Stuxnet virus targeting Iran's Nuclear facilities

[GostHacked]

The difference with the virus is that it is designed to specifically target a certain type of control system. Not simple hackers, it's much more than that. Speculation it was state sponsored, and the two suspects are the USA and Israel.

It makes sense that Israel is behind it, because they will do what they can to prevent Iran from putting their nuclear facility online. As evidence, we can use Iraq and Syria as examples. Israel targeted and destroyed those facilities it deemed a threat to the state.

The virus was not designed to monitor or steal data, it was very specifically designed to target very specific systems.

The real danger is that if something went wrong, the whole thing can go Chernobyl.

Edited September 29, 2010 by GostHacked

[M.Dancer]

The real danger is that if something went wrong, the whole thing can go Chernobyl.

Here's hoping...

[TimG]

The real danger is that if something went wrong, the whole thing can go Chernobyl.

Not very likely. This particular attack required detailed knowledge of the systems it infected. People with this kind of knowledge would also know how to disable a reactor without triggering a major incident. If we assume that it was state sponsored attempt to disrupt Iran's nuke program then it is unlikely that the sponsors wanted a major incident since the virus was going to be discovered eventually.

[GostHacked]

Not very likely. This particular attack required detailed knowledge of the systems it infected. People with this kind of knowledge would also know how to disable a reactor without triggering a major incident. If we assume that it was state sponsored attempt to disrupt Iran's nuke program then it is unlikely that the sponsors wanted a major incident since the virus was going to be discovered eventually.

I think you fail to understand how a worm virus works. Once released, you will have a hard time or an impossible time removing the virus or controlling what it does after it's release. Worms mutate by design, and it seems that one Russian scientist there had his laptop infected and that end up transferring to other systems and eventually online. All nuke and infrastructure facilities are on their own isolated network not tied into the net.

And can you guarantee me that one of these facilities won't go Chernobyl when infected by a specifically designed virus?

[TimG]

Worms mutate by design

Not unless that is what is desired by the creator. In this case, the creator wished to sabotage specific systems which the creator understood very well. They would not need to program the need for mutation.

And can you guarantee me that one of these facilities won't go Chernobyl when infected by a specifically designed virus?

Sure. All they would need to do fake critical alarms when there are none. This would force the operators to shut down the reactor for safety reasons. If the objective was to disrupt Iran's nuke program then regular unscheduled outages would acheive that goal.

[bush_cheney2004]

...And can you guarantee me that one of these facilities won't go Chernobyl when infected by a specifically designed virus?

This is an odd question, as Chernobyl certainly did not require a virus or worm at all. What we can speculate is that plant disruption or forced reduction in power levels is far different than effective disabling of a fail-safe design. So if a Siemens controller is compromised it can fail in a specific way that should already be known and accounted for with interlocks, redundancy, mechanical or electrical limiters, etc., etc. If Iran's plant is not designed and constructed with such safeguards and isolation (as described above), then the risk is far higher, regardless of web viruses.

Decisions and actions by nuclear power plant operators are still the higher potential risk event.

[Wild Bill]

I think you fail to understand how a worm virus works. Once released, you will have a hard time or an impossible time removing the virus or controlling what it does after it's release. Worms mutate by design, and it seems that one Russian scientist there had his laptop infected and that end up transferring to other systems and eventually online. All nuke and infrastructure facilities are on their own isolated network not tied into the net.

And can you guarantee me that one of these facilities won't go Chernobyl when infected by a specifically designed virus?

I think you fail to understand how the Chernobyl failure worked! That reactor had far less computer control than those designed by other countries. Things were mostly done manually. Political officers wanted to run a test for political reasons that was deemed unsafe by the technical staff. That staff was over-ridden and the result was a catastrophic failure.

Nobody ever built their reactors Chernobyl-style but the Russians and nobody would ever let a political officer over-ride the technicians and engineers but the Russians at that time in their history. Other reactors couldn't fail in a Chernobyl fashion because their very design is like a canvas bucket of water boiling over a fire. If the bucket fails the water douses the fire!

The Russian system was run by ideological idiots, who thought that politics trumped physics. What happened was a tragedy but they did it to themselves.

So unless the Iranians are similar idiots a Chernobyl failure is pretty well guaranteed NOT to happen! What's more likely is that the reactor will simply not work and keep shutting down, likely in an expensive and messy manner but NOT dangerous outside of the reactor!

Edited September 29, 2010 by Wild Bill

[RNG]

I think you fail to understand how the Chernobyl failure worked! That reactor had far less computer control than those designed by other countries. Things were mostly done manually. Political officers wanted to run a test for political reasons that was deemed unsafe by the technical staff. That staff was over-ridden and the result was a catastrophic failure.

Nobody ever built their reactors Chernobyl-style but the Russians and nobody would ever let a political officer over-ride the technicians and engineers but the Russians at that time in their history. Other reactors couldn't fail in a Chernobyl fashion because their very design is like a canvas bucket of water boiling over a fire. If the bucket fails the water douses the fire!

The Russian system was run by ideological idiots, who thought that politics trumped physics. What happened was a tragedy but they did it to themselves.

So unless the Iranians are similar idiots a Chernobyl failure is pretty well guaranteed NOT to happen! What's more likely is that the reactor will simply not work and keep shutting down, likely in an expensive and messy manner but NOT dangerous outside of the reactor!

Bummer. I was hoping the US or Israel could smuggle in a small nuke to the site, initiate it and claim the Iranians messed up and it went Chernobyl. Facts suck.

[GostHacked]

Guess I called it. Looks it was Israel with help from the US.

http://www.foxnews.com/scitech/2011/01/16/report-israel-tested-worm-linked-iran-atom-woes/

In what the Times described as a joint Israeli-U.S. effort to undermine Iran's nuclear ambitions, it said the tests of the destructive Stuxnet worm had occurred over the past two years at the heavily guarded Dimona complex in the Negev desert.

The newspaper cited unidentified intelligence and military experts familiar with Dimona who said Israel had spun centrifuges virtually identical to those at Iran's Natanz facility, where Iranian scientists are struggling to enrich uranium.

"To check out the worm, you have to know the machines," an American expert on nuclear intelligence told the newspaper. "The reason the worm has been effective is that the Israelis tried it out."

[Jack Weber]

Guess I called it. Looks it was Israel with help from the US.

http://www.foxnews.com/scitech/2011/01/16/report-israel-tested-worm-linked-iran-atom-woes/

Good...

Perhaps they could team up and do this the North Korea?

[Shady]

You know who you can thank for the Stuxnet virus? This man ----> PIC

God bless you sir!

[GostHacked]

You know who you can thank for the Stuxnet virus? This man ----> PIC

God bless you sir!

Why?

[bloodyminded]

Here's hoping [that the whole thing will go Chernobyl]...

Ah, that's sweet.

[dre]

I think you fail to understand how a worm virus works. Once released, you will have a hard time or an impossible time removing the virus or controlling what it does after it's release

That depends on the system. Worms are not necessarily hard to remove... this one targets a very specific industrial control system... a specific piece of hardware. The vendor most likely already has a patch, and Id be really suprised if this set Iran back more than a few weeks/months.

[GostHacked]

That depends on the system. Worms are not necessarily hard to remove... this one targets a very specific industrial control system... a specific piece of hardware. The vendor most likely already has a patch, and Id be really suprised if this set Iran back more than a few weeks/months.

And now that is seems the Stuxnet virus has been released into the wild on the Internet, you can expect more issues. Most power stations are off the internet grid so there is little risk to them unless you do to them what was done to Iran. Someone had to infiltrate the site and manually load the virus from a memory stick or a cd/dvd possibly onto the network.

The problem with developing a computer virus is that it can and most likely will come back to haunt you.

[eyeball]

The problem with developing a computer virus is that it can and most likely will come back to haunt you.

Yep, just like interfering with the internal affairs of another country does, like Iran for example.

Edited January 21, 2011 by eyeball

[Shady]

Yep, just like interfering with the internal affairs of another country does, like Iran for example.

Or just like the way Iran interferes with the internal affairs of other countries.

[Shady]

Why?

The Stuxnet program was instituted by one George W Bush. Or Bushitler as many on the left lovingly refered to him.

[dre]

And now that is seems the Stuxnet virus has been released into the wild on the Internet, you can expect more issues. Most power stations are off the internet grid so there is little risk to them unless you do to them what was done to Iran. Someone had to infiltrate the site and manually load the virus from a memory stick or a cd/dvd possibly onto the network.

The problem with developing a computer virus is that it can and most likely will come back to haunt you.

If its a problem to other systems then they will have to patch for it as well. But from what I read it targets a very specific industrial control system by a specific manufacturer. So only plants that use that specific system would be exposed.

[eyeball]

Or just like the way Iran interferes with the internal affairs of other countries.

Well, yeah. It shouldn't be any surprise that when someone deliberately infects you with a disease that you might show some of the same symptoms...but apparently you are, surprised that is.

Edited January 21, 2011 by eyeball

[TimG]

If its a problem to other systems then they will have to patch for it as well. But from what I read it targets a very specific industrial control system by a specific manufacturer. So only plants that use that specific system would be exposed.

Only plants that used the system and did not bother to change the default admin password. Even the best software can be defeated by human error.

[dre]

Only plants that used the system and did not bother to change the default admin password. Even the best software can be defeated by human error.

In any case my guess is the manufacturer is working on a patch around the clock. This type of problem gets solved many thousands of times per year. Theres a whole industry built around it.

[GostHacked]

Or just like the way Iran interferes with the internal affairs of other countries.

So nothing like risking escalation of interfering with other countries by preemptive interference. Who's doing who?

[eyeball]

So nothing like risking escalation of interfering with other countries by preemptive interference. Who's doing who?

Who's doing who again you mean.

[dre]

The more that security experts review the code, the less likely it seems that this was a plot by the west. Iv read a few articles in the last few days that actually claim the worm was not very well made, and that rookie mistakes lead to its early detection.

Parker wrote a tool that analyzed similarities between the Stuxnet code and the code of some other well-known worms and applications and found that the code was fairly low quality.

http://threatpost.com/en_us/blogs/stuxnet-authors-made-several-basic-errors-011811

Edited January 22, 2011 by dre