US and Israel created Stuxnet, lost control of it • Hacker News Board

Re: US and Israel created Stuxnet, lost control of it

#211

Post by afterburner » Fri, Jun 01, 2012, 7:01 PM UTC

ChuckMcM wrote: post #199

hieronymusN wrote: post #41

Earlier quoted context omitted.

This isn't nearly as terrifying as the Cold War with the USSR. We're not threatened with nuclear war, nor having the near misses that could trigger it (Cuban missile crisis). No one is building bomb shelters in their backyards, because right now the balance of power is very much in the United States' favor. Could things get there with another nuclear enabled power like China? Maybe, in time. Iran is not an existentia…

I am probably in a minority but I find it more terrifying than the Cold War. At least in the Cold War when the balloon went up everybody died. In this scenario we could be alive and under increasingly onerous affronts on our civil liberties. During the Cold War I might have been called up to attack and kill Soviets, if internal threats were used to install a police state I would be called up to attack and kill my own…

Onerous affronts on civil liberties were occurring during the Cold War too.

Re: US and Israel created Stuxnet, lost control of it

#212

Post by lawnchair_larry » Fri, Jun 01, 2012, 7:11 PM UTC

tptacek wrote: post #165

dpeck wrote: post #155

It is anything but confirmed. Arstechnica writes an article about an article in the NYT (a paper that doesn't have the best track record reporting about cyber events and control system security issues to begin with) that cites no credible sources. Also, you don't "lose control" of something like this, it was designed with many ways to spread. If control was lost it was during the spec/coding phase, not after deployme…

When the New York Times prints: “Should we shut this thing down?” Mr. Obama asked, according to members of the president’s national security team who were in the room. It is generally safe to assume, whether you admire the NYT (like me) or don't (like 'patio11), that there's an actual source with a credible claim to have been in the room with the President who did in fact tell David E. Sanger that this happened. Peop…

Yeah, you and Nate Lawson were totally out to lunch on that. I was honestly amazed that anyone thought it could have been anything else, and still am.

But I see nothing idiotic about it.

Re: US and Israel created Stuxnet, lost control of it

#213

Post by eli » Fri, Jun 01, 2012, 7:11 PM UTC

dpeck wrote: post #202

eli wrote: post #174

Earlier quoted context omitted.

How much more do you think you can reasonably expect for an ongoing covert national security program? If the article is wrong, it would be a massive screw up. Huge. Historical. The kind of thing that would prompt a strong rebuke from the named countries and individuals. In fact it's a remarkably well sourced article given the context and a cynical person might speculate on the timing of this revelation in regards to…

You act as if its something that the countries would want to rebuke. Seems like good PR and an orchestrated leak to me.

So someone else created Stuxnet, but many months after its discovery the US government orchestrated a leak involving multiple government agencies and a detailed backstory to falsely take credit for it?

That seems like a complicated and unnecessary conspiracy theory that runs a very high risk of unraveling in an embarrassing fashion. It is not plausible.

Re: US and Israel created Stuxnet, lost control of it

#214

Post by waqf » Fri, Jun 01, 2012, 7:12 PM UTC

freshhawk wrote: post #178

strags wrote: post #170

"[Obama] repeatedly expressed concerns that any American acknowledgment that it was using cyberweapons—even under the most careful and limited circumstances—could enable other countries, terrorists or hackers to justify their own attacks. “We discussed the irony, more than once,” one of his aides said." "Irony" is the wrong word. It's "hypocrisy".

Not when you honestly believe in American Exceptionalism

On the contrary, hypocrisy is all about believing that "when I do it it's not wrong". Decrying something when you are ashamed that you secretly do it yourself is not hypocrisy, because it doesn't involve a double standard.

Re: US and Israel created Stuxnet, lost control of it

#215

Post by jerf » Fri, Jun 01, 2012, 7:18 PM UTC

kbolino wrote: post #160

jerf wrote: post #146

Earlier quoted context omitted.

That's a canned knee-jerk response, not one that shows you read my message. That's not relevant data to the question of what future bioattacks or computer attacks are possible... and note my continued avoidance of the term "terrorism". Once an attack is launched the source isn't very relevant. Failing to secure our infrastructure because "terrorism isn't something to be afraid of" is still a stupid move because it le…

My original response was more thoughtful, but I felt that summed up my point better. The question is not what's possible, but what's likely and how much it will cost. If the likelihood is low and the cost is small, then you cannot justify extravagant preparation. An attack against civilian infrastructure is terrorism no matter who does it. It may be a singular event, part of a chain of attacks, or a prelude to a full…

You continue to not really be thinking about my point, insisting on framing it in a pre-canned terrorism argument. I am explicitly talking about high-cost events, and at best you can call the probability unknown, for things like a biological attack or a computer attack that perhaps even accidentally ends up taking out some very important part of the infrastructure. We already have good reasons to be concerned that a high-cost biological attack could be launched out of someone's literal garage, and it is not an irrational fear; we have plausible plans on how it could be done. Indeed I'd argue that being unconcerned about it is irrational, and being unconcerned about it because so far "terrorists", a small subset of the group of people I'm concerned about, have only managed to "fly planes into a couple of buildings". It's basically a non-sequitur argument, because a great deal of the point I'm making is that is only a small part of the total interesting threat profile.

Re: US and Israel created Stuxnet, lost control of it

#216

Post by webXL » Fri, Jun 01, 2012, 7:21 PM UTC

kbolino wrote: post #194

webXL wrote: post #166

Earlier quoted context omitted.

Terrorist victims in 2001: 3,000 ... Cancer deaths in 2001: 550,000 I don't think it's fair to the families of the victims, to the people of NYC, or any peaceful, healthy person who has that threat in the back of their mind when minding their own business in public, to equate a cancer death with a death caused by a crumbling skyscraper, a burning skyscraper, or jumping out of a burning, crumbling skyscraper. I know c…

Neither is any less dead than the other. The cause matters only to the living. My entire point is that fear of the threat in the back of your mind is entirely irrational. You're much more likely to die of cancer, and even then, you're not very likely to die at all. The Stalin quote about "a single death is a tragedy, a million is a statistic" comes to mind here. I understand your point that terrorism is the result of…

But you have no real control over either, so why make such a big deal of the former?

Not true. Even thought they need to be much smarter about it, people with guns, whom our tax dollars fund and who's power and number I fear and would like to limit, can reduce the likelihood of a terrorist ruining my life. Scientists can do the same for cancer, but unfortunately, we have more people who can fight terrorism that who can fight cancer.

We can elect leaders are vote in the marketplace to shift resources one way or the other, or be a better cancer or terrorism fighter if we are in those fields. Our individual control might be negligible, but not society's.

Re: US and Israel created Stuxnet, lost control of it

#217

Post by lawnchair_larry » Fri, Jun 01, 2012, 7:21 PM UTC

gavinlynch wrote: post #175

The one part of the article that sticks out to me is that they "lost control" of the virus. I wonder if this is really true. Politically, it probably sounds better to say, "oops, this was only meant for Iran. Somebody messed up" than to have to field questions from reporters: "Why does the United States think it is okay to infect hundreds of thousands of computers with this virus?" "Is it ethical to introduce securit…

This is a good point. Being somewhat familiar with the code, but not enough to call this a provable lie, there is nothing I'm aware of that really fits this statement. No "error" that caused it to "leak". I don't think they wanted it to leak, but the design of it could only constrain it so much. It was intentionally designed to infect other computers in order to reach its target.

The other part that makes no sense to me is the bit about the "beacon" that would deliver info back to them over an air gap network. This is rather confusing and inconsistent with what has been seen from it, but it's not impossible.

But of course these statements went through several non-technical people and were written for a non-technical audience, so they might be based on something accurate and just sound funny.

Re: US and Israel created Stuxnet, lost control of it

#218

Post by FreakLegion » Fri, Jun 01, 2012, 7:24 PM UTC

tptacek wrote: post #165

dpeck wrote: post #155

It is anything but confirmed. Arstechnica writes an article about an article in the NYT (a paper that doesn't have the best track record reporting about cyber events and control system security issues to begin with) that cites no credible sources. Also, you don't "lose control" of something like this, it was designed with many ways to spread. If control was lost it was during the spec/coding phase, not after deployme…

When the New York Times prints: “Should we shut this thing down?” Mr. Obama asked, according to members of the president’s national security team who were in the room. It is generally safe to assume, whether you admire the NYT (like me) or don't (like 'patio11), that there's an actual source with a credible claim to have been in the room with the President who did in fact tell David E. Sanger that this happened. Peop…

Did your friends who thought it might have been a cover for direct sabotage not examine the code? I assume anyone working in InfoSec at least has access to the binaries. With an appropriate SCADA controller you can see it in action, too.

Edit: Actually it looks like these days anyone can grab RE'd source off the intarwebs, though I haven't checked to see if the downloads Google is feeding me are legitimate.

Re: US and Israel created Stuxnet, lost control of it

#219

Post by terangdom » Fri, Jun 01, 2012, 7:34 PM UTC

webXL wrote: post #171

Fizzadar wrote: post #140

Earlier quoted context omitted.

I would say that because it spread beyond Natanz it was a big fuck up :)

Yeah, but everyone knows we don't want them to get nukes. The rest of the world doesn't want them to get nukes. Iran would have discovered the highly specialized virus on their network. It was a fuck up that the media got confirmation of the virus creators, but everyone knew who was behind it from day one.

No, everyone did not know. Many had strong suspicions.

Re: US and Israel created Stuxnet, lost control of it

#220

Post by salimmadjd » Fri, Jun 01, 2012, 7:34 PM UTC

pivo wrote: post #168

salimmadjd wrote: post #128

Earlier quoted context omitted.

>> why would "The IAEA Board of Governors passed a resolution[186] by a vote of 32–2 Because of pressure from Israeli lobby. I follow this very carefully, and most of it is propaganda to provide impunity to Israel for current and future actions. The fact is, Iranian still unable to refine oil in industrial scale without outside help. Enriching U like any thing else becomes harder as you reach higher purity. US intell…

Just curious, isn't refining oil on an industrial scale easier than enriching uranium? Any idea why they are unable to do it?

I just don't think the they have the capability. The country is very nepotistic, so anyone in charge got their position because they knew someone rather than purely on merits. The regime is also rather paranoid, so probably they only promote within their own ranks. Combine all those and you get an ineffective bureaucracy. The best they could hope for is all the hype the western media is giving them. Their ability to grow their enrichment facility has basically halted.

But of course no one in media mentions that, because that goes against the narrative they want to play. That's until we go there and mess everything up, then we'll hear all these data the was there and everyone glossed over. Deja vu Iraq.