Author
|
Topic: Israel Tests on Worm Called Crucial in Iran Nuclear Delay (Read 1432 times) |
|
Walter Watts
Archon
Gender: 
Posts: 1571
Reputation: 8.60
Rate Walter Watts
Just when I thought I was out-they pull me back in
  
|
 |
Israel Tests on Worm Called Crucial in Iran Nuclear Delay
« on: 2011-01-15 22:06:21 » |
 |
January 15, 2011
Israel Tests on Worm Called Crucial in Iran Nuclear Delay
By WILLIAM J. BROAD, JOHN MARKOFF and DAVID E. SANGER
The Dimona complex in the Negev desert is famous as the heavily guarded heart of Israel’s never-acknowledged nuclear arms program, where neat rows of factories make atomic fuel for the arsenal.
Over the past two years, according to intelligence and military experts familiar with its operations, Dimona has taken on a new, equally secret role — as a critical testing ground in a joint American and Israeli effort to undermine Iran’s efforts to make a bomb of its own.
Behind Dimona’s barbed wire, the experts say, Israel has spun nuclear centrifuges virtually identical to Iran’s at Natanz, where Iranian scientists are struggling to enrich uranium. They say Dimona tested the effectiveness of the Stuxnet computer worm, a destructive program that appears to have wiped out roughly a fifth of Iran’s nuclear centrifuges and helped delay, though not destroy, Tehran’s ability to make its first nuclear arms.
“To check out the worm, you have to know the machines,” said an American expert on nuclear intelligence. “The reason the worm has been effective is that the Israelis tried it out.”
Though American and Israeli officials refuse to talk publicly about what goes on at Dimona, the operations there, as well as related efforts in the United States, are among the newest and strongest clues suggesting that the virus was designed as an American-Israeli project to sabotage the Iranian program.
In recent days, the retiring chief of Israel’s Mossad intelligence agency, Meir Dagan, and Secretary of State Hillary Rodham Clinton separately announced that they believed Iran’s efforts had been set back by several years. Mrs. Clinton cited American-led sanctions, which have hurt Iran’s ability to buy components and do business around the world.
The gruff Mr. Dagan, whose organization has been accused by Iran of being behind the deaths of several Iranian scientists, told the Israeli Knesset in recent days that Iran had run into technological difficulties that could delay a bomb until 2015. That represented a sharp reversal from Israel’s long-held argument that Iran was on the cusp of success.
The biggest single factor in putting time on the nuclear clock appears to be Stuxnet, the most sophisticated cyberweapon ever deployed.
In interviews over the past three months in the United States and Europe, experts who have picked apart the computer worm describe it as far more complex — and ingenious — than anything they had imagined when it began circulating around the world, unexplained, in mid-2009.
Many mysteries remain, chief among them, exactly who constructed a computer worm that appears to have several authors on several continents. But the digital trail is littered with intriguing bits of evidence.
In early 2008 the German company Siemens cooperated with one of the United States’ premier national laboratories, in Idaho, to identify the vulnerabilities of computer controllers that the company sells to operate industrial machinery around the world — and that American intelligence agencies have identified as key equipment in Iran’s enrichment facilities.
Seimens says that program was part of routine efforts to secure its products against cyberattacks. Nonetheless, it gave the Idaho National Laboratory — which is part of the Energy Department, responsible for America’s nuclear arms — the chance to identify well-hidden holes in the Siemens systems that were exploited the next year by Stuxnet.
The worm itself now appears to have included two major components. One was designed to send Iran’s nuclear centrifuges spinning wildly out of control. Another seems right out of the movies: The computer program also secretly recorded what normal operations at the nuclear plant looked like, then played those readings back to plant operators, like a pre-recorded security tape in a bank heist, so that it would appear that everything was operating normally while the centrifuges were actually tearing themselves apart.
The attacks were not fully successful: Some parts of Iran’s operations ground to a halt, while others survived, according to the reports of international nuclear inspectors. Nor is it clear the attacks are over: Some experts who have examined the code believe it contains the seeds for yet more versions and assaults.
“It’s like a playbook,” said Ralph Langner, an independent computer security expert in Hamburg, Germany, who was among the first to decode Stuxnet. “Anyone who looks at it carefully can build something like it.” Mr. Langner is among the experts who expressed fear that the attack had legitimized a new form of industrial warfare, one to which the United States is also highly vulnerable.
Officially, neither American nor Israeli officials will even utter the name of the malicious computer program, much less describe any role in designing it.
But Israeli officials grin widely when asked about its effects. Mr. Obama’s chief strategist for combating weapons of mass destruction, Gary Samore, sidestepped a Stuxnet question at a recent conference about Iran, but added with a smile: “I’m glad to hear they are having troubles with their centrifuge machines, and the U.S. and its allies are doing everything we can to make it more complicated.”
In recent days, American officials who spoke on the condition of anonymity have said in interviews that they believe Iran’s setbacks have been underreported. That may explain why Mrs. Clinton provided her public assessment while traveling in the Middle East last week.
By the accounts of a number of computer scientists, nuclear enrichment experts and former officials, the covert race to create Stuxnet was a joint project between the Americans and the Israelis, with some help, knowing or unknowing, from the Germans and the British.
The project’s political origins can be found in the last months of the Bush administration. In January 2009, The New York Times reported that Mr. Bush authorized a covert program to undermine the electrical and computer systems around Natanz, Iran’s major enrichment center. President Obama, first briefed on the program even before taking office, sped it up, according to officials familiar with the administration’s Iran strategy. So did the Israelis, other officials said. Israel has long been seeking a way to cripple Iran’s capability without triggering the opprobrium, or the war, that might follow an overt military strike of the kind they conducted against nuclear facilities in Iraq in 1981 and Syria in 2007.
Two years ago, when Israel still thought its only solution was a military one and approached Mr. Bush for the bunker-busting bombs and other equipment it believed it would need for an air attack, its officials told the White House that such a strike would set back Iran’s programs by roughly three years. Its request was turned down.
Now, Mr. Dagan’s statement suggests that Israel believes it has gained at least that much time, without mounting an attack. So does the Obama administration.
For years, Washington’s approach to Tehran’s program has been one of attempting “to put time on the clock,” a senior administration official said, even while refusing to discuss Stuxnet. “And now, we have a bit more.”
Finding Weaknesses
Paranoia helped, as it turns out.
Years before the worm hit Iran, Washington had become deeply worried about the vulnerability of the millions of computers that run everything in the United States from bank transactions to the power grid.
Computers known as controllers run all kinds of industrial machinery. By early 2008, the Department of Homeland Security had teamed up with the Idaho National Laboratory to study a widely used Siemens controller known as P.C.S.-7, for Process Control System 7. Its complex software, called Step 7, can run whole symphonies of industrial instruments, sensors and machines.
The vulnerability of the controller to cyberattack was an open secret. In July 2008, the Idaho lab and Siemens teamed up on a PowerPoint presentation on the controller’s vulnerabilities that was made to a conference in Chicago at Navy Pier, a top tourist attraction.
“Goal is for attacker to gain control,” the July paper said in describing the many kinds of maneuvers that could exploit system holes. The paper was 62 pages long, including pictures of the controllers as they were examined and tested in Idaho.
In a statement on Friday, the Idaho National Laboratory confirmed that it formed a partnership with Siemens but said it was one of many with manufacturers to identify cybervulnerabilities. It argued that the report did not detail specific flaws that attackers could exploit. But it also said it could not comment on the laboratory’s classified missions, leaving unanswered the question of whether it passed what it learned about the Siemens systems to other parts of the nation’s intelligence apparatus.
The presentation at the Chicago conference, which recently disappeared from a Siemens Web site, never discussed specific places where the machines were used.
But Washington knew. The controllers were critical to operations at Natanz, a sprawling enrichment site in the desert. “If you look for the weak links in the system,” said one former American official, “this one jumps out.”
Controllers, and the electrical regulators they run, became a focus of sanctions efforts. The trove of State Department cables made public by WikiLeaks describes urgent efforts in April 2009 to stop a shipment of Siemens controllers, contained in 111 boxes at the port of Dubai, in the United Arab Emirates. They were headed for Iran, one cable said, and were meant to control “uranium enrichment cascades” — the term for groups of spinning centrifuges.
Subsequent cables showed that the United Arab Emirates blocked the transfer of the Siemens computers across the Strait of Hormuz to Bandar Abbas, a major Iranian port.
Only months later, in June, Stuxnet began to pop up around the globe. The Symantec Corporation, a maker of computer security software and services based in Silicon Valley, snared it in a global malware collection system. The worm hit primarily inside Iran, Symantec reported, but also in time appeared in India, Indonesia and other countries.
But unlike most malware, it seemed to be doing little harm. It did not slow computer networks or wreak general havoc.
That deepened the mystery.
A ‘Dual Warhead’
No one was more intrigued than Mr. Langner, a former psychologist who runs a small computer security company in a suburb of Hamburg. Eager to design protective software for his clients, he had his five employees focus on picking apart the code and running it on the series of Siemens controllers neatly stacked in racks, their lights blinking.
He quickly discovered that the worm only kicked into gear when it detected the presence of a specific configuration of controllers, running a set of processes that appear to exist only in a centrifuge plant. “The attackers took great care to make sure that only their designated targets were hit,” he said. “It was a marksman’s job.”
For example, one small section of the code appears designed to send commands to 984 machines linked together.
Curiously, when international inspectors visited Natanz in late 2009, they found that the Iranians had taken out of service a total of exactly 984 machines that had been running the previous summer.
But as Mr. Langner kept peeling back the layers, he found more — what he calls the “dual warhead.” One part of the program is designed to lie dormant for long periods, then speed up the machines so that the spinning rotors in the centrifuges wobble and then destroy themselves. Another part, called a “man in the middle” in the computer world, sends out those false sensor signals to make the system believe everything is running smoothly. That prevents a safety system from kicking in, which would shut down the plant before it could self-destruct.
“Code analysis makes it clear that Stuxnet is not about sending a message or proving a concept,” Mr. Langner later wrote. “It is about destroying its targets with utmost determination in military style.”
This was not the work of hackers, he quickly concluded. It had to be the work of someone who knew his way around the specific quirks of the Siemens controllers and had an intimate understanding of exactly how the Iranians had designed their enrichment operations.
In fact, the Americans and the Israelis had a pretty good idea.
Testing the Worm
Perhaps the most secretive part of the Stuxnet story centers on how the theory of cyberdestruction was tested on enrichment machines to make sure the malicious software did its intended job.
The account starts in the Netherlands. In the 1970s, the Dutch designed a tall, thin machine for enriching uranium. As is well known, A. Q. Khan, a Pakistani metallurgist working for the Dutch, stole the design and in 1976 fled to Pakistan.
The resulting machine, known as the P-1, for Pakistan’s first-generation centrifuge, helped the country get the bomb. And when Dr. Khan later founded an atomic black market, he illegally sold P-1’s to Iran, Libya, and North Korea.
The P-1 is more than six feet tall. Inside, a rotor of aluminum spins uranium gas to blinding speeds, slowly concentrating the rare part of the uranium that can fuel reactors and bombs.
How and when Israel obtained this kind of first-generation centrifuge remains unclear, whether from Europe, or the Khan network, or by other means. But nuclear experts agree that Dimona came to hold row upon row of spinning centrifuges.
“They’ve long been an important part of the complex,” said Avner Cohen, author of “The Worst-Kept Secret” (2010), a book about the Israeli bomb program, and a senior fellow at the Monterey Institute of International Studies. He added that Israeli intelligence had asked retired senior Dimona personnel to help on the Iranian issue, and that some apparently came from the enrichment program.
“I have no specific knowledge,” Dr. Cohen said of Israel and the Stuxnet worm. “But I see a strong Israeli signature and think that the centrifuge knowledge was critical.”
Another clue involves the United States. It obtained a cache of P-1’s after Libya gave up its nuclear program in late 2003, and the machines were sent to the Oak Ridge National Laboratory in Tennessee, another arm of the Energy Department.
By early 2004, a variety of federal and private nuclear experts assembled by the Central Intelligence Agency were calling for the United States to build a secret plant where scientists could set up the P-1’s and study their vulnerabilities. “The notion of a test bed was really pushed,” a participant at the C.I.A. meeting recalled.
The resulting plant, nuclear experts said last week, may also have played a role in Stuxnet testing.
But the United States and its allies ran into the same problem the Iranians have grappled with: the P-1 is a balky, badly designed machine. When the Tennessee laboratory shipped some of its P-1’s to England, in hopes of working with the British on a program of general P-1 testing, they stumbled, according to nuclear experts.
“They failed hopelessly,” one recalled, saying that the machines proved too crude and temperamental to spin properly.
Dr. Cohen said his sources told him that Israel succeeded — with great difficulty — in mastering the centrifuge technology. And the American expert in nuclear intelligence, who spoke on the condition of anonymity, said the Israelis used machines of the P-1 style to test the effectiveness of Stuxnet.
The expert added that Israel worked in collaboration with the United States in targeting Iran, but that Washington was eager for “plausible deniability.”
In November, the Iranian president, Mahmoud Ahmadinejad, broke the country’s silence about the worm’s impact on its enrichment program, saying a cyberattack had caused “minor problems with some of our centrifuges.” Fortunately, he added, “our experts discovered it.”
The most detailed portrait of the damage comes from the Institute for Science and International Security, a private group in Washington. Last month, it issued a lengthy Stuxnet report that said Iran’s P-1 machines at Natanz suffered a series of failures in mid- to late 2009 that culminated in technicians taking 984 machines out of action.
The report called the failures “a major problem” and identified Stuxnet as the likely culprit.
Stuxnet is not the only blow to Iran. Sanctions have hurt its effort to build more advanced (and less temperamental) centrifuges. And last January, and again in November, two scientists who were believed to be central to the nuclear program were killed in Tehran.
The man widely believed to be responsible for much of Iran’s program, Mohsen Fakrizadeh, a college professor, has been hidden away by the Iranians, who know he is high on the target list.
Publicly, Israeli officials make no explicit ties between Stuxnet and Iran’s problems. But in recent weeks, they have given revised and surprisingly upbeat assessments of Tehran’s nuclear status.
“A number of technological challenges and difficulties” have beset Iran’s program, Moshe Yaalon, Israel’s minister of strategic affairs, told Israeli public radio late last month.
The troubles, he added, “have postponed the timetable.”
|
Walter Watts
Tulsa Network Solutions, Inc.
No one gets to see the Wizard! Not nobody! Not no how!
|
|
|
Fritz
Archon
Gender:
Posts: 1746
Reputation: 8.41
Rate Fritz
|
|
Re:Israel Tests on Worm Called Crucial in Iran Nuclear Delay
« Reply #1 on: 2011-01-17 11:59:42 » |
|
Well Walter; it seems we have an interesting dilemma on our hands .... so will the real 'Creator' please rise and claim his 'WORM'.
Cheers
Fritz
PS: Possibly rename it 'Stucknuts' 
The New York Times Fails To Deliver Stuxnet’s Creators
Source: Forbes
Author: Jeffrey Carr
Date: 2011.01.17
Yesterday the New York Times published a major story by William J. Broad, John Markoff and David E. Sanger which named the U.S. and Israel as co-developers of the Stuxnet worm. Unfortunately for their millions of readers, they provided almost no verifiable evidence to back up their claims, and even worse, excluded evidence that didn’t support their theory.
The Dimona Complex
The article’s entire hook is built upon claims made for the Dimona Complex by un-named sources:
Over the past two years, according to intelligence and military experts familiar with its operations, Dimona has taken on a new, equally secret role — as a critical testing ground in a joint American and Israeli effort to undermine Iran’s efforts to make a bomb of its own.”
And the proof? The journalists give none, because no one wants to go on the record. Fair enough, but with such a sensational claim I’d expect, at the very least, to read some additional supporting evidence. And here it is – “Israeli officials grin widely when asked about its effects.” That’s it. That’s all they’ve got. Some officials grinned.
So how likely is it that an Israeli official who has direct knowledge of Stuxnet testing at Dimona is going to speak to a reporter about it? Based upon the experience of Mordechai Vanunu, who’s considered a traitor to Israel and has spent most of his life in prison after he revealed his knowledge of the top secret facility to the British press in 1986, I’m guessing the answer has something to do with snowballs and hell. To put it mildly, the Mossad was very unhappy with Mr. Vanunu. And everyone in Israel knows it.
As far as Mossad chief Meir Dagan telling the Israeli Knesset on the day before his retirement that Iran’s capabilities to develop a nuclear warhead have been pushed back until 2015, I have no idea where that figure came from or what Mr. Dagan’s motivations would be for saying that but the Israeli Prime Minister, the founder of Israel’s Computer Emergency Response Team (CERT) and at least two respected Israeli experts disagree with Mr. Dagan. One of them spent 40 years working in precisely this area.
Efrayim Asculai, a 40 year veteran of Israel’s Atomic Energy Commission and an expert on Iran’s nuclear weapons development wrote a recent article (01 Dec 2010) warning about nuclear proliferation in 2011 in general and Iran’s still robust capabilities in particular:
Take the case of Iran. Even prior to the November 23 distribution by the IAEA to its member states of its periodic report on Iran, much was heard heralding the fact that the Iranians were grappling with complications in operating their gas centrifuge uranium enrichment plant at Natanz. Some blamed the delays on the potent Stuxnet computer virus that was apparently very effective in disrupting electrical inverters, a vital component in the centrifuge operations. Others, however, attributed the difficulty to the inherent challenges in operating the almost obsolete P-1 model machines. This opinion was bolstered by a statement in the report (in a footnote) that feeding the centrifuge cascades with its input uranium hexafluoride was stopped on November 16. Yet the next statement in the footnote was far less reassuring when it noted that the feed was resumed six days later.
On the same day the report was published, the Institute for Science and Security (ISIS) published an analysis of the IAEA report, showing that in the reporting period Iran increased its operational efficiency in almost every parameter. The number of centrifuges enriching uranium is almost at its peak; the flow of the feed material into the enrichment cascades is at its peak, and so is the rate of production of the 3.5% enriched uranium. The rate of the enrichment process from 3.5% to 20% is quite steady, in spite of the old centrifuge model. Although this is a small scale operation, the Iranians could turn it into a large scale one in a very short time. Since this is a stone’s throw away from weapons-grade uranium, this situation cannot be a source of optimism.”
Shai Blitzblau, head of the computer warfare laboratory at Israel-based Maglan Information Defense Technologies, Ltd was quoted in John Markoff’s first article about Stuxnet in the New York Times last September:
Israel had nothing to do with Stuxnet. We did a complete simulation of it and we sliced the code to its deepest level. We have studied its protocols and functionality. Our two main suspects for this are high-level industrial espionage against Siemens and a kind of academic experiment.”
In a different interview for Defense-Update, Blitzblau said
Stuxnet is definitely not a military code, at least not a Western one” said Shai Blitzblau, Head of Maglan-Computer Warfare and Network Intelligence Labs, interviewed by Defense Update. “Stuxnet is a sophisticated and highly advanced code, but it lacks certain elements commonly associated with military operations” Blitzblau explains that the broad, indiscriminate attack on industrial computers launched by Stuxnet is not characteristic to a military operation, where the nation launching the attack tries to minimize collateral damage and focus on a specific target.”
Gadi Evron, an Israeli security expert and founder of Israel’s CERT, wrote “Stuxnet: An Amateur’s Weapon” for Dark Reading on why Stuxnet was most likely not an Israeli operation, referring to it as “sloppy” and “amateurish”:
For such an operation, Stuxnet must not fail. There has to be clear intelligence about how the systems it attacks are built. Also, given the nature of these systems (industrial software that controls power plants, like SCADA systems), it would have to be developed in a replication of the target environment — an immense cost to reconstruct and an effort in intelligence collection. Such a tool would be used carefully to avoid the risk of discovery — not just the specific operation, but of methods used, the technology developed, and past targets.
How then could a target-specific weapon such as Stuxnet be found in tens of thousands of computers worldwide, as vendors such as Microsoft report? It makes no operational sense to attack random computers, which would increase the likeliness of discovery and compromise the operation.
A Questionable Timeline
Furthermore, Sanger, Markoff and Broad have mis-stated the facts of the Stuxnet timeline. After writing about a leaked State Dept cable that discusses how the United Arab Emirates (UAE) stopped a shipment of Siemens Step 7 controllers from entering Iran in April, 2009, the reporters then wrote “Only months later, in June, Stuxnet began to pop up around the globe”. Except that that didn’t happen in June, 2009. It happened about 15 months later in July, 2010, several weeks after VirusBlokAda broke the news about the Windows shortcut exploit (.LNK). Here’s Symantec’s timeline as documented in their final report:
June, 2009: Earliest Stuxnet sample seen. Does not exploit MS10-046. Does not have signed driver files.
January 25, 2010: Stuxnet driver signed with a valid certificate belonging to Realtek Semiconductor Corps.
March, 2010: First Stuxnet variant to exploit MS10-046.
June 17, 2010: Virusblokada reports W32.Stuxnet (named RootkitTmphider). Reports that it’s using a vulnerability in the processing of shortcuts/.lnk files in order to propagate (later identified as MS10-046).
In other words, the Stuxnet worm that amazed so many security researchers with its 4 zero day exploits and two genuine digital certificates didn’t exist in June 2009. Only the most rudimentary version of it did, which begs the question – why was it so effective in its stripped-down form in 2009 and why would the developers keep pushing more sophisticated versions out in 2010?
The other problem not addressed in the NYT piece is what happened to the P1 centrifuges in 2008 and early 2009, before Stuxnet had been released? According to the IAEA as reported by ISIS (.pdf), an unknown event occurred in 2008 which impacted centrifuge performance and from which Natanz had not recovered as late as February 2010.
On December 22, 2010, ISIS released another report “Did Stuxnet Take Out 1,000 Centrifuges at the Natanz Enrichment Plant? (.pdf)”. Rather than addressing the earlier performance problems from 2008, the ISIS authors looked at centrifuge replacement numbers at Natanz:
In late 2009 or early 2010, Iran decommissioned and replaced about 1,000 IR-1 centrifuges in the Fuel Enrichment Plant (FEP) at Natanz, implying that these centrifuges broke. Iran’s IR-1 centrifuges often break, yet this level of breakage exceeded expectations and occurred during an extended period of relatively poor centrifuge performance.
Although mechanical failures or operational problems have often been discussed as causing problems in the IR-1 centrifuges, the crashing of such a large number of centrifuges over a relatively short period of time could have resulted from an infection of the Stuxnet malware.
David Albright and his co-researchers at ISIS concluded that the Stuxnet worm most likely was designed to destroy a limited number of centrifuges and temporarily set back Iran’s fuel enrichment program. Does that sound like a strategy that Israel would agree to? Not to Benjamin Netanyahu, Israel’s PM. After expressly stating his disagreement with Dagan’s 2015 date, he said that “sanctions should be strictly enforced and materially strengthened…, and that if they don’t achieve their goal, they would be followed by a credible military option.”
CONCLUSION
Broad, Markoff, and Sangar failed to provide any verifiable evidence to support their claims that Israel tested the U.S. developed Stuxnet worm at Dimona.
Broad, et al failed to establish an accurate timeline of events which, had they done so, would have raised several un-answered questions about when the Natanz centrifuges were crashing versus when Stuxnet was fully developed.
Broad, et al provided no expert analysis on the state of Iran’s fuel enrichment program, opting for a disputed comment by Mr. Dagan and Hilary Clinton, who tried to credit U.N. sanctions for Iran’s Fuel Enrichment Program (FEP) delays.
When I wrote “Stuxnet’s Finnish-Chinese Connection“, I supported my theory that the People’s Republic of China developed the Stuxnet worm with five pieces of verifiable evidence that were unique to China. Not a single one of those 5 was because a senior official in the Chinese government “smiled”.
|
Where there is the necessary technical skill to move mountains, there is no need for the faith that moves mountains -anon-
|
|
|
|
Logged
