Live data from Hacker News

US and Israel created Stuxnet, lost control of it

arstechnica.com

261–270 of 321 posts

Re: US and Israel created Stuxnet, lost control of it

#261
post #170

"[Obama] repeatedly expressed concerns that any American acknowledgment that it was using cyberweapons—even under the most careful and limited circumstances—could enable other countries, terrorists or hackers to justify their own attacks. “We discussed the irony, more than once,” one of his aides said." "Irony" is the wrong word. It's "hypocrisy".

It isn't necessarily hypocrisy. It makes sense for them to be leery of acting without first talking about the limits they believe should be applied to cyberwarfare. A single act may be consistent with many different interpretations, and the United States could easily be blamed if one of their allies committed some heinous act and justified it using a doctrine they extrapolated from Stuxnet and other acts condoned or committed by the United States.

As an analogous example, parents, knowing that many people think in crude categories such as "drugs" and "illegal," would not simply pot in front of their children without explanation. They would not want to discover later that their kids were doing meth or shoplifting and hear, "What are you angry about? You smoked illegal drugs right in front of me. How is this different?" The parents would likely find themselves accused of hypocrisy, by their kids and by others who honestly or disingenuously failed to understand the distinctions the parents drew between smoking pot and doing meth, or smoking pot and shoplifting.

I don't know if the United States has an official stance on the acceptable use of cyberwarfare, but the fact that they chose to leak their involvement in Stuxnet rather than openly admit it and justify it suggests that they have no official policy to cite (though it may also be that they don't want to officially acknowledge responsibility for Stuxnet's collateral damage.) If there is no official articulation of policy, we really are setting unpredictable precedents that are likely to implicate us in future disasters.

Re: US and Israel created Stuxnet, lost control of it

#262
post #205

Earlier quoted context omitted.

You are leaving out a rather glaring example. Neither atomic bomb, dropped by the one and only country ever to use them, were dropped on military targets. The "Democracies" of the world kill many innocent civilians, an order of magnitude in fact than any terrorist related event if you really want to compare the two. Not because the people running them are cartoonishly evil or anything, it simply reflects the massive…

"I doubt it makes a difference to the populations affected whether they were an intentional target, or the gps on the smart bomb that just leveled your house glitched out." You're wrong. If an airliner (or even a weapon) goes astray and kills my family, I am going to be angry, no doubt about it. If you've deliberately targeted my family, my anger is going to be greater by several orders of magnitude. For example, thi…

That, as well as the story linked (which I read carefully), are really bad analogies, for what I think of obvious reasons.

I do think intent can matter at times. Perhaps what I'm more zeroing in on is that idea that I don't find saying you didn't mean to, when you repeatedly kill civilians in very large numbers, such that certain countries have a long history of being on the receiving end of American collateral damage, as an acceptable rational/excuse. (This last part is why I think you're examples are not particularly apt)

Your intent just stops mattering as much when the body count gets to a certain number and you show no signs of changing the behavior.

Re: US and Israel created Stuxnet, lost control of it

#263
post #154

Earlier quoted context omitted.

So... someone involved is going on the record? Someone who can do interviews on, you know, Fresh Air and say "I was involved in this project"? The fact that the NYT thinks it's true doesn't mean much, particularly since they've been punked so many times.

I assume if it wasn't true the administration would have held a press conference denouncing it by now.

On the other hand, they say a story can't be considered true until it's received an official denial.

Re: US and Israel created Stuxnet, lost control of it

#264
post #28

It's a new cold war. Eventually Iran will write viruses in return to attack US power grid. All fun and games until Homeland Security Theater is given new powers to raid your home and shoot your dog if they think your computer is being used as part of a botnet.

This isn't nearly as terrifying as the Cold War with the USSR. We're not threatened with nuclear war, nor having the near misses that could trigger it (Cuban missile crisis). No one is building bomb shelters in their backyards, because right now the balance of power is very much in the United States' favor. Could things get there with another nuclear enabled power like China? Maybe, in time. Iran is not an existentia…

I think it's more terrifying today. Who would have thought a small place like North Korea kill lots and lots of Americans? It may happen indirectly, via sharing nuke technology with Iran, who is buddy-buddy with Latin American countries, which may, by proxy, end up within striking distance of millions of Americans.

Re: US and Israel created Stuxnet, lost control of it

#265
post #261
post #170

"[Obama] repeatedly expressed concerns that any American acknowledgment that it was using cyberweapons—even under the most careful and limited circumstances—could enable other countries, terrorists or hackers to justify their own attacks. “We discussed the irony, more than once,” one of his aides said." "Irony" is the wrong word. It's "hypocrisy".

It isn't necessarily hypocrisy. It makes sense for them to be leery of acting without first talking about the limits they believe should be applied to cyberwarfare. A single act may be consistent with many different interpretations, and the United States could easily be blamed if one of their allies committed some heinous act and justified it using a doctrine they extrapolated from Stuxnet and other acts condoned or…

Also I am not at all sure that terrorists are going to care whether the US says they have used weapons like this. I would suggest that "we are worried about cybersecurity" is a much larger green light than "we are using cyberweapons."

I am not aware of the last time a terrorist attacked us with an F-15 or a B-2.....

The much larger issue though is that by releasing Stuxnet, the government had to release tools that terrorists could use into the wild. These can then be reverse compiled, hacked, and turned against us. That's bad news. It would be like leaving behind a large number of Predators or something in terrorist hands.

Actually it is worse than that. With actual airplanes, you have maintenance issues and costs, and the fact is that you have limited quantity and little ability to produce more. With Stuxnet, these limits are not there.

Re: US and Israel created Stuxnet, lost control of it

#266
post #106

Earlier quoted context omitted.

The physical terrorism threat is negligible. The generalized cheap-attack-with-disproportionate-damage threat I can't in good conscience write off quite so readily. Biological attacks are still scarily possible, and if we start talking computer viruses it becomes scarier again. Recall Stuxnet didn't merely inconvenience people, it destroyed hardware. If someone manages to write a virus that, say, destroys a significa…

Terrorist victims in 2001: 3,000 Murder victims in 2001: 15,000 Car collision fatalities in 2001: 42,000 Cancer deaths in 2001: 550,000 The only thing that's disproportionate is how we react to terrorism. (statistics are for United States)

While I agree that terrorism is given disproportionate attention (add car-collision fatalities in September 2001 as 3300 and it becomes even more useful comparison-wise), I also think it misses the point.

The sorts of terrorism we are afraid of tends to hype fear over risk. Take anthrax for example. Anthrax has been floated as a biological weapon because it's unlikely to spread back and contaminate one's own area, but experiments with weaponized anthrax shows an abysmally low rate of contracting the disease (between 0.1% and 1%) and so it's nearly exclusively a weapon of fear. The very things that make it attractive as a biological weapon also make it ineffective (no person-person transmission for example).

Similarly when we look at nerve gas attacks and the problems and sole case in history, it's clear these are relatively ineffective terrorism-wise. VX may be more effective than Sarin given high-tech dispersal systems but it's also very sensitive to things like droplet size and it's not volatile. Sarin, OTOH, is volatile meaning you can expect it to dissolve in the air and spread that way. Despite that, Aum Shinrikyo would have been more successful using plain old high explosives than nerve gas, and only one of their two nerve gas attacks (the one under entirely ideal circumstances) resulted in any fatalities whatsoever.

Nuclear terrorism could be significant but I suspect you'd have to blow up a small nuke in a major city every ten years to have an effect similar to car crashes nationally. I am sorry but I just don't see that happening so as long as I don't worry about getting behind the wheel I don't give that a second thought either.

All the above being said, cyberwar by non-state actors is different. Traditional terrorist attacks seek to cripple a society or socially disrupt it by killing people and making them afraid. I don't know that this necessarily has to be the intermediate goal of what people call cyber-terrorism (which is why I don't call it that). Instead it can disrupt society and hold it hostage by, well, disrupting it directly.

Imagine if power blackouts and communications infrastructure was disrupted repeatedly. Imagine if we suddenly the power grid were taken down repeatedly. What would be disrupted? How well could we recover? What if telecomunications infrastructure was attacked as well?

People would die but that's not really the goal. Just as in conventional terrorism deaths are a means to an end, sufficiently successful attackers could hold a society hostage by holding the infrastructure hostage.

Re: US and Israel created Stuxnet, lost control of it

#267
post #166

Earlier quoted context omitted.

Terrorist victims in 2001: 3,000 Murder victims in 2001: 15,000 Car collision fatalities in 2001: 42,000 Cancer deaths in 2001: 550,000 The only thing that's disproportionate is how we react to terrorism. (statistics are for United States)

Terrorist victims in 2001: 3,000 ... Cancer deaths in 2001: 550,000 I don't think it's fair to the families of the victims, to the people of NYC, or any peaceful, healthy person who has that threat in the back of their mind when minding their own business in public, to equate a cancer death with a death caused by a crumbling skyscraper, a burning skyscraper, or jumping out of a burning, crumbling skyscraper. I know c…

"Are you implying that we shouldn't react disproportionately?"

I would say that even when you factor in malicious intent we still react disproportionally, and that this is an inherent problem.

Any individual involved in any security-related field will have to work with the concept of acceptable risk at some point. The damage that terrorists can cause us is not that high compared to the way we victimize ourselves to try to prevent very modest harm.

Our reaction has become comparable to a cytokine storm in reaction to a flu virus, really. That can't be good.

Edit: As a side note, our reaction is such that it allows for what I call "grey-terrorism" vulnerabilities. If we define terrorism to only include acts which are violent or directly dangerous to human life, then leaving cardboard boxes marked "do not touch" in airport restrooms around the nation is not "terrorism." The act is not dangerous to human life. The act is not violent. The act however may be very disruptive to our airports, and it may be very good at inspiring terror.

Re: US and Israel created Stuxnet, lost control of it

#268
post #192
post #184

Earlier quoted context omitted.

Let me be clear: there is no evidence whatsoever that Iran has nuclear weapons in its possession. There is no evidence whatsoever that Iran has had an organized nuclear weapons development program for the last nine years. There is some evidence that there was a nuclear weapons program prior to 2003. This is where you start discussing things: with reality and facts. I am insulted that these facts I am offering are bei…

I don't know why I'm jumping in, but. Iran is enriching uranium. A lot of it. This is not disputed. Iran rattles their sabre a lot, and has large domestic oil production, both of those are also undisputed. ... So you're saying you believe their story that they're enriching uranium beyond where it needs to be for nuclear power, just so they can have nuclear power? Even though they already have more oil than they can s…

To answer your points in order:

1. Iran's sabre rattling is in response to the outright threats of invasion and/or military strikes by the US/Israel.

2. Iran has oil which is more economically valuable sold on the market and not burned in local power plants, arguing they have no right to nuclear power is silly.

3. Iran enriches up to 20% for use in medical research reactor that produces isotopes for cancer treatment, the entire process is monitored by the IAEA.

4. "All of the available evidence points towards their going for a nuclear weapon" Which rock have you emerged from and more importantly, was it comfortable there? The CIA itself not to mention some very high ranking retired or otherwise members of Israel's intelligence/military have clearly stated that they don't believe Iran has nukes or is working towards them, for e.g. see: http://www.bbc.co.uk/news/world-middle-east-17879744 and http://www.csmonitor.com/World/Backchannels/2012/0425/Israel...

5. They do "play ball" with the international community, they don't play ball with the US which has been threatening them for quite a while now even though it's own intelligence agency has said Iran is not pursuing a nuke. Unless of course "International Community" in your lexicon equals the US.

oh and just a piece of advice; you shouldn't jump in if you're going to parrot unsupported claims

Re: US and Israel created Stuxnet, lost control of it

#269
post #182

Earlier quoted context omitted.

"No open hostilities" is a definition by non-essentials. It's fallacious. As I already said and as you failed to address. Whether certain people happen to know whether there is an attack or who is behind it does not change anything. A state of knowledge does not change the reality: someone is planning and attacking.

If I had a downvote button, I would exercise it on your steadfast refusal to acknowledge that the Cold War is so-called for the absence of direct military conflict between the armies of the two quarreling states. Wikipedia does not back your definition, as the Wiki entry leaves room for espionage, sabotage, and other actions that one might consider an "attack" but certainly do not force a declaration of war, mobiliza…

Firstly, talking about Wiki definitions is the wrong thing to focus on.

Secondly, the Cold War is a misnomer, the US was very much involved in an open confrontation with the Chinese+Soviets in Korea, and to a lesser extent with their proxies in Vietnam later on.

Yes, the Korean war was fought under the aegis of a resolution issued by the UN security council, but it was a 'hot' war, and part of a broad push against Communist influence.

Re: US and Israel created Stuxnet, lost control of it

#270

The fact that the NYT published this piece is interesting. Assume all details are true. Why did the dog bark rather than choose to be silent? And the sources. Assume all of this is true? Why feed the info to the NYT? When coupled with recent revelations that Mr. Obama personally approves every killing of militants (for certain strained definitions of that term), the upcoming election springs to mind as a motivation.…

Former election strategist here. This is part of the Obama-Is-Tough roll-out, clearly done with current admin participation. Timed release to follow the "kill list" story and maybe even pre-empt the terrible jobs report. All the same, it's pretty stunning that the Obama administration would trade its (public) plausible deniability on Stuxnet in order to "look tough" on America's enemies. Playing fast and loose with f…

Agreed. I wonder if the people who leaked this information will be held responsible just the same as Thomas Drake & Jeffrey Sterling were/are.

For this to be included in the sudden wave of media coverage on Obama's tough stances on foreign conflicts/terrorism is pretty weighty regardless of motivation.

Post reply on HN