Stuxnet is embarrassing, not amazing

Do we actually know that? Is there any evidence that this delayed the program by "years" rather than a few months?

How do you know that?

But the unanimous consensus ("with high confidence") of all 16 US intelligence agencies remains that Iran does not have a nuclear weapons program. I haven't seen that mentioned once in any discussion of this subject here. That's just weird.

I don't follow this stuff closely and obviously have no idea what's going on behind the scenes, but it seems likely that everything about this business is stuffed to the gills with propaganda. Is there any credibly objective source anywhere?

Someone needs to do that t-shirt, with the Stuxnet code on the back. I'd get one... although I'd probably be too afraid to wear it :-)

A big part of Nate's point in this article is that the virus and DRM communities have known for over a decade how to take programs like this and make them hard to analyze. Nate is pointing out that nothing like that seems to have been done here.

Note that Nate was a key contributor to the as-yet-unbroken† Blu-Ray BD+ DRM scheme, which he worked on in his last couple years at Paul Kocher's infamous Cryptography Research. Here he is going out of his way to cite well known, public sources for methods that would have allowed an intelligence agency to carry out this attack without broadcasting to the world "AIR GAP ALL YOUR NUCLEAR FACILITIES IMMEDIATELY OR YOU WILL LOSE YOUR CENTRIFUGES". He's not even suggesting that the authors needed to be world-class content protection experts; only that they would have benefited greatly from a book you can get off the shelf at Barnes and Noble.

The C.W. on Hacker News might be that it makes sense for Iran's enemies to brag about destroying centrifuges without a costly military intervention. But real intelligence services don't brag, if only because they'd like to be able to repeat the same trick against Myanmar or Belarus or Syria or whoever the next proliferation threat is.

† BD+ is interesting because it was designed to be broken easily and then renewed easily; there are numerous individual disk breaks, but so far as I know no break against the whole BD+ scheme that would enable a bypass of any studio update. BD+ may be the first such renewable content protection scheme ever deployed.

If it is, it's likelier that Stuxnet is the creation of Unit 8200 rather than the Mossad.

Reference: http://en.wikipedia.org/wiki/Unit_8200

How long it was out in the wild doesn't matter though: what matters is how long it infected the target machines.

During that time it caused complete chaos within the Iranian nuclear program (to the point where some officials were executed on the suspicion of espionage).

How do we know that the people being executed were innocent as opposed to people committing espionage? I mean, if Stuxnet caused Iranian counterintelligence to discover an Israeli operative, then I'm not sure that's a win: delaying the program by an unspecified amount of time at the cost of lots of dollars and the loss of some operatives doesn't seem like a win to me. But this is all very speculative, so who knows.

Is there a good source justifying the "complete chaos" claim? Or the executions?

I'd challenge you to find any reputable party in that field to challenge this summary. There's a whole Twitterverse of security experts that will back me up on this. Nate's not an egotist, and that's not where this post is coming from.

The place Nate is coming from is one of skepticism. He's challenging the near-hagiographic conventional wisdom that Stuxnet's sophistication is a clear sign of its intelligence lab origins. If Stuxnet isn't particularly sophisticated, that doesn't mean it wasn't set into motion by nation-state actors, or that it was ineffective, but it does knock down one factor in most of the discussions about the importance of "cyber warfare". Maybe Iran's nuclear plants were simply absurdly exposed to IT-based attacks due to sheer incompetence.

Any high-end agency would never say the latter, so either there were severe time pressures or this was Team B. The narrative that this is highly polished work of a high-end agency (4! I mean 3 0-days!) is not supported by evidence.

I think the idea (Making the red team have to put up with expensive and costly countermeasures to malware) is a good one, however I think it is unlikely the reason this was detected.

Or perhaps it was engineered to be as complex as necessary to accomplish the job (sabotage), but simple enough that Israel didn't have to show all of its cyber-warfare cards.

There's a good chance that any worm, no matter how engineered, will be detected and reverse engineered. It makes sense not to go all-in on any single one and reveal your techniques unless the difficulty of intrusion calls for it.

The one valid criticism is that it is more work to implement. But it's not that hard.

Nate is saying, take exactly one step back and look at Stuxnet and you see that it has two jobs: one†, to retard the Iranian nuclear program, and two, to do so at a minimal cost to future intelligence activities. At that second objective it seems to have demonstrably failed; there are teenagers who have done better jobs of concealing the payloads of malware.

† If you believe all the Stuxnet press.

http://www.symantec.com/content/en/us/enterprise/media/secur...

http://www.malwareinfo.org/files/W32.DownadupThreat.pdf

You'll notice that most of the gushing has devolved to focusing on the payload and not the infection mechanism. That's because the worm itself is surprisingly average.

Of course, not all Israeli military want to avoid a confrontation. Military don't usually get medals for preventing wars.

  I fear whoever unleashed this has opened a pandora's box of destructive malware.  We've already seen things like China hacking major corporations and manipulating it's currency.  It's not hard to picture a future where malware is used to hurt the competition's production, at either a corporate or state level.

By that point, according to most reports, the program had been set back by three years (as effective as what a military strike would have been, according to the NYT article).

It was hidden for almost two years, then suddenly discovered - at which point dozens of security companies around the world deconstructed the worm in a process that took weeks.