Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Businesses Security IT

Stuxnet Virus Now Biggest Threat To Industry 254

digitaldc writes "A malicious computer attack that appears to target Iran's nuclear plants can be modified to wreak havoc on industrial control systems around the world, and represents the most dire cyberthreat known to industry, government officials and experts said Wednesday. They warned that industries are becoming increasingly vulnerable to the so-called Stuxnet worm as they merge networks and computer systems to increase efficiency. The growing danger, said lawmakers, makes it imperative that Congress move on legislation that would expand government controls and set requirements to make systems safer."
This discussion has been archived. No new comments can be posted.

Stuxnet Virus Now Biggest Threat To Industry

Comments Filter:
  • by elrous0 ( 869638 ) * on Thursday November 18, 2010 @09:29AM (#34267530)

    This is a wake-up call to a new vulnerability. There are a helluva lot worse ways to have found out about it than this relatively innocuous version. It also exposes stupid weaknesses like the fact that all Siemens PLC's (programmable logic controllers) have a hard-coded password [wired.com] that was never meant to be changed, and that all the obscure proprietary software in the world on PLC's doesn't mean jack for security--because they all still have to take their orders from a machine running it software on regular old Windows.

    We could have realized these vulnerabilities only after a bunch of stuff started exploding.

    • by poetmatt ( 793785 ) on Thursday November 18, 2010 @09:36AM (#34267602) Journal

      this is a wake up call to a new "cyber-vulnerability"! Oh noes! I said the word cyber! It's not a threat, it's a cyberthreat!

      yes, this is the hype they want you to believe. Stuxnet is something to be concerned about, but adding the word cyber is just bullshit hype all around.

      the rest is just calling into play Siemens shitty programming ethics which are now going to bite them in the ass as businesses and government will probably shy away from business with them until this can be fixed.

      • Re: (Score:3, Insightful)

        by lgw ( 121541 )

        Everything, everything, is a reason for "new government controls" these days. If the TSA groping 3-year-old girls isn't a wakeup call to the gradual march of fascism we seem to embrace, I don't know what is.

        "Threat"? I don't care. "Cyber-threat"? I don't care. I don't care what the threat is any more. I have more than enough government, and I want less! The biggest threat by far is our government, and it's time to de-fund the whole stinking mess.

        • By all means, stop paying taxes. Consider it a protest.
          • Re: (Score:3, Insightful)

            by lgw ( 121541 )

            No, some retarded fringe protest is the opposite of what we need. What we do need is people to wake up to the gradual increase in totalitarianism, and stop being OK with it. We still have a functioning democracy, and any every intrusive government agency can be destroyed entirely with a stroke of a pen. Every single world event is an excuse to make out government stronger and more intrusive if we let it be so, but we can just as easily decide that enough is too much, and put and end to it.

    • by mevets ( 322601 ) on Thursday November 18, 2010 @09:38AM (#34267632)

      We also could have foreseen these vulnerabilities.

      I used to work in industrial automation - in its pre-windows era, and people did put effort into isolation, access control and validation.

      After having made the bad decision to deploy on Windows, when years of evidence that it had a horrendous lack of access control, how did Siemens just continue on? What were they thinking?

      • Re: (Score:3, Funny)

        by elrous0 ( 869638 ) *

        Yes, according to Captain Hindsight [wikia.com], we should have secured our PLC's and SCADA infrastructure better years ago.

        • Re: (Score:3, Insightful)

          by squizzar ( 1031726 )

          Every time someone suggests a Windows based system in _any_ critical situation plenty of people come out shouting how it will undoubtedly lead to the end of the world. Hindsight doesn't even come into it - the possibility of these scenarios was predicted, brought to people's attention and dismissed.

          'Captain Hindsight' parodies people who appear out of the woodwork to say what is now blindingly obvious, not people who had the foresight to predict these problems but were ignored.

          • by JWW ( 79176 ) on Thursday November 18, 2010 @10:37AM (#34268410)

            Yep, you and the GGP post are correct, this was a foresight issue. I too was in a position where I was asked to replace reliable, effective, and secure Unix control systems with Windows based systems.

            It was a ridiculous play for the new eye-candy, and "usability" (why do you need general application usability on machines that should be running only ONE program?). Just the fact that there were now Windows machines on the production floor led to enormous headaches. All kinds of access controls and system policies and restrictions and processes needed to be put in place to keep these machines functioning even reasonably well, where the Unix boxes (and X-terminals) they replaced were ROCK SOLID.

            Now the industry will pay for using the quick and easy and VULNERABLE hardware to run their process control systems.

      • What were they thinking?

        The customer uses Windows, thus we need to make our solutions work on Windows.

        • Re: (Score:3, Funny)

          by Lumpy ( 12016 )

          Because the customer is too stupid to use a different OS for the single application that needs to run on that?

          If you think that you need to run Office on the SCADA computer, please throw yourself from the nearest building as people who think the way you do are the cause of this problem.

          "Hey dave, the nuclear reactor computer, you think it will run Netflix?" Yup: you're the problem.

    • Security? If I have a physical piece of hardware that could cut someones head off, why exactly would I have it connected to a network?

      These PLC's operate with a swarm sort of mentality. The network is merely a method for them to communicate. Kind of like how your light switch authenticates you to turn on and off a light.

      Oh wait, it doesn't... OMFGz0rs, someone could cause a fire by turning on the light without authentication!

      • by elrous0 ( 869638 ) * on Thursday November 18, 2010 @09:56AM (#34267842)

        No, the problem is that even if your PLC's aren't networked--the laptop that reprograms them may be at some point (and can be infected with a virus). Even if you pull your whole infrastructure off the network, it doesn't ensure security if Jim the IT guy is using the Step 7 laptop to surf the web, or if any yahoo can stick his thumb drive into said laptop and give it a digital STD.

        • by Lumpy ( 12016 )

          What idiot would program the system with a general purpose laptop? All parts of a SCADA system are supposed to be seperated including the programming pc. you sneaker-net the sourcecode to the programming pc, you compile it there. Only infection vector is to infect the sourcecode in a way that makes the compiler execute the virus. reduces the infection vector to that of military top secret levels.

          • An idiot who has the choice between wipeing a laptop and reinstalling the OS, or actually getting home on time tonight.
      • I have a piece of hardware that could potentially bludgeon someone or knock them into other equipment that could cut something off (it's a pipe bender, to be specific), and it's connected to a network because our management decided that the operator shouldn't need to be able to read blueprints, but rather a different personnel will read blueprints and create part files that instruct it what to bend, which will be moved to that machine over the network. /sigh

    • This is not new vulnerability, this is old vulnerability called "security through obscurity". Designs of nulclear power plants are not open for review, which leads to these kind of flows quite naturally.
    • Re: (Score:2, Interesting)

      by Anonymous Coward

      all Siemens PLC's (programmable logic controllers) have a hard-coded password

      A Siemens PLC has no such hard coded password. In fact, if the plants in question had activated the write protection options provided by Siemens PLC's, then there would have been no way for the worm to change the PLC code (without the worm knowing the plants' password). Any manufacturer's PLC would have been vulnerable in the same way, if the customer didn't make use of the security features provided.

      The password confusion is related to a vulnerability in the WinCC visualization/operator software, which r

    • by Lumpy ( 12016 ) on Thursday November 18, 2010 @11:17AM (#34269042) Homepage

      Wake up call? new?

      Lots of IT pros have been screaming for a DECADE that only complete fucking morons put a SCADA system on anything that is connected to an external network. Let me repeat that. ONLY A COMPLETE MORON will hook up a scada system to a pc that bridges the internet and the secured network, OR puts the whole damn thing on a unsecured network.

      Guess what, Complete morons are the managers of these places, these complete morons do not want to buy extra pc's so they have the employees check their email ON THE SCADA computers. OR they do something stupid and not lock them down and allow the users to install and run software on them.

      This is not a new problem. Those of us in IT have known about it and have been yelling at the idiots in charge for a long time now. IT's just this is the first real "BITE THEM IN THE ASS" that has happened and got a lot of publicity.

      • Re: (Score:3, Informative)

        ONLY A COMPLETE MORON will hook up a scada system to a pc that bridges the internet and the secured network, OR puts the whole damn thing on a unsecured network.

        As someone that worked on SCADA software for about a decade, I wholeheartedly approve this message. With very few exceptions, every bit of SCADA code I saw makes [insert favorite insecure software target here] look like Fort Knox. You do NOT want the internet getting anywhere near that code.

        P.S. Thanks, Slashdot, for making me log in to IE to post. I still can't copy/paste in Chrome.

  • Idea (Score:2, Funny)

    by Haedrian ( 1676506 )
    They should run Mac software on PLCs. Macs don't get viruses!

    </satire>
    • Yeah, if they were really serious about ending terror, they should nuke Redmond

    • If I said something like that, I'd get modded troll.
      (hugs his Mac G6... like a G6...)

    • Re: (Score:3, Funny)

      by elrous0 ( 869638 ) *

      They also make you morally superior to and smarter than anyone using a Windows machine. It's common knowledge in any coffee shop or arthouse theater.

      • Uh no. Apple products just make you cool and artistic.

        Its Linux which makes you smarter.
  • The solution (Score:5, Insightful)

    by Lord Lode ( 1290856 ) on Thursday November 18, 2010 @09:34AM (#34267574)

    Don't use Windows for important industrial systems.

    • by L4t3r4lu5 ( 1216702 ) on Thursday November 18, 2010 @10:19AM (#34268126)
      More importantly, don't use control software from companies who mandate that passwords are hard-coded and cannot be changed.

      MS: "By the way, the Windows Server 2008 Domain Admin password is 12345. Be sure to write that down!"

      IT Industry: "Lolwut? GTFO."
      Nuclear Fuel Refinement Industry: "The same as my luggage! I like it!"
    • Of course but unfortunately Windows is everywhere in industrial systems. To truly be isolated they should be running dedicated HMIs connected to the PLC with no computer at all. But modern automated facilities want to be able to monitor everything from a SECS/GEM host, be able to remotely look and control HMIs, etc. I bet the companies that spent extra for Rockwell Automation PLCs over Siemens are happy with there choice now. How idiot to hard code a password like that. Not sure why we need legislation
      • And how would the non-computer HMI be configured and updated when the plant needs to change the calibration on a pressure meter, or similar? Presumably by some kind of PC or engineering workstation with an "HMI Configuration" package on it? Gee, that sounds rather a lot like the kind of "PLC configuration" workstations that were the attack vector for getting into the PLCs!

        It's turtles all the way down, I'm afraid. You can't implement a programmable control system without a general-purpose, insecure, infecta

    • Re: (Score:3, Interesting)

      by LWATCDR ( 28044 )

      Simple answer for a not so simple problem.
      Back in the old days people used systems like the PDP-11 and VAX for things like this. Problem was they cost a lot of money and someday the are out of production.
      A good while back people started to use PCs and DOS. That was cheaper but even those are not out of prodcution. Believe it or not there are companies still making PDP-11, VAX, and even DOS/ISA bussed systems today!
      Your company may depend on using a very expensive machine that uses and ISA buss card to inter

      • Re: (Score:3, Insightful)

        by Lumpy ( 12016 )

        Why?

        I solved this a decade ago when I was into SCADA programming Entire SCADA system is isolated NO connection to outside network, no apps other than the Control software.

        Need to have data go to the administrator for stupid reports? easy solution.

        Rs232. Rs232 TX and Gnd only hooked to the Scada system and set to output all stats in a streaming basis. Supervisors PC hooked to that RS232 to monitor all he likes. Infect his pc with nasty kil lyou all virus and it CAN NOT infect the SCADA system unless

    • "expand government controls and set requirements to make systems safer"

      I'm sure we'll be safe after they make Norton Antivirus mandatory on all machines (which is about as much as I expect from Government...)

  • Cut the hardlines (Score:4, Insightful)

    by commodore64_love ( 1445365 ) on Thursday November 18, 2010 @09:34AM (#34267576) Journal

    There's no reason why these machines should be connected to the internet. Maybe some of the top-level communication computers to coordinate between plants, but certainly not the local-area computers/machines.

    • Re:Cut the hardlines (Score:5, Informative)

      by keean ( 824435 ) on Thursday November 18, 2010 @09:47AM (#34267720)
      Actually Stuxnet does not require the machines to be connected to the Internet. In infests the machines used by the designers of these systems, and piggy backs on update PLDs (programmable logic devices) for the production machinery. It does not even rely on the PLD programming machines being connected, as it infests the PLD design files. It infests the PLD design engineers workstations when someone plugs an infected laptop into the private network that all the design computers are on.
      • Oh so it's just like when Windows XP(?) shipped with a virus on-board. That should make it easier to control, simply by virus protecting the Engineers desktops.

        • Yeah, AV on the laptops does help - but as usual, only against known threats. When a nation state decides to gin up some custom sabotage-ware to take out your specific factory, you can count on it bypassing any and all AV until its dirty work is done.

          I think it's difficult to ever be truly secure against an attack with this level of dedication. Stuxnet targeted air-gapped facilities, and appears to have succeeded in its primary mission. If anything, the failure of Stuxnet was that it spread *too much*. It's

    • The problem was not that the targeted machines were connected to the internet, they wern't. If you have RTFA's the targeted machines were supposed to be infected by USB sticks transfered between infected machines and the mission critical systems. Thats why the Stuxnet worm did its best to hide very discreetly on a USB stick, so that it could be transfered from internet connected systems to the mission critical systems without being noticed. Hell, you probably could have picked up on this if you had even RTF

  • Do you really want the idiots in D.C. telling you how your computer must work? Ask anyone doing IT related stuff under the DoD -- their own security policies cause more outages and problems than anything else. Those policies are from people who supposedly know what's what. Now put clueless politicians in charge.

    You DON'T want this, no matter how much you like government control of your lives.

    • Re: (Score:3, Interesting)

      by ewieling ( 90662 )
      I do not mind the government telling industry that they must secure their systems. Who else is going to do that? Customers?
      • by Wonko the Sane ( 25252 ) * on Thursday November 18, 2010 @10:03AM (#34267918) Journal

        When the last time the government solved the problem that it told you it was trying to solve?

        • I am two minds about this: one, it's definitely time for someone to put down standards. But two, the government has consistently failed to get its own shit in order, which can only be attributed to crappy bureaucracy.

          It's pretty much all of a piece, I suppose.

          A simple fix would be to pass a law that lets people sue companies more easily for problems related to their crappy computer infrastructure...Let the market take care of the rest.

      • Except that the government won't settle for telling industry that they must secure their systems. Government will tell industry how to secure their systems and if industry follows government standards they will be protected from lawsuits...even if everyone knows that meeting government standards will do nothing to actually secure industry's systems.
    • by RingDev ( 879105 ) on Thursday November 18, 2010 @09:44AM (#34267680) Homepage Journal

      A fair number of people have labeled me a socialist, and even I can see that this is nothing more than a blatent attempt at a power grab by the federal government, and profiteering by Symantec.

      Dean Turner, director of the Global Intelligence Network at Symantec Corp., told the Senate Homeland Security and Governmental Affairs Committee that the "real-world implications of Stuxnet are beyond any threat we have seen in the past."

      So we're having people who stand to gain more power over their country men making a decision about taking that power, receiving testimony about the threat from the company that stands to profit the most by their decision to take the power. Yeah, that's not a recipe for a horrendous outcome.

      -Rick

    • Re: (Score:2, Interesting)

      Paranoia and its associated billions and billions spent because of it is how the US will be weakened.

      It's been said that one of the (many) reasons the Soviet Union collapsed was because of the spending on military hardware to keep up with the US - their economy just couldn't support it.

      The US has no real reason, at least at this time, to spend billions and billions of hardware BUT security is another matter.

      We're so paranoid, that we're searching each other to make sure that our neighbors aren't a threat -

  • Legislation? (Score:5, Insightful)

    by TD-Linux ( 1295697 ) on Thursday November 18, 2010 @09:35AM (#34267586)
    I would think that the risk of prolonged downtime in a factory that plows through millions of dollars a day would be enough of an incentive for any manager to tighten their security.
    • Re: (Score:3, Insightful)

      by Ryanrule ( 1657199 )
      But you see, that is the fault of some IT guy they can just fire. But a VP would have to submit outrageous expenses for such security, and that would hurt his bonus.
    • Re:Legislation? (Score:5, Insightful)

      by Tom ( 822 ) on Thursday November 18, 2010 @09:51AM (#34267782) Homepage Journal

      No, it isn't. Humans in general and managers in particular are famously bad at correctly estimating the factors of low-probability/high-impact risks. Not always in the same direction - we vastly overestimate the risk of some stuff, and vastly underestimate others. But we're almost always off, and by several orders of magnitude.

      And don't forget the human factor - the risk for the manager is not millions of dollars of company assets, that is an abstract figure at best. The risk to him is the loss of his job, which is lower in both value and likelihood than the event itself. However, spending money on security is a 100% loss of profit which will impact the bottom line, profit, quarterly report, etc. with a very high probability of negative impact on his bonus or raise.

      Unfortunately, almost everything you learn about management or governance acts as if "the company" would make decisions, and not humans. And ignores that humans have a more personal context that also influences their decisions, and routinely overrides even those cases where the optimal decision can be clearly demonstrated.

    • As long as it doesn't break, then they're not going to sink a lot of money into security and contingency. Hard for management to justify a big expenditure without any obvious problem.

      When it does break, then you'll see some meaningful change.

  • So first the goverment makes the most malicious worm possible to do their bidding in wiping out the enemy, and then the goverment figure they can use this worm as an argument for imposing more restrictions and expanding their power.

    Next up: the police starts killing people so they can use the higher homicide rates to motivate expansion.
    • My though exactly. Kill two birds with one stone.
      But at least the government is becoming more efficient.
      • by mcvos ( 645701 )

        You mean the only way the government can get it right, is when they intend to fuck things up?

    • Sounds like the ultimate cyber conspiracy.
    • I find the US government to be a bit weird.

      It tries to impose regulations in places where they probably shouldn't, and leave it as a free-for-all on places where it should.

      And before someone mentions "Socialism", you should probably google what that word means.
  • by SuricouRaven ( 1897204 ) on Thursday November 18, 2010 @09:37AM (#34267612)
    As sophisticated as Stuxnet is, it still relies on people doing Very Stupid Things. The solution isn't government intervention to control how everyone designs their networks (They'd be perpetually ten years behind current technology anyway), but to just weather the current panic, learn from it, and remember CHANGE THE DEFAULT PASSWORDS and USE A FIREWALL! The only reason this has been such a problem is that industrial control networks are designed by people with insufficient training in IT security, so often even the most common-sense measures are neglected.
  • by Thomas Charron ( 1485 ) <twaffleNO@SPAMgmail.com> on Thursday November 18, 2010 @09:38AM (#34267616) Homepage

    Don't exaggerate the issue. The exploitation of PLC's by Stuxnet is akin to a device on your car vehicles CAN bus issueing commands across the network. Does your cars radio require authentication? Newp. How about your speedometer? Newp.

        What StuxNet *does* emphasize is why it's a very, VERY dumb idea to have a network with PLCs connected to an external network of any kind.

        "OMFG, I can't believe my cancer test came up negative because some hax0r compromised it. What kind of suck software was RUNNING on that device?"

        OOOOOOoorrrrrrr..

        "OMFG, you idiots, WTF would you connect a device which is going to tell me if I'm *DYING* to the MTF internet?!?!"

    • by dbIII ( 701233 )
      We all know this, but the stupidity arises from having an interface that requires change to be done by connecting via something that has previously been connected to the outside world. An isolated network isn't isolated anymore once somebody connects their malware ridden laptop to it.
  • Blowback (Score:3, Insightful)

    by srussia ( 884021 ) on Thursday November 18, 2010 @09:38AM (#34267628)
    Ain't it a biatch.
  • There are lots of choices. Just avoid using Seimens controllers. Problem solved!

  • "Think of the children!"
  • lol the irony (Score:2, Insightful)

    by Anonymous Coward

    Its probably American dollars that paid for stuxnet in the first place (by way of "Aid" to certain countries)

    just deserts come to mind

  • Obviously, this virus showed that nuclear security is much harder problem then anyone realised before. Nuclear plants are using on unsecure closed-source programs. It is unlikely that anyone competent reviewd sources of these programs. It should be remebered that all arguments on how "new reactors" are now safe, as opose to Chernobil, are invalid, all of a sudden and there is little Nuclear Lobby can do in short term to restore safety argument.
    • by khallow ( 566160 )

      It should be remebered that all arguments on how "new reactors" are now safe, as opose to Chernobil, are invalid, all of a sudden and there is little Nuclear Lobby can do in short term to restore safety argument.

      And why are those arguments invalid? Keep in mind that some reactor designs, such as pebble bed, are sufficiently safe no matter what the computer systems are doing.

      • Well, if there is mechanical "switch" independant of what any microcontroller says (like: mechanical switch connected to microcontroller in cars. You can "push breaks" in SW, albait it is mechanical part), then I am accepting your argument. For this however, design of nuclear power plants should be open for review.
        • Well, if there is mechanical "switch" independant of what any microcontroller says (like: mechanical switch connected to microcontroller in cars. You can "push breaks" in SW, albait it is mechanical part), then I am accepting your argument.

          Besides this there are reactor designs that are prevented from exploding or melting down by the laws of physics, regardless of any control system tries to do be it a mechanical switch or a microcontroller.

  • by blind biker ( 1066130 ) on Thursday November 18, 2010 @09:57AM (#34267852) Journal

    Seriously, who TF came to the idea that all WANs are to be extinguished and only the Internet can be used for site-to-site networks? Maybe I'm showing my age, but I don't care: when I was working in IT (before returning to academia), private WANs were the norm, and nobody even dreamt of connecting any part of a company network, no matter how unimportant, to the Internet. Somehow, common sense wasn't snuffed entirely. Oh, and we did have e-mail, shockingly enough, which was nicely routed to the Interent (if the e-mail address was an Internet e-mail address).

    • What makes you (and half of Slashdot) think that Stuxnet was designed to primarily attack systems that are connected to the Internet?

      It's not. It's designed to use multiple propagation strategies to get over air-gaps, helpfully transported by people who need to use both a) internet connected resources and b) private network resources. Once it's over the air-gap, it then spreads just fine within the private internal network. But it *does not* require sensitive assets to be on the public internet to be a genu

  • by HangingChad ( 677530 ) on Thursday November 18, 2010 @09:58AM (#34267858) Homepage

    So the US government launches a cyber attack aimed at Iran's nuclear production and now the government wants to protect us from cyberthreats?

    Where have I heard that before? Oh, yeah! We woulds hate to see bad tings happen to yas.

    Besides taking naked pictures of you at the airport, now the government will be infiltrating your office network to protect you. Boy, I feel so much safer now.

  • Stop running your robots with a computer running windows 98 (or winxp that auto-logs-in to admin on bootup). Stop putting those same computers on the Internet because Jim the Operator needed to read his email. Buy a dedicated computer for that, and remove/disable the NIC on the controller computer.
  • Why does it always follow the outline:

    [INSERT REAL OR IMAGINED DANGER HERE], so the only solution is for [INSERT GOV'T BRANCH HERE] to [INSERT DESIRED ACTION HERE].

    "The growing danger, said lawmakers, makes it imperative that Congress move on legislation that would expand government controls and set requirements to make systems safer."

  • This is a wake-up call. It is one that has been missing for a long time. Thankfully, it is not damaging to ANYTHING. The ONLY downfall is that if you are running the German designed centrifuges, then it will only mix Uranium with a tolerance that is acceptable for Nuke Plants. Basically, it does not have high enough tolerance for bombs. The problem for Iran is that they obviously have ZERO intentions of doing this work for nuke plants like they claim. It is all for bombs.
  • The only reason we survived the cylons was by not having our computers networked for "increased efficiency". We are doomed.
  • If foo works on one system, and foo is adaptable, then foo + bar might work on another system.

    We can make jokes about the Windows OS and giving vital machines an active presence on the Internet all day long (and it seems we have), but that would be missing the point. What we have here is a virus which has been proven to work, and which like many viruses, can be altered to infect other systems. People who say these organizations should run OSX or Linux, who's to say this virus can't be recoded to work o
  • "The growing danger, said lawmakers, makes it imperative that Congress move on legislation that would expand government controls and set requirements to make systems safer."

    Uh NO... it makes it imperative that security folks get better training! Why does this government think they can fix everything by expanding government controls???
    • Government doesn't think it can fix anything by expanding government controls, it just thinks it can get people to accept government controls if it claims they are going to fix problems.
  • Anyone involved in industrial control systems - especially nuclear fuel refinement, for Bob's sake - needs to look up "air gap" in a dictionary. It's not a guarantee of security, but it's a start.

  • Get the dropdown right on the first try. No submit button for you!

    AJAX isn't necessarily a bad thing, but incompetent web developers replacing good interfaces with bad ones, sure is.

  • by Fantom42 ( 174630 ) on Thursday November 18, 2010 @11:36AM (#34269352)

    Many of the comments here seem to be unaware of what Stuxnet actually is or how it works. Symantec has a great whitepaper on it that is updated as they learn more. 50 pages of technical detail. Of course you can read the executive summary and at least avoid making the kinds of uniformed comments I'm seeing here.

    http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf [symantec.com]

    Just a Few:

    1. "People are so stupid to connect their industrial control system to the internet!"

    Stuxnet does not require internet access. It delivers its payload in various ways, and in particular, if an infected USB stick is inserted into a susceptible machine, it will find a machine on that network with the Siemens PLC development environment and infect it in such a way to insert hidden malicious code into the PLC.

    2. "Just don't run Windows"

    There is some validity to this idea. But the payload was not delievered to a Windows machine, just via one. How many embedded controller development environments require a Windows machine? Try coding a Xilinx FPGA without a Windows box, or just about anything out there without one.

    3. "We could have seen this coming"

    Most people did see this coming. But they didn't think it was actually plausible to defend against. The Stuxnet worm required a huge amount of resources and detailed knowledge to pull off. Everything from the payload to the infection method. Someone really thought this through. It is a proof of concept of what people generally believed to be only possible in theory.

    The fact that government is getting involved here is a bit worrisome. I hope they at least pay attention to the existing specifications already out there to help mitigate some of these threats. NIST 800-82 is a decent read that is free (final public draft) and there are other pay ones out there as well.

    The reason why I am kindof annoyed about people's ignorance about Stuxnet is because the biggest lesson learned from it is largely being ignored. 1. That "air gap" protection you think you have is not as good as you think it is. 2. The "insider threat" is worth thinking about, even if you trust your insiders. They may not know they are a threat.

How many hardware guys does it take to change a light bulb? "Well the diagnostics say it's fine buddy, so it's a software problem."

Working...