The Cellar - Malware hits industrial equipment

The Cellar (http://cellar.org/index.php)

- Technology (http://cellar.org/forumdisplay.php?f=7)

- - Malware hits industrial equipment (http://cellar.org/showthread.php?t=23629)

Malware hits industrial equipment

I'm posting this article about "malware" because experts are saying it was authored by a government, not some kid working in his basement.

BITS article

September 24, 2010, 8:41 pm
Malware Hits Computerized Industrial Equipment
By RIVA RICHMOND

Quote:

The technology industry is being rattled by a quiet and sophisticated
malicious software program that has infiltrated factory computers.
The malware, known as Stuxnet, was discovered by VirusBlokAda,
<snip>in mid July, at least several months after its creation.

Quote:

Security experts say Stuxnet attacked the software in specialized industrial control equipment
made by Siemens by exploiting a previously unknown hole in the Windows operating system.
The malware marks the first attack on critical industrial infrastructure
that sits at the foundation of modern economies.

Quote:

Eric Chien, the technical director of Symantec Security Response,
a security software maker that has studied Stuxnet, said it appears
that the malware was created to attack an Iranian industrial facility.
Security experts say that it was likely staged by a government or
government-backed group, in light of the significant expertise
and resources required to create it.

Quote:

“It’s impossible this was created by some teenager in his basement,”
Mr. Chien said. “The amount of resources and man hours to put this together,”
he said, show “it has to be something that was state originated.”

Oh, now I feel bad. No wonder Iran's leader has to lie about everything. He's got a virus!

Their speculating it's a nation state. It's using several previously unknown holes in windows. It migrates to computers that don't connect to the web. It's not just Iran, India, Malaysia and eastern Europe too. It does no harm unless it finds specific industrial controls, like the unauthorized Siemens controls, Russia sold to Iran.

Quote:

Originally Posted by xoxoxoBruce (Post 684976)

Their speculating it's a nation state. It's using several previously unknown holes in windows. It migrates to computers that don't connect to the web. It's not just Iran, India, Malaysia and eastern Europe too. It does no harm unless it finds specific industrial controls, like the unauthorized Siemens controls, Russia sold to Iran.

So maybe it was made and released by Siemens? You hack us, we hack you back?

Or are the machines about to take over for real?

Quote:

Originally Posted by ZenGum (Post 685019)

Or are the machines about to take over for real?

Didn't that happen at 2:14am on August 29, 1997?

Very "Ghost in the Shell" . . . (btw, a 15 year-old film)

Quote:

Originally Posted by xoxoxoBruce (Post 685023)

I'd bet on China.

Industry polls (professional estimations) put internet espionage and malware mostly from the US government (36%) and from the Chinese government (33% of the time).

Quote:

Originally Posted by ZenGum (Post 685019)

So maybe it was made and released by Siemens? You hack us, we hack you back?

IEEE Spectrum reported on the (suspected) complete compromise of the entire Greek telephone system. Hacking was that widespread and that serious a national security issue. The article did not even try to suggest who might have done it. List all the usual suspects.

From the NY Times of 25 Sept 2010:

Quote:

Iran Fights Malware Attacking Computers
Stuxnet, which computer experts say is a far cry from common computer malware that has affected the Internet for years. A worm is a self-replicating malware computer program. A virus is malware that infects its target by attaching itself to programs or documents.

Stuxnet, which was first publicly identified several months ago, is aimed solely at industrial equipment made by Siemens that controls oil pipelines, electric utilities, nuclear facilities and other large industrial sites. While it is not clear that Iran was the main target - the infection has also been reported in Indonesia, Pakistan, India and elsewhere - a disproportionate number of computers inside Iran appear to have been struck, according to reports by computer security monitors. ...

Based on what he knows of Stuxnet, Mr. Lewis said, the United States is "one of four or five places that could have done it - the Israelis, the British and the Americans are the prime suspects, then the French and Germans, and you can't rule out the Russians and the Chinese."

Quote:

Originally Posted by xoxoxoBruce (Post 685023)

I'd bet on China.

A quick glance at politics and the application of Occam's razor says US or Israel. If it really is a State.

Israel was my first thought, but energy hungry China has a big stake in keeping the middle east from blowing up, and an increasing investment in Africa, Greece and around the Mediterranean. It's a crap shoot at this point.

The thing that got me was other countries found it easy to remove with commercially available anti-virus programs. Does the UN embargo on Iran include Norton?

Quote:

Originally Posted by tw (Post 685088)

From the NY Times of 25 Sept 2010:

Quote:

Stuxnet, which was first publicly identified several months ago, is aimed solely at industrial equipment made by Siemens that controls oil pipelines, electric utilities, nuclear facilities and other large industrial sites.

Quote:

Originally Posted by xoxoxoBruce (Post 685142)

The thing that got me was other countries found it easy to remove with commercially available anti-virus programs. Does the UN embargo on Iran include Norton?

A surgical strike of this nature can have reconnaissance value in that previously unknown facilities of interest may be revealed through monitoring of internal message traffic about the strike's impact. Disruption may simply be a cover for this activity, especially since it is readily recoverable.

Quote:

Originally Posted by sexobon (Post 685169)

Surgical? Are you a disciple of pathetic myths constantly promoted by Air Force Generals?

We have two choices. First, negotiation now made so much more effective since America has restored relations with Russia, Turkey, some Caspian Sea nations, and other 'much more at risk' nations. That also means we have intelligence and covert options due to cooperation both inside and surrounding Iran.

Second, or we could attack. Since the number of sites are hundreds, many in virtually bomb proof locations, and maybe half remain secret, well, what are you going to bomb? An attack means troops on the ground. There is no other military option. That means virtually all intelligence and covert options are lost. A failed attack means things are far worse AND that America has no more options. That means American integrity - one of our greatest assets in the region - is lost. There is no military option without ground troops. In poker, it is called "all in".

You have listened to Turkey's Gul or Russian foreign diplomats discussing this problem? Now that Obama has restored relations with Russia, then Russia even canceled their air defense sale to Iran. And is rumored to have restored intelligence exchanges with America.

More important is Iran's problem getting materials and machines necessary to make parts to tolerances required to enrich uranium. And other problems implied by the above malware rumors.

How did we discover Qom? American intelligence was routinely reading e-mail from their scientists. These made possible because countries actually at risk (Jordan, Syria, Turkey, Russia, etc) are even more concerned. Why are they not complaining that America are not doing enough? Because we have little idea how successful the US government has been. Because countries at risk are in agreement with what the Obama administration has been doing.

Israel is a wild card due to a government (Likud) that is so extremist. Israeli actions could only make things worse unless their actions are done with the cooperation of Iranian neighbors and without American cooperation. Even the Israelis know they must also put troops (special forces) on the ground if using the military option.

Anyone promoting an American military option is their own fool. Not to be confused with something completely different - what in poker is called a "bluff". But again, that is why the only viable solution is found in negotiation (and covert operations made possible only if doing negotiation).

Depends on if we have help with that strike ...

Aliens have deactivated British and US nuclear missiles