Hacker News Reader

Comment by axg11 | Hacker News Reader

Hiding and obfuscating the payload is pointless in this case. The author doesn’t seem to understand the reasons why a group would go through the trouble of obfuscation or other similar techniques.

Stuxnet was a one-time operation with a very limited opportunity window. Target systems were airgapped. A large part of the success of the operation relied on a human penetrating that air gap. A successful operation would be attributed to either Israel or USA immediately. What is the benefit of obfuscation?

View on HN

Yeah, the author definitely doesn't really have a clue what the requirements are for various forms of intelligence operation.

It should be noted, however, that there apparently was a significant amount of animosity from the NSA towards unit 8200 for "turning up the volume" on the payload. Usually NSA really really really doesn't like catching attribution for stuff, and Mossad is more known for trying to send a message with obvious attributions (motorcycle assassinations etc). It was supposedly delivered from TAO to 8200 as a very covert weapon, and 8200 stripped off a bunch of the limitations in order to increase the odds of successfully completing the mission.

I'm not actually referencing the Wikipedia article, so I don't know if what I'm saying is reflected in there, but it's a good read either way: https://en.wikipedia.org/wiki/Operation_Olympic_Games

Stuxnet was assembled from a standard implant framework that is shared across "Five Eyes" countries. Everyone writes modules of various types that implement a standard API and share them across teams. For example, if the Australians need to compromise a diplomatic machine in Singapore, the UK may have a module already written a keylogger that hooks Pinyin (software for typing in Mandarin).

When the Israeli's pushed it to 11 they brought down a ton of scrutiny on the framework as a whole. Which is why people started discovering links to other sophisticated malware families - like Kaspersky's discovery that Stuxnet and Flame used the same LNK vulnerability which was not known to the public at the time. The "QWERTY" keylogger in the Snowden leaks was identified as part of the Regin malware family.

They effectively gave every nation on the planet a trail of breadcrumbs to either find western espionage tools, or strongly attribute tools they had previously found.

This also refutes most of the articles points, they _could_ have done all these things but SOP is to do the least amount of shady shit to get the job done. Being extra cool guy just makes it more likely to trigger an anti-virus system that detects a specific trick.

I wonder if the "Olympic Games" name is in reference to a USB-stick jumping the airgap by being handed off like the Olympic Torch Relay.

That's a smart thought. Ive always wondered why they called it that.

Snowden mentioned that they have some kind of a random operation name generator that they have to use, but people keep using it over and over to find a suitable name. I don't recall the specifics but it was in his book.

> That's a smart thought. Ive always wondered why they called it that.

That's a smart-ass thought, and for that very reason would make it a horrible code name for such a project.

You want your code names to be totally arbitrary and have nothing to do with the project.

In WW2, the Brits managed to correctly guess quite a bit about the German anti-aircraft and anti-anti-aircraft systems from the 'clever' code names the Germans picked. See eg https://www.reddit.com/r/todayilearned/comments/bnkzdq/til_d...

Yes I know, but people take pride in their work and they want a cool name for their project.

Like I said Snowden did mention that NSA mandated the use of this code name generator in his book, and it was indeed random for this reason. But he also describes people used to game the system for a cool code name by simply running the generator over and over until they got one they liked :)

I would imagine that a cool name would also make it easier to sell a proposal to the brass. Prudence or not, people are easily influenced this way. It's why marketing works.

Yeah, the author of the article sounds like a teenager/young adult who seems unable to evaluate objects along multiple dimensions.

Exactly. All that matters is that the scoreboard reads "Stuxnet - 1; Iran - 0 (Final)"

Yeah, effective trumps every possible hindsight criticism.

Considering that Iran went on to develop uranium enrichment capabilities it hardly seems like Stuxnet was a final win, though it certainly delayed them.

Delaying has always been the point, whether it's Stuxnet or technology export bans or assassinating 4 scientists in the streets working on the program.

Long term effects of Stuxnet are unclear. In the short term, it was a huge win in delaying the programme and sending a message that even air gapped systems are at risk. In the long term, Stuxnet put the programme and every adversary on notice that they should increase focus on security practices.

And yet we leave our own infrastructure connected to the internet. It’s like we want our power grid to fail, our dams to release a flood, our water supply to be over-floridated.

Didn't we just talk about how Stuxnet showed that even airgaps aren't 100% secure?

The benefits of being connected to the Internet are the same as before; but the benefits of the airgap are smaller than we expected them to be. Hence we would expect our preferred trade-off to swing in favour of more connections?

And the lock on your house isn’t particularly effective either, yet we don’t see you going on vacation whilst leaving the door fully open.

If there was a high chance I would come home to my house being devastated whether I lock up or not, I would probably not bother locking up.

I live in Chile. In practice you would lock up (and even set up your lights with an endemic light timer so it looks like you're home) and the alternative is homelessness. Actual homelessness, not eviction. You still pay rent, only there's no roof over your head. You'd be homeless, not evicted. The ruins of your former house are a better home than the street. Shit in the corner, rebuild, that sort of thing. In practice you would not leave for vacations and for sure exercise right to bear arms, that's what's up. The police will ALWAYS tell you you're in safe hands with them don't get a gun in urban areas. They'll say it'll be used against you. I guess it could if you're a wimp. Yeah I'm such a wimp, the thug will walk right up while I do nothing but hold the gun, suck the bullets out of the barrel with his powerful lungs, and spit them out back at me!

Dude they should diminish fluoride by a factor of ten.

All the much more sweeter when they get it.

The list of countries America tells other countries to treat poorly is getting kinda long.

So I could actually rattle them off the top of my head once:

Myanmar

Sudan

Iran

North Korea

Cuba

That last one is a funny one, the original pariah. But like you can't go to these countries for contests, or accept prize money there, so for instance the Rubik's Cube championship can't be in Cuba, because Americans who are damned good at it can't win.

And it wasn't a very large amount of land. Sudan yeah, that was the biggest country in Africa before it split. But it was remote from where I was in Chile, much more than half the world away. Never met a Sudanese, nothing.

Now it's like Belarus, Russia, China soon, North Korea, Cuba always always, South Sudan, uh, Yemen, there's more...Libya for a while, like EVERYONE EVERYONE IS SANCTIONED.

When everybody's sanctioned, nobody's sanctioned. America is sanctioned.

This is a pretty ironic view. What you're regretting losing only ever existed during the unipolar moment anyway. The era preceding it was literally called the Cold War. Emphasis on War. Now that the unipolar moment is ending you're blaming America for sticking to its guns and refusing to do business with countries that agitate for its downfall or destruction?

The damage goes way beyond delaying them one time, it also makes it way harder to use COTS hardware in the future. It's going to be a lot harder to get work done when you can't just buy a computer off Amazon.

In World War 2 the British developed "exploding rats." The idea was to pack rats with explosives and leave them near boilers. The person shoveling fuel would eventually find the rat and shovel it in to the furnace to dispose of it - where a relatively small explosion would cause the pressure vessel to rupture and take out an entire train or industrial facility.

A single shipment of 100 explosive rats was sent across the border and was intercepted. What resulted was a massive amount of German energy spent on trying to detect rat shipments and having to consider exploding rats in their threat model for every further operation.

Stuxnet not only delayed the the Iranian nuclear efforts, it made everything a hundred times more complex going forward because they realized not even air gapped computers were safe. Not to mention they no longer trust any of their monitoring or instrumentation, which Stuxnet made a point of faking... imagine trying to debug even the smallest issue when you don't trust a single piece of data.

They already had enrichment capabilities. What stuxnet targeted was and I believe is an active enrichment plant.

I don't think it did more than delay production and destroy some really expensive centrifuges but it could have been a message like "we'll get you no matter what" in order to bring them to the table or something.

Exactly. Nothing wrong with going for a bunch of low hanging fruit in an attack. If the simple stuff doesn’t work you need to do obfuscation and have good OPSEC

Exactly. The cost of failure was deemed greater than the cost of success with attribution. It's just the way covert ops works.

If you asked the leaders of this op, in retrospect, if they were starting off from scratch, would they accept the result we saw where Irans nuclear enrichment capabilities were delayed long enough for more information about their secret work to be known with more certainty. . .all of them would take it in a heartbeat.

I'm not in the field, so it is definitely possible that my way of looking at it is just completely wrong-headed, but -- what about repeating the attack? If the program had remained hidden, maybe they could re-use some parts? Also, is it possible that other parties (badguys) gained some capability by analyzing the program?

How could it remain hidden? The programme heads would think it was an accident? This was a devastating setback to the entire programme. There would surely be an investigation to ensure a repeat could not happen.

They could have used it on somebody else. Iran is not going to brag about having been hacked.

Reply on news.ycombinator.com