they need to lock down their machine controllers, without any real damage.

Iran doesn't get nukes until later

So, we're not going to change the end-game, we're just going to piss of Iran....and you think that's good?

Consider things from the Iranian's perspective. Back in the day, they were establishing a legitimate democratically elected government. The US overthrew that government and pushed a brutal dictator into power, who tortured and murdered many Iranians. From their perspective, the US is an evil nation that does evil things. Nuclear weapons look like the only thing that could give them security against the US. And we're hellbent on stopping them. Heck, the US has never even apologized for overthrowing their government and installing a murderous dictator: can you really blame the Iranians for believing that the US government is trying to screw with their country?

The only way this ends well is with a deal and deals require trust. Does Stuxnet promote that trust? Or does Stuxnet just provide further evidence that the hardliners are right, that the US is trying to screw with their country?

industry figures out that they need to lock down their machine controllers

This seems like wishful thinking. We have a terrible track record of getting large scale systems secured, even in areas where those systems are under continuous public attack. Industrial software is not one of those areas, so developers of such software are unlikely to take security very seriously. But even if they did: we don't know how to get them to build secure systems.

Microsoft spends a huge amount of developer time and money on system security. They're not very successful. But they devote a much larger fraction of their budget to that goal than any industrial software shop. So expecting industrial software shops to produce code that is even as secure as Microsoft's seems...unlikely.

Re: Development and testing of the Stuxnet worm

#15

Post by MichaelSalib »

extension wrote: post #12
atomical wrote: post #10

Earlier quoted context omitted.

Aren't people worried Iran could potentially develop something similar to target oil rigs? Is there a guy at the CIA saying, "Oh don't worry about it boys; it's a one off, they'll never be able to figure it out or respond in kind." At one point Persians were one of the most educated minorities in the US. They have good universities in Iran and I wouldn't put it past them to develop the capabilities to push back again…

If Iran is going to do, or is already doing, cyberwarfare then they'll do it whether or not they get attacked first. But now, everyone will be on guard. I think for the most part, Stuxnet will be a one of a kind event in history. Though it's a nasty thing to do, only one team ever gets to do it, and I'd rather it be us than them.

If Iran is going to do, or is already doing, cyberwarfare then they'll do it whether or not they get attacked first.

Why? Is that because you assume that Iranians are irrational and evil?

Usually people do stuff because it benefits them somehow. So, why exactly would Iran launch a cyberwarfare attack against the US in a world where the US didn't strike first?

But now, everyone will be on guard.

Given how completely we've failed at building secure systems, I'm not sure that really helps.

Re: Development and testing of the Stuxnet worm

#16

Post by bueller »

extension wrote: post #8

I haven't decided yet how to feel about Stuxnet. On one hand, good guys don't release viruses into the wild, period . On the other hand, only good has come from this. Iran doesn't get nukes until later and industry figures out that they need to lock down their machine controllers, without any real damage.

i guess you haven't seen Hackers

Re: Development and testing of the Stuxnet worm

#18

Post by extension »

MichaelSalib wrote: post #13
extension wrote: post #8

I haven't decided yet how to feel about Stuxnet. On one hand, good guys don't release viruses into the wild, period . On the other hand, only good has come from this. Iran doesn't get nukes until later and industry figures out that they need to lock down their machine controllers, without any real damage.

Iran doesn't get nukes until later So, we're not going to change the end-game, we're just going to piss of Iran....and you think that's good? Consider things from the Iranian's perspective. Back in the day, they were establishing a legitimate democratically elected government. The US overthrew that government and pushed a brutal dictator into power, who tortured and murdered many Iranians. From their perspective, the…

So, we're not going to change the end-game, we're just going to piss of Iran....and you think that's good?

All I want is for nobody to get nuked. I think it's more likely that nobody will get nuked if Iran doesn't have nukes. But you're right that Stuxnet is a dirty move that erodes trust, that's why I'm conflicted.

We have a terrible track record of getting large scale systems secured, even in areas where those systems are under continuous public attack. Industrial software is not one of those areas, so developers of such software are unlikely to take security very seriously.

Surely going from complete obliviousness to awareness is the biggest step the industry will ever take to being secure, even if subsequent progress is slow. But I think they will fare better than corporate or home users, because there are less of them and they are more technically inclined and disciplined.

Re: Development and testing of the Stuxnet worm

#19

Post by ecuzzillo »

MichaelSalib wrote: post #13
extension wrote: post #8

I haven't decided yet how to feel about Stuxnet. On one hand, good guys don't release viruses into the wild, period . On the other hand, only good has come from this. Iran doesn't get nukes until later and industry figures out that they need to lock down their machine controllers, without any real damage.

Iran doesn't get nukes until later So, we're not going to change the end-game, we're just going to piss of Iran....and you think that's good? Consider things from the Iranian's perspective. Back in the day, they were establishing a legitimate democratically elected government. The US overthrew that government and pushed a brutal dictator into power, who tortured and murdered many Iranians. From their perspective, the…

The Iran political situation is not exactly about to topple, but it's not the most stable situation in the world, either. Four-plus years is a really long time when we're talking about the CIA's/US's/Israel's ability to topple a potentially vulnerable regime.

Re: Development and testing of the Stuxnet worm

#20

Post by ecuzzillo »

MichaelSalib wrote: post #15
extension wrote: post #12

Earlier quoted context omitted.

If Iran is going to do, or is already doing, cyberwarfare then they'll do it whether or not they get attacked first. But now, everyone will be on guard. I think for the most part, Stuxnet will be a one of a kind event in history. Though it's a nasty thing to do, only one team ever gets to do it, and I'd rather it be us than them.

If Iran is going to do, or is already doing, cyberwarfare then they'll do it whether or not they get attacked first. Why? Is that because you assume that Iranians are irrational and evil? Usually people do stuff because it benefits them somehow. So, why exactly would Iran launch a cyberwarfare attack against the US in a world where the US didn't strike first? But now, everyone will be on guard. Given how completely w…

Iran's top people have been established to desire the destruction of Israel at minimum, and they can't fathom the destruction of the US, but if they could, I'm pretty sure they would want that too. So, at minimum, they would want to do shit like this to Israel if they remotely had the capability. My impression is that they don't have remotely the brain-capital to do so.
Post reply on HN