Collarspace Discussion Forums


Home  Login  Search 

RE: Stuxnet "attackware" targeted malware


View related threads: (in this forum | in all forums)

Logged in as: Guest
 
All Forums >> [Community Discussions] >> Dungeon of Political and Religious Discussion >> RE: Stuxnet "attackware" targeted malware Page: <<   < prev  1 [2] 3   next >   >>
Login
Message << Older Topic   Newer Topic >>
RE: Stuxnet "attackware" targeted malware - 9/30/2010 8:49:52 AM   
DomKen


Posts: 19457
Joined: 7/4/2004
From: Chicago, IL
Status: offline
quote:

ORIGINAL: hertz
quote:

Not to mention that they ran the entire thing as a covert op with no leaks.  There's no way that a bunch of loosely organized terrorists could have pulled this one off.


Why not? Why even terrorists? It could be some IT student working from her bedroom. We don't know enough yet.

Writing this virus required
1) Finding an otherwise unknown vulnerability in the way USB devices work
2) Detailed knowldege of siemens industrial control products
3) Detailed knowledge of the precise industrial process to be attacked
4) Sophisticated encryption techniques

That's a very broad and unlikely skill set for a single individual. The size and sophistication of the software functionally rules out it being the work of a single coder.

(in reply to hertz)
Profile   Post #: 21
RE: Stuxnet "attackware" targeted malware - 9/30/2010 8:51:23 AM   
Termyn8or


Posts: 18681
Joined: 11/12/2005
Status: offline 		"A bit like their attack on the civilians on board the Mavi Marmara...

ROLF. Spoken like the anti-Semite you are. "
_______________________________________

I heard nothing about Arabs here. They're Semites like we are Americans.

I wish the Israel firsters would just move there if they love that fucking country more than their own. Go, fucking go.

Fuck this no criticism allowed bullshit. Their govenment makes even the second worst look like fucking Nirvana. Not Jews per se, but the Israeli government is full of real motherfuckers who'll step on anyone to get their way, even their supposed allies. We all fucking know it, unless we have blinders on. While I have no problem with Jews, I would rather make a deal with someone who just stabbed their own Mother 32 times than the government of Israel.

So if criticising Isreal's action makes me an anti-Semite, I want the shirt, the button, that hat and two bumpers stickers. (do we have yard signs yet ?)

T

(in reply to willbeurdaddy)
Profile   Post #: 22
RE: Stuxnet "attackware" targeted malware - 9/30/2010 12:05:31 PM   
Icarys


Posts: 5757
Status: offline
quote:

ORIGINAL: DomKen


quote:

ORIGINAL: hertz
quote:

Not to mention that they ran the entire thing as a covert op with no leaks.  There's no way that a bunch of loosely organized terrorists could have pulled this one off.


Why not? Why even terrorists? It could be some IT student working from her bedroom. We don't know enough yet.

Writing this virus required
1) Finding an otherwise unknown vulnerability in the way USB devices work
2) Detailed knowldege of siemens industrial control products
3) Detailed knowledge of the precise industrial process to be attacked
4) Sophisticated encryption techniques

That's a very broad and unlikely skill set for a single individual. The size and sophistication of the software functionally rules out it being the work of a single coder.


No it's not. Not exactly.. Once you have a certain level of skill...adapting to work in various other avenue's is just another curve..Not quite the bend one would imagine either.

Kevin Mitnik was an "all around" hacker that did everything from phreaking to social engineering software. His expertise was phone systems but he had a wide array of other skills which included computer virus's and BBS board hacks to the making of electronic devices which aided him in his attempts.

I believe he now writes for 2600.

Kind of a cool story, really. The feds went after him and at the time of his arrest they found out that he was using the same system that they were using to listen in on him to listen in on them. :> Which BTW is on every single phone system in an updated sister program at this very minute.

< Message edited by Icarys -- 9/30/2010 12:31:56 PM >

_____________________________

submission - the feeling of patient, submissive humbleness - the state of being submissive or compliant; meekness.

Alaska Bound-The Official Countdown Has Started!
http://tinyurl.com/872mcu3
http://alturl.com/mog7m

(in reply to DomKen)
Profile   Post #: 23
RE: Stuxnet "attackware" targeted malware - 9/30/2010 1:44:25 PM   
hertz


Posts: 1315
Joined: 8/7/2010
Status: offline
quote:

ORIGINAL: DomKen

Writing this virus required
1) Finding an otherwise unknown vulnerability in the way USB devices work
2) Detailed knowldege of siemens industrial control products
3) Detailed knowledge of the precise industrial process to be attacked
4) Sophisticated encryption techniques

That's a very broad and unlikely skill set for a single individual. The size and sophistication of the software functionally rules out it being the work of a single coder.



1. Writing almost any worm or virus requires knowledge of unknown vulnerabilities in computer software and hardware. This is, often enough, how these sorts of malware programmes work.

2. Detailed knowledge of Seimens industrial control products may be important, it may not. Certainly a knowledge of their vulnerability to attack is important. And it might be useful, although not necessary, to understand the real world mechanisms the software instruction set corresponds to. At this stage, we don't know enough about what is going on to be sure of much. The experts tell us that Stuxnet looks like it is precisely targeted at a specific plant configuration. If this is the case, I wonder why it is apparently causing problems in China, India, Iran and elsewhere? I suspect the reporting is somewhat ahead of the knowledge curve.

3. Knowledge of the precise industrial process to be attacked would be helpful if this were an attack on a specific installation. Unfortunately, the facts suggest it is attacking many different systems all around the world. Evidence that it was specifically designed to go for an Iranian target is not as watertight as many suggest.

4. Knowledge of the design and deployment of 'sophisticated encryption techniques' are two a penny in hacking circles.

I remember the Blaster worm. It caused chaos, and it was, for the period, easily as beautiful a piece of software design as Stuxnet is. But that was almost a decade ago. I seriously cannot see any reason, given the knowledge we have now, to assume that Stuxnet is beyond the reach of an individual or group with no state funding.

I still say the Jury is out.

(in reply to DomKen)
Profile   Post #: 24
RE: Stuxnet "attackware" targeted malware - 9/30/2010 1:49:41 PM   
Moonhead


Posts: 16520
Joined: 9/21/2009
Status: offline
quote:

ORIGINAL: DarkSteven

quote:

ORIGINAL: hertz

Wouldn't it be just too ironic if the real target is somewhere in the US, and all those people who are currently cheer-leading for the Zionists are about to discover that actually, a sneak attack of this sort could have some very real and unpleasant consequences for a civilian population?



Look, hertz, this is a bad situation any way you slice it.  I have been taking it for granted that Iran has been developing a nuclear weapon.  If so, then either Iran becomes a nuclear power, or else some nation, either Israel or the US, would bomb Iran and touch off God knows what in the Middle East.  Either outcome would be horrific.

I am tickled pink that there is another option.

And the folks who determined the target are pretty damn good.  They used espionage to determine what hardware and software is in the "reactor", and made code that is way more sophisticated than anything seen to date.  Not to mention that they ran the entire thing as a covert op with no leaks.  There's no way that a bunch of loosely organized terrorists could have pulled this one off.


Agree with the rest, but just Israel or the 'States? Half of the gulf's in deep shit if (say) Syria acquires nuclear capacity...

_____________________________

I like to think he was eaten by rats, in the dark, during a fog. It's what he would have wanted...
(Simon R Green on the late James Herbert)

(in reply to DarkSteven)
Profile   Post #: 25
RE: Stuxnet "attackware" targeted malware - 9/30/2010 1:59:03 PM   
hertz


Posts: 1315
Joined: 8/7/2010
Status: offline 		You know what we need? This

(in reply to Moonhead)
Profile   Post #: 26
RE: Stuxnet "attackware" targeted malware - 9/30/2010 2:45:56 PM   
Owner59


Posts: 17033
Joined: 3/14/2006
From: Dirty Jersey
Status: offline
quote:

ORIGINAL: willbeurdaddy


quote:

ORIGINAL: hertz

quote:

And, yes, I'm assuming that this emanated from Israel. It was done so professionally and effectively and quietly...


A bit like their attack on the civilians on board the Mavi Marmara...



ROLF. Spoken like the anti-Semite you are.



This, comming from a bigotted Islamaphobe......

People in glass houses......

_____________________________

"As for our common defense, we reject as false the choice between our safety and our ideals"

President Obama

(in reply to willbeurdaddy)
Profile   Post #: 27
RE: Stuxnet "attackware" targeted malware - 9/30/2010 2:50:54 PM   
hertz


Posts: 1315
Joined: 8/7/2010
Status: offline 		There's an interesting story here about a previous worm. A bit like Stuxnet, the initial thought was that it was an attack by a foreign intelligence agency, but further reflection once the dust had settled suggested otherwise.

quote:

In the fall of 2008, a variant of a three year-old, relatively-benign worm began winding its way through the U.S. military’s networks, spread by troops using thumb drives and other removable storage media. Now, the Pentagon says the infiltration — first reported by Danger Room — was a deliberate attack, launched by foreign spies. It’s a claim that some of the troops who worked to contain the worm are finding hard to back up.

The worm, dubbed agent.btz, caused the military’s network administrators major headaches. It took the Pentagon nearly 14 months of stop and go effort to clean out the worm — a process the military called “Operation Buckshot Yankee.” The endeavor was so tortuous that it helped lead to a major reorganization of the armed forces’ information defenses, including the creation of the military’s new Cyber Command.



EDITED: To tidy up a clumsy sentence and a speeeeeling mistrake.


< Message edited by hertz -- 9/30/2010 2:54:42 PM >

(in reply to hertz)
Profile   Post #: 28
RE: Stuxnet "attackware" targeted malware - 9/30/2010 2:57:37 PM   
Owner59


Posts: 17033
Joined: 3/14/2006
From: Dirty Jersey
Status: offline 		Cyber War: The Next Threat to National Security and What to Do About It ...by Richard Clarke

http://www.amazon.com/Cyber-War-Threat-National-Security/dp/0061962236/ref=sr_1_1?s=books&ie=UTF8&qid=1285883275&sr=1-1#_

This is definitley part of the future`s battle grounds and thank god we`re on it.We have to win those battles and protect against attacks.

_____________________________

"As for our common defense, we reject as false the choice between our safety and our ideals"

President Obama

(in reply to hertz)
Profile   Post #: 29
RE: Stuxnet "attackware" targeted malware - 9/30/2010 3:03:53 PM   
hertz


Posts: 1315
Joined: 8/7/2010
Status: offline 		Dumping Windoze for Linux would be an excellent start. Which raises another interesting thought. If large organisations and military organisations gave up on Windoze and went for something more secure, this sort of attack would be much less likely to happen.

(in reply to Owner59)
Profile   Post #: 30
RE: Stuxnet "attackware" targeted malware - 9/30/2010 3:15:43 PM   
ScaryJello


Posts: 103
Joined: 10/19/2006
Status: offline
quote:

ORIGINAL: hertz

4. Knowledge of the design and deployment of 'sophisticated encryption techniques' are two a penny in hacking circles.



Ummmm not really. The high level encryption techniques used in reactors, military and governmental level systems is quite advanced. The knowledge required to be able to reverse engineer and bypass such encryption in such a fashion as to not trigger any alarms, while not rare, is not "two a penny."

quote:

ORIGINAL: hertz

Dumping Windoze for Linux would be an excellent start. Which raises another interesting thought. If large organisations and military organisations gave up on Windoze and went for something more secure, this sort of attack would be much less likely to happen.



Windows is common on many government computers, however the attacks used in this worm are not windows specific as the USB protocols are virtually the same on each operating system.

Switching to Linux won't solve the issue either. I am a big fan of the *Nix systems and run several myself, however they have a steeper learning curve and they don't have the ability to work on the same variety of projects as a windows machine, at least right out of the box. The next issue for switching to Linux would be determining which flavor to use. Mint, Solaris, Linux, Unix, Gentoo. The list goes on and on. All with different capabilities and learning curves.

_____________________________

twitter: http://twitter.com/thescaryjello

blog: http://scaryjello.blogspot.com/

stories: http://scaryjello.wordpress.com/

(in reply to hertz)
Profile   Post #: 31
RE: Stuxnet "attackware" targeted malware - 9/30/2010 3:19:05 PM   
Hippiekinkster


Posts: 5512
Joined: 11/20/2007
From: Liechtenstein
Status: offline 		Never mind, Ken. It's evident the link to Langner wasn't read by most. They think this is some kid sitting around in Maw and Paw's basement.

_____________________________

"We are convinced that freedom w/o Socialism is privilege and injustice, and that Socialism w/o freedom is slavery and brutality." Bakunin

“Nothing we do, however virtuous, can be accomplished alone; therefore we are saved by love.” Reinhold Ne

(in reply to hertz)
Profile   Post #: 32
RE: Stuxnet "attackware" targeted malware - 9/30/2010 3:24:58 PM   
ScaryJello


Posts: 103
Joined: 10/19/2006
Status: offline
quote:

ORIGINAL: Icarys

No it's not. Not exactly.. Once you have a certain level of skill...adapting to work in various other avenue's is just another curve..Not quite the bend one would imagine either.


Yes it is a steep learning curve to switch from one of those areas to another. The amount of knowledge that a single person would have to have would be akin to someone being able to play professional baseball, golf, football and be a world class archer. Sure it is possible to find someone who can do that, but it is easier and more efficient to bring in people who are experts in the individual fields and have them work jointly on the project.

quote:


Kevin Mitnik was an "all around" hacker that did everything from phreaking to social engineering software. His expertise was phone systems but he had a wide array of other skills which included computer virus's and BBS board hacks to the making of electronic devices which aided him in his attempts.

I believe he now writes for 2600.


Okay. Kevin Mitnick is not an incredible hacker. His technical skills were not anywhere near the top of the crowd even back in his hey-day. Kevin Mitnick is first and fore most a Social Engineer. He had goo basic skills, but relied mostly upon Social engineering to access systems and obtain the information needed to fool the networks.

Also so far as I know he does not write for 2600. Especially since I don't believe there are any staff writers for that magazine. Most of the articles are submitted by readers and professionals in the computer field. It is akin to a journal of psychiatry where the articles come from professionals as opposed to staff members.


He had a cool story and got lots of coverage, but there are far cooler hackers out there to look at. Captain Crunch, Eric Corley and Gary McKinnon. Not to mention the number of white hat hackers out there.

_____________________________

twitter: http://twitter.com/thescaryjello

blog: http://scaryjello.blogspot.com/

stories: http://scaryjello.wordpress.com/

(in reply to Icarys)
Profile   Post #: 33
RE: Stuxnet "attackware" targeted malware - 9/30/2010 3:26:24 PM   
ScaryJello


Posts: 103
Joined: 10/19/2006
Status: offline 		Thanks for the link. Seeing that sort of code always reminds me why I prefer to stay in the consumer world of programming as opposed to the machine and assembly level code.

_____________________________

twitter: http://twitter.com/thescaryjello

blog: http://scaryjello.blogspot.com/

stories: http://scaryjello.wordpress.com/

(in reply to Hippiekinkster)
Profile   Post #: 34
RE: Stuxnet "attackware" targeted malware - 9/30/2010 3:40:55 PM   
hertz


Posts: 1315
Joined: 8/7/2010
Status: offline
quote:

ORIGINAL: ScaryJello

quote:

ORIGINAL: hertz

4. Knowledge of the design and deployment of 'sophisticated encryption techniques' are two a penny in hacking circles.



Ummmm not really. The high level encryption techniques used in reactors, military and governmental level systems is quite advanced. The knowledge required to be able to reverse engineer and bypass such encryption in such a fashion as to not trigger any alarms, while not rare, is not "two a penny."


Although this is true, in relation to Stuxnet, my understanding is that the mention of encryption relates only to the way the worm's dlls are encrypted. Almost anyone with an expertise in hacking could encrypt a dll using readily available tools. It doesn't require the resources of a state to do this.

Stuxnet is not decrypting any 'foreign' code (foreign to itself) on the fly - it doesn't need to. My understanding is that the systems it is apparently able to affect are not protected by any serious encryption. Obviously, if it were breaking encrypted resources as a part of its operation, then this would be serious cause for concern, and might imply more than a hacking group is involved. But as far as I am aware, this is not the case.

I didn't mean to imply that the knowledge of how to break encryption protocols is widespread, only that the ability to deploy encryption protocols is well understood by many people.


quote:

quote:

ORIGINAL: hertz

Dumping Windoze for Linux would be an excellent start. Which raises another interesting thought. If large organisations and military organisations gave up on Windoze and went for something more secure, this sort of attack would be much less likely to happen.



Windows is common on many government computers, however the attacks used in this worm are not windows specific as the USB protocols are virtually the same on each operating system.


That explains the vulnerability which allows the worm entry to computer systems. It doesn't explain the worm's ability to act. Stuxnet is a windows-dependent worm, AFAIK.

quote:

Switching to Linux won't solve the issue either.


Doesn't solve the vulnerability to code entry perhaps, but certainly Linux is more secure than Windows and is unlikely to allow code to run without permission in the way windows seems very prone to.




(in reply to ScaryJello)
Profile   Post #: 35
RE: Stuxnet "attackware" targeted malware - 9/30/2010 5:25:31 PM   
Icarys


Posts: 5757
Status: offline
quote:

Yes it is a steep learning curve to switch from one of those areas to another. The amount of knowledge that a single person would have to have would be akin to someone being able to play professional baseball, golf, football and be a world class archer. Sure it is possible to find someone who can do that, but it is easier and more efficient to bring in people who are experts in the individual fields and have them work jointly on the project.

That was my point. There ARE people out there that have the capabilities to pull it off...Whether it was more than one person..Well we don't know that yet but I would guess it was.

quote:

Okay. Kevin Mitnick is not an incredible hacker. His technical skills were not anywhere near the top of the crowd even back in his hey-day. Kevin Mitnick is first and fore most a Social Engineer. He had goo basic skills, but relied mostly upon Social engineering to access systems and obtain the information needed to fool the networks.

Also so far as I know he does not write for 2600. Especially since I don't believe there are any staff writers for that magazine. Most of the articles are submitted by readers and professionals in the computer field. It is akin to a journal of psychiatry where the articles come from professionals as opposed to staff members.


He had a cool story and got lots of coverage, but there are far cooler hackers out there to look at. Captain Crunch, Eric Corley and Gary McKinnon. Not to mention the number of white hat hackers out there.


Did I say he was incredible? I just said he was an "all around"..meaning well rounded. He actually dabbled more in phreaking but yes he was also well known  for social engineering. As for everything else...It's all subjective but I'm sure there are people better than him and Captain Crunch was most likely one of them although there's not a lot of info on him. He was more or less the Father of phreaking..that doesn't make him a super phone hacker..it only makes hi one of the first.

As for Mitnick writing..It may have been wired.com...I've read a couple of articles just can't remember where they were. :>

I've read a couple of books on Mitnick that's why he came to mind when Ken said what he did.


_____________________________

submission - the feeling of patient, submissive humbleness - the state of being submissive or compliant; meekness.

Alaska Bound-The Official Countdown Has Started!
http://tinyurl.com/872mcu3
http://alturl.com/mog7m

(in reply to ScaryJello)
Profile   Post #: 36
RE: Stuxnet "attackware" targeted malware - 9/30/2010 9:11:49 PM   
DomKen


Posts: 19457
Joined: 7/4/2004
From: Chicago, IL
Status: offline 		If stuxnet was encrypted using over the counter tools then it would already be fully decrypted and reverse engineered. Since it is being decrypted by hand by the top people in the field that tells me, a professional software developer with 20+ years experience, that this isn't an over the counter encryption technique.

This program is designed to violate both the security of USB and of the siemens indsutrial controllers in ways not previously known. one hacker might find an unknown vulnerability but 2?

The people disassembling this thing are quite sure it is lokking for a single specific industrial process. The "payload" is keyed to only be activated on that specific system and to do very specific things to that system. That requires in depth knowledge of that industrial process.

As I said above this is extremely unlikely to be a single p[erson. The skillset is too broad and the program is too big and too sophisticated to be a single coders effort.

(in reply to Icarys)
Profile   Post #: 37
RE: Stuxnet "attackware" targeted malware - 10/1/2010 2:57:08 AM   
hertz


Posts: 1315
Joined: 8/7/2010
Status: offline
quote:

If stuxnet was encrypted using over the counter tools then it would already be fully decrypted and reverse engineered.


Not necessarily. One of the great joys of encryption is that even if someone tells you exactly which algorithm was used, without the key, it's very difficult to reverse the process back to the original.

quote:

The people disassembling this thing are quite sure it is lokking for a single specific industrial process. The "payload" is keyed to only be activated on that specific system and to do very specific things to that system.


There have been some reports saying this, yes. There have been some reports suggesting that it has attacked many systems using WinCC and Seimens software.

quote:

As I said above this is extremely unlikely to be a single p[erson. The skillset is too broad and the program is too big and too sophisticated to be a single coders effort.


It's a big leap from here to the suggestion that a rogue state such as Israel released the worm. Single person, small group of hackers, state - no-one knows at this point.

(in reply to DomKen)
Profile   Post #: 38
RE: Stuxnet "attackware" targeted malware - 10/1/2010 4:28:23 AM   
DomKen


Posts: 19457
Joined: 7/4/2004
From: Chicago, IL
Status: offline
quote:

ORIGINAL: hertz

quote:

If stuxnet was encrypted using over the counter tools then it would already be fully decrypted and reverse engineered.


Not necessarily. One of the great joys of encryption is that even if someone tells you exactly which algorithm was used, without the key, it's very difficult to reverse the process back to the original.

They have the keys. They have to be built into the code in order for the software to decrypt itself. That's why systems that encrypt/decrypt themselves can be reverse engineered at all.
quote:

quote:

The people disassembling this thing are quite sure it is lokking for a single specific industrial process. The "payload" is keyed to only be activated on that specific system and to do very specific things to that system.


There have been some reports saying this, yes. There have been some reports suggesting that it has attacked many systems using WinCC and Seimens software.

The reports are that it has infected a lot of systems and there are reports that the size of the program has caused problems in some systems. There have been no credible reports of the virus payload being activated.

quote:

quote:

As I said above this is extremely unlikely to be a single p[erson. The skillset is too broad and the program is too big and too sophisticated to be a single coders effort.


It's a big leap from here to the suggestion that a rogue state such as Israel released the worm. Single person, small group of hackers, state - no-one knows at this point.

Who said Israel is a rogue state in the first place? Secondly the entire point I'm making is that a single individual is extremely unlikely.

(in reply to hertz)
Profile   Post #: 39
RE: Stuxnet "attackware" targeted malware - 10/1/2010 4:43:41 AM   
thishereboi


Posts: 14463
Joined: 6/19/2008
Status: offline
quote:


This, comming from a bigotted Islamaphobe......

People in glass houses......


Just to clarify...so you are saying if someone is bigoted themselves, say against the conservatives, then they shouldn't be running around calling other people bigots. Is that what you are saying there?


_____________________________

"Sweetie, you're wasting your gum" .. Albert


This here is the boi formerly known as orfunboi


(in reply to Owner59)
Profile   Post #: 40
Page:   <<   < prev  1 [2] 3   next >   >>
All Forums >> [Community Discussions] >> Dungeon of Political and Religious Discussion >> RE: Stuxnet "attackware" targeted malware Page: <<   < prev  1 [2] 3   next >   >>
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts




Collarchat.com © 2025
Terms of Service Privacy Policy Spam Policy

0.156