Stuxnet

[Gerald]

As long as you know what a worm as this is, so it is harmless,and is well protected in the system of society

[Skybird]

Originally Posted by Vendor

As long as you know what a worm as this is, so it is harmless,and is well protected in the system of society

This worm was anything but harmless, but the reuslt of a developement and desiogn work that must have costed millions and impossibly could have bene the work of just some gifted hackers doing it as a hobby. This worm was like one of these Russian puppets with more and more puppets inside of them - just theat the inner puppets became more and more complex and self-unfolding, and heading for very precisely defined key codes as present in certain industrial control software. It indeed compares to a description of having been the first massive use of cyberwarfare in known history. Whoever fired it up, meant serious business. Affected parts of industrial installations are still not cleared of the consequences from this strike, more than one year after the impact.


So, do not think of this thing like of just any worm we have by the dozens every day. This was a military major strike by use of a new weapon technology, plain and simple.

And that'S the reason why I do not think that Fiunland has anything to do with it, Happy Times. I also wonder if Finland has the will and the resources to invest into offensive capacities in this field. Like the German essay in the FAZ quoted an insider, this worm was of that kind that you only develope if oyu can invest, millions into carrying out such an attack, and when the alternative of not doing it would be - to launch a real war. That reduces the number of possible suspects very drastically, I would say.

[Gerald]

I know how it is 'destroyed' infrastructure, but I maintain that it was not of the severe variety, some countries had problems with the undeniable, and it is due to their lower security level

[Skybird]

Originally Posted by Vendor

I know how it is 'destroyed' infrastructure, but I maintain that it was not of the severe variety, some countries had problems with the undeniable, and it is due to their lower security level

No, I think you get that wrong. Most countries have no bigger troubles with it, because the woirm was designed to attack very specific industrial compounds in Iran, not globally. Other countries only got affected because there industrial intallations share parts fo the control software by for example Siemens that also are used by the Oranians, but these other coutries do not meet the full list of specifics of ther attack profile of this worm, which saved them from being attacked in full, too. When the worm impatced in Iran, that was at a time, early last year, when the Iranians massievly increased the total number of centrifuges, but although they did, the number of operational centrifuges dramatically went down. These complexes were one of the target descpritons of the attacking software, and since these c omplexes are somewhat unique to Iran, other countries were not affected in full by this "worm". Consider these minor sideffects as kind of collateral damage. But the Iranian industry - has not recovered until today, they are still fighting with this beast, and it still is biting them.

Think of it like this:


The smaller the puppet, the deeper inside other puppets it was hidden, but the more dangerous it became, and the more complex.

[Gerald]

Iran is not exactly known for having a high level of safety in these kinds of cases, and if they still fight with it as it is for them, however, the threat became a reality in other countries which are not also, I am not surprised,at all

[Skybird]

Originally Posted by Vendor

Iran is not exactly known for having a high level of safety in these kinds of cases, and if they still fight with it as it is for them, however, the threat became a reality in other countries which are not also, I am not surprised,at all

No, no other country was as effected as Iran. The attack was designed to hit Iran. All other countries only took tamed-down collateral damage. The software, so say analysts today, has been very cleverly designed to react to specifics of Iranian installations and their specific characteristics, that make them different to other nation'S installations using code by Siemens software as well, for example.

It's like the hopuse next to yours getting hit by a bomb. While yours is close to it, your house also may take some force from the blow, too. But that does not compare to the target house, that sees it'S very centre getting hit by the full blow of the bomb. The first takes damage, the latter takes much more damage or even gets destroyed.

[Gerald]

No, you're wrong, other countries became involved!

[Happy Times]

Originally Posted by Skybird

And that'S the reason why I do not think that Fiunland has anything to do with it, Happy Times. I also wonder if Finland has the will and the resources to invest into offensive capacities in this field. Like the German essay in the FAZ quoted an insider, this worm was of that kind that you only develope if oyu can invest, millions into carrying out such an attack, and when the alternative of not doing it would be - to launch a real war. That reduces the number of possible suspects very drastically, I would say.

I wasnt suggesting that Finland did it.

I was commenting your remark that European nations dont have the capability to do this and asking do you have info on that?

Finnish capacity is there if it needs offensive actions and i doubt it would cost millions, the article said it would require the work of 5-10 people and 6 months to a year to complete.

In Finland these people would be gathered from the military intelligence, universities and private companies in the interest of national security and just payed their normal salary or in times of war nothing, i dont know how others do this.

[TLAM Strike]

Originally Posted by Happy Times

I wasnt suggesting that Finland did it.

I was commenting your remark that European nations dont have the capability to do this and asking do you have info on that?

Finnish capacity is there if it needs offensive actions and i doubt it would cost millions, the article said it would require the work of 5-10 people and 6 months to a year to complete.

In Finland these people would be gathered from the military intelligence, universities and private companies in the interest of national security and just payed their normal salary or in times of war nothing, i dont know how others do this.

Nations? Militaries? There are some civilian groups that have such capabilities, all they require is the motivation.

[Happy Times]

Originally Posted by TLAM Strike

Nations? Militaries? There are some civilian groups that have such capabilities, all they require is the motivation.

I dont doubt that, we where just talking about nations capabilities.

[Happy Times]

Stuxnet Questions and Answers
http://www.f-secure.com/weblog/archives/00002040.html


In a Computer Worm, a Possible Biblical Clue
http://www.nytimes.com/2010/09/30/wo...nted=1&_r=2&hp

Myrtus is an allusion to the Hebrew word for Esther. The Book of Esther tells the story of a Persian plot against the Jews, who attacked their enemies pre-emptively.

Habib Elghanian
http://en.wikipedia.org/wiki/Habib_Elghanian

On May 9, 1979, Elghanian was executed by a firing squad in Tehran sending shock waves through the closely knit Iranian Jewish community. He was the first Jew and one of the first civilians to be executed by the new Islamic government[2]. This prompted the mass exodus of the once 100,000 member strong Jewish community of Iran which continues to this day.


Kudos to Israel, they still have a pair.

[SteamWake]

Originally Posted by Vendor

As long as you know what a worm as this is, so it is harmless,and is well protected in the system of society

Siemens SCADA systems are hardly 'well protected' or at least they werent. I dont think they foresaw this as an issue.

I recently had a discussion over communications protocal for a domestic water supply system. I boiled down to hardwired RS232 or wireless ethernet. The wireless is of course much cheaper and easier to program and maintain but has obvious security risks. These risks were pointed out. The end results? The cheaper route.

[Skybird]

Originally Posted by SteamWake

Siemens SCADA systems are hardly 'well protected' or at least they werent. I dont think they foresaw this as an issue.

I recently had a discussion over communications protocal for a domestic water supply system. I boiled down to hardwired RS232 or wireless ethernet. The wireless is of course much cheaper and easier to program and maintain but has obvious security risks. These risks were pointed out. The end results? The cheaper route.

If I would think too long about our cybersecurity of powerplants and powergrids, hospitals, industrial infrastructure, communication networks, etc, I would not find any sleep anymore. I really think that a determined and competent attacker with the needed ressources could completely shut down our complete systems and infrastructure and destroy them without needing to drop a single bomb. It is a nightmare scenario. I once heared an expert on cyber-warfare comparing it to the impact of a killer meteorit that affects all the globe.

Our world is more complex than ever before. And it is more vulnerable than ever before.