Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stuxnet's Secret Twin

foreignpolicy.com

Post reply on HN
Print view View original

41–50 of 61 posts

Re: Stuxnet's Secret Twin

#41

Post by MichaelGG »

fragsworth wrote: post #38
tcoppi wrote: post #18

Earlier quoted context omitted.

If you'd bother to read the article, you'd know that the infection vector was not direct Internet access to the affected systems.

They were able to connect to the centrifuges through the internal facility by infected machines. I remember reading that one of the methods Stuxnet used to transmit data through the facility between two infected machines that were not networked: sound cards and microphones.

Citation? A Google search for Stuxnet Microphone only has sentences saying it could activate and record; nothing about transferring data.

The "BadBIOS" (apparent) hoax/delusion claims machines are using that vector, though.

Re: Stuxnet's Secret Twin

#42

Post by jafaku »

angrydev wrote: post #34

Readability link: http://www.readability.com/articles/6ycbi4jx I highly recommend downloading this extension for websites with crappy overlays like this one!

I just removed the overlay with firebug :p

But that's a great service, I didn't know I could use it without registering. I will use the bookmarklet from now on, thanks!

Re: Stuxnet's Secret Twin

#43

Post by walshemj »

davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

They where not the controllers where SCADA - which appears to have less security than windows 3.1

Why SCADA doesn't have the equivalent of a write protect switch so that you can physically disable updates is the more interesting Q.

Re: Stuxnet's Secret Twin

#44

Post by duaneb »

davidgerard wrote: post #25
andylei wrote: post #24

Earlier quoted context omitted.

someone should have told the iranians that linux computers have no security vulnerabilities

They are seriously less insecure by design than Windows. http://philosecurity.org/2009/01/12/interview-with-an-adware... Don't tell me you aren't familiar with this.

Any targeted attack is likely to succeed given the (apparent) money and talent behind Stuxnet. Many of the exploits were zero-day anyway; I see no reason why they couldn't have used zero-day linux exploits instead.

I do agree, though, Windows is a desktop machine OS and has a vastly larger exploitation surface area.

Re: Stuxnet's Secret Twin

#45

Post by nitrogen »

D9u wrote: post #10
xfax wrote: post #9

Here you go: http://www.readability.com/read?url=http%3A//www.foreignpoli...

That link also presents a registration form. Thanks anyway.

You can just right click the overlay, click Inspect Element, then delete the div that contains the overlay.

Re: Stuxnet's Secret Twin

#46

Post by viraptor »

duaneb wrote: post #44
davidgerard wrote: post #25

Earlier quoted context omitted.

They are seriously less insecure by design than Windows. http://philosecurity.org/2009/01/12/interview-with-an-adware... Don't tell me you aren't familiar with this.

Any targeted attack is likely to succeed given the (apparent) money and talent behind Stuxnet. Many of the exploits were zero-day anyway; I see no reason why they couldn't have used zero-day linux exploits instead. I do agree, though, Windows is a desktop machine OS and has a vastly larger exploitation surface area.

"I see no reason why they couldn't have used zero-day linux exploits instead"

Selinux / apparmor, lxc (or similar), better aslr, daemons usually defaulting to separate users, many other things... There are many security layers so trivial to apply these days that it's really a failure not to. Sure - you can still find zero-days (or may be already sitting on a pile of them), but I get an impression that it's much harder to take over the whole system these days if anyone spent a couple of minutes just to tweak the defaults.

Re: Stuxnet's Secret Twin

#47

Post by Zigurd »

fragsworth wrote: post #38
tcoppi wrote: post #18

Earlier quoted context omitted.

If you'd bother to read the article, you'd know that the infection vector was not direct Internet access to the affected systems.

They were able to connect to the centrifuges through the internal facility by infected machines. I remember reading that one of the methods Stuxnet used to transmit data through the facility between two infected machines that were not networked: sound cards and microphones.

They probably bribed an operator to carry in a usb stick.

Re: Stuxnet's Secret Twin

#48

Post by Zigurd »

TheCapn wrote: post #27
davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

If a government entity was willing to pay for 0-day exploits to target a specific system and infrastructure I don't think it really mattered what OS was behind the controllers since they'd be building the super-virus to the needs of the assignment.

I don't think that conclusion, or the more general one, that endpoint security can't be a significant barrier, can be drawn yet. The level of good security practices in this case is very low. Once the air gap was breached they were done.

Re: Stuxnet's Secret Twin

#49

Post by Zigurd »

duaneb wrote: post #44
davidgerard wrote: post #25

Earlier quoted context omitted.

They are seriously less insecure by design than Windows. http://philosecurity.org/2009/01/12/interview-with-an-adware... Don't tell me you aren't familiar with this.

Any targeted attack is likely to succeed given the (apparent) money and talent behind Stuxnet. Many of the exploits were zero-day anyway; I see no reason why they couldn't have used zero-day linux exploits instead. I do agree, though, Windows is a desktop machine OS and has a vastly larger exploitation surface area.

I do not think that's true. It obviously took a serious amount of time, money, and testing to implement stuxnet. Double the cost and risk might still be do-able. 10X the cost and risk might not.

The level of defense - in this case an air gap - raised cost and risk. That added back bag job to plant the infection, or a bribed operator to the cost and risk. If the SCADA software ran in a VM as a guest OS, and booted from read-only media, stuxnet might not have taken hold, and the bribed operator might have been discovered by forensics on isolated infected systems.

At some point the cost and/or risk exceeds the value of the target or a reasonable threshold for the chance of success. Even when you have infinite money, you don't have infinite time or infinite risk tolerance.

Re: Stuxnet's Secret Twin

#50

Post by JabavuAdams »

davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

> Why THE FUCK are industrial controllers connected to the Internet?

Fixed that for you.

Post reply on HN