Stuxnet Infected (But Didn't Affect) Chevron Network In 2010 82
Penurious Penguin writes "The Wall Street Journal, in correspondence with Chevron representatives, reveals that back in 2010, Stuxnet reached Chevron, where it managed to infect — but not significantly affect — the oil giant's network. According to a Chevron representative speaking to CNET, the issue was 'immediately addressed ... without incident.' The Stuxnet worm is believed to be the work of the U.S. and Israel, and this report is confirmation that it struck well wide of its intended targets. Chevron's general manager of the earth sciences department, Mark Koelmel, said to CIO Journal, 'I don't think the U.S. government even realized how far it had spread ... I think the downside of what they did is going to be far worse than what they actually accomplished.'"
Payload was specific - Transport, not so much (Score:5, Informative)
The transport used was fairly generic in nature, but since the payload was aimed at a specific controller [wikipedia.org] used on centrifuges its not surprising that it had little effect elsewhere [symantec.com].
Even if that Siemens motor controller was common, its use case in Iran was rather specific, and chances are the payload was pretty specific to exact firmware levels. From Wiki:
While the worm is promiscuous, it makes itself inert if Siemens software is not found on infected computers, and contains safeguards to prevent each infected computer from spreading the worm to more than three others, and to erase itself on 24 June 2012.
Had it been given a shorter life span than two years, chances are it would never have been discovered.
The real risk here is that others have climbed on board this train and are using essentially the same engine for other purposes.
I wonder... (Score:5, Insightful)
Unless Chevron is running centrifuges in Iran, Stuxnet probably wouldnâ(TM)t have been much of an issue as the Stuxnet code was pretty specific. But of course the real issue for Chevron it *how* they allowed Stuxnet to infect at all? What was the vector, and why was it either Interwebs connected or techs were using infected thumb drives?
Re:I wonder... (Score:4, Insightful)
Re: (Score:2)
Our govt has a very tight relationship with Microsoft, Symantec and McAfee. It's not surprising that certain things are not flagged as malicious. It's also curious that there are signatures in their database for things that have never been officially found in the wild. It's been noted a few times that Kasperasky has added signatures for virus's and trojans long before they show up in the wild.
Re: (Score:2)
Our govt has a very tight relationship with Microsoft, Symantec and McAfee.
Given the impossibility of keeping ANYTHING secret in this country, how can you make such statements without a shred of proof? If such existed, someone would have spilled the beans long before now.
There are other anti-virus products produced in Russia and Germany. These too totally missed Stuxnet.
Are these companies compromised by the US government as well?
Hanlon's Razor:
Never attribute to malice that which is adequately explained by stupidity.
It seems far more likely to me that McA
Re: (Score:1)
I take exception to your statement the government can not keep secrets.
The CIA has a budget estimated at 10's of billions dollars per year. The Military intelligence agencies probably at least that much as well. They obviously do something with that money.
How many intel related operations and actions can you directly cite that are confirmed or well known to be intel. operations?
They manage to keep their day to day operations around the world pretty well secret I feel. And have for many years.
Re: (Score:3)
LOL
Posting this the day after the head of the CIA is forced to resign. Priceless
http://m.voanews.com/1543302.html [voanews.com]
Re: (Score:2)
Posting this the day after the head of the CIA is forced to resign. Priceless
Which has exactly ZERO to do with keeping or not keeping secrets.
In other words, so what?
Re: (Score:1)
Re: (Score:2)
The CIA has a budget estimated at 10's of billions dollars per year. The Military intelligence agencies probably at least that much as well.
What other military agencies? I though the CIA was a military agency itself
Re: (Score:2)
Re: (Score:2)
We got a tiny feel for it via news about http://en.wikipedia.org/wiki/Magic_Lantern_(software)#Antivirus_vendor_cooperation [wikipedia.org]
"FBI taps cell phone mic as eavesdropping tool"
http://news.cnet.com/2100-1029-6140191.html [cnet.com]
http://arstechnica.com/information-technology/2008/01/bavarian-government-caught-looking-for-skype-backdoor/ [arstechnica.com]
So yes its "spilled" but usually years later and seems more of a telco/crypto/hardware/software curiosity by man
Re: (Score:2)
Our govt has a very tight relationship with Microsoft, Symantec and McAfee.
And oil companies like Chevron?
Re: (Score:1)
If it was anything like the spread at our work thumb drives is only one of the possible methods of attack. The others mimicked the conficker worm can is able to spread over peer to peer networks. In a company with many 10s of thousands of employees I'm not surprised they got infected. We here at an only slightly smaller than Chevron oil company got infected too, but the virus never made it as far as our control system networks. It spread globally through the business network though until they took all the f
Re: (Score:2)
Where I work, p-2-p is blocked, and are most streaming / download services. As well, plugging a thumb drive into your desk-top logs you out and blocks your account - which is kind of stupid since portable hard drives work fine - but only if the guid for the device is registered on the network (but of course that could be spoofed).
The REAL deterrent is that if they catch you using unauthorized hardware / software, you get escorted out permanently.
At least that's the way we do it were I work...
- Frosty
Re: (Score:2)
Probably infected thumb drives. Or hooking the infected PC to the airgapped network to update the software.
These networks are airgapped for security as well as keeping
Virus gives "Germ Warfare" (Score:2)
Sabotage (Score:3)
You have a choice between real people dying or computers catching a virus... The more effective we are in slowing down Iran's nuclear program, the more time we have before we need to resort to military action...
Lemme start by saying that I agree.
But isn't sabotage an act of war?
The US seems to think so: http://www.geek.com/articles/news/pentagon-rules-cyber-attacks-and-sabotage-constitute-an-act-of-war-20110531/ [geek.com]
And that it justifies military response.
Re: (Score:2)
You have a choice between real people dying or computers catching a virus... The more effective we are in slowing down Iran's nuclear program, the more time we have before we need to resort to military action...
Lemme start by saying that I agree.
But isn't sabotage an act of war?
The US seems to think so: http://www.geek.com/articles/news/pentagon-rules-cyber-attacks-and-sabotage-constitute-an-act-of-war-20110531/ [geek.com]
And that it justifies military response.
Countries weigh the cost vs benefits when engaging in a war, not all 'acts of war' are created equal.
If hundreds or thousands of citizens die in an attack like the USS Maine (Spain), RMS Lusitania (Germany), Peril Harbor (Japan), 9/11 (Afghanistan), the US responds with an all out war where both sides suffer causalities. Other cases like the theft of American's property (Cuba), an embargo is sufficient for us to tell them that we don't like 'em.
During none of the wars listed above did the US ever have a sig
Re: (Score:1)
There is 0 evidence that Iran is developing nuclear weapons. The CIA said as much.
I trust them more than I trust a bunch of war mongering politicians and lobbyists for a certain country.
Re: (Score:3)
There is 0 evidence that Iran is developing nuclear weapons. The CIA said as much.
There is the uranium enrichment process which is most of the work. Reading through intelligence reports [nytimes.com], it appears that Iran is deliberately putting off the most provocative steps for now (well as of perhaps 2010, who knows about now). But that's not the same as "zero evidence".
If one looks at the US Manhattan project, most of the work done outside of New Mexico was uranium and plutonium refinement. That required vast amounts of energy and huge complexes in numerous states. It was only in New Mexico at
Re: (Score:1)
Another key bit of evidence is the extreme hardening of much of their uranium enrichment facilities against conventional attack. If these facilities were just for civilian use, then they wouldn't have enough value to justify the degree of hardening used.
Maybe if they weren't being targetted by Mossad thugs they could afford to have unsafe nuclear facilities. As it is, their (civilian!) scientists are being killed left and right, and there was (at least) one (digital) attack in one of their facilities. You can't blame them for trying to defend themselves from attackers If it were your country instead you'd be all for defending from the agressors, but since they're dirty sand-niggers they obviously deserve it.
Re: (Score:2)
they have been actively targeted by multiple military organizations, so it is perfectly reasonable for them to harden such facilities even if they aren't trying to develop a weapon.
No. I don't buy that at all. I mostly agree with the second paragraph, but there are two addition concerns, both which coincide with your observation. Iran can also chose to use any nukes it makes. Nobody trusts them with this stuff. Also, we have to consider the other countries in the area. Saudi Arabia and Egypt may decide to develop nuclear weapons of their own in response.
And Iran may pass on its knowledge or nuclear weapons themselves to its non-terrorist allies/associates such as Venezuela or North
Re: (Score:2)
Maybe if they weren't being targetted by Mossad thugs they could afford to have unsafe nuclear facilities.
And there's that third piece of evidence. One doesn't just get targeted by "Mossad thugs". It's not like the weather.
You can't blame them for trying to defend themselves from attackers If it were your country instead you'd be all for defending from the agressors, but since they're dirty sand-niggers they obviously deserve it.
No blaming is going on here. But I don't mind making "trying to defend themselves" as hard as possible.
Re: (Score:3, Insightful)
You have a choice between real people dying or computers catching a virus. Personally, I prefer the latter. The more effective we are in slowing down Israel's nuclear program, the more time we have before we need to resort to military action. I think everyone can agree harsh sanctions and computer viruses are preferable to all-out war. That is, so long as they work. Those who criticizes legitimate sanctions and the passive actions like computer viruses doesn't understand that their actions are just leading to all-out war.
FTFY.
Also, you could change that to "The more effective we are in slowing down the USA's nuclear program, the more time we have before we need to resort to military action", but I think you get the point. Or I hope you do.
Re: (Score:1)
I'm afraid of the country that thinks absolutely nothing of blackmailing its "allies" at every turn.
Good Grief. (Score:2)
I think the downside of what they did is going to be far worse than what they actually accomplished.
So you think nuclear proliferation is acceptable and that Iran will manage being a Nuke Bomb owner in a sensible way? Really?
A "bomb" in the hands or the Iranians is truly a terrifying thing.
Re: (Score:3)
Re: (Score:2, Insightful)
I think the downside of what they did is going to be far worse than what they actually accomplished.
So you think nuclear proliferation is acceptable and that Iran will manage being a Nuke Bomb owner in a sensible way? Really?
A "bomb" in the hands or the Iranians is truly a terrifying thing.
And hundreds of bombs in the hands of crazy terrorist harboring and financing muslim government no eh ? See Pakistan.
And although India is not a muslim country, they are about as trigger happy as the Pakistanis insofar as nuclear weapons are concerned.
Israel, has hundreds of nuclear warheads, the majority of which are being carried on modern AIP submarines bought from Germany.
And what about NK, a crazy country that fires real artillry shells on South Korea and even sinks SK ships ?
The least of our worries i
Re: (Score:2)
See Pakistan.
Of course Pakistan is a HUGE concern. But that doesn't mean we should ignore Iran.
Re: (Score:1)
And although India is not a muslim country, they are about as trigger happy as the Pakistanis insofar as nuclear weapons are concerned.
Fuck you! India has always held a non-first use policy (in other words, it will be used only as a retaliation to a nuclear strike). They have pretty open about this policy. I have never heard any one complain about Indian nuclear policy (unlike Pakistan which refuses to promise non-first use)
Re: (Score:2)
Your neighbor who you just had war with, just started testing nuclear explosions. You would be silly and stupid to not do the same. If it comes to war, why is far fetched to imagine China nuking India? The only deterrent is India having nuclear weapons, and keeping the ability to retaliate in kind. Now that India has it, we would never know if China would have nuked non-nuclear India when it comes to war between them (which would eventually have to happen at some point of time in the future, may be decades/
Re: (Score:2)
Actually, make that, you had just lost a war with your neighbor, and you had to concede a strategically significant piece of land you had under your control. Now your neighbor starts testing nuclear weapons.
Re: (Score:2)
Pakistan as a state has had decent relations with Israel forever. Just because there are some lonnies in Pakistan that would like to see Israel disappear doesnt mean Pakistan does not work well with Israel. Hell Pakistan even acquired radars from Israel. There have been times when their relations were very very cordial.
Europe was also unstable for a long time too, in the past. Rest of Asia too. It doesnt mean the present conflicts and overthrowing of governments are not being orchestrated by the west.
Re: (Score:1)
I think the downside of what they did is going to be far worse than what they actually accomplished.
So you think nuclear proliferation is acceptable and that Iran will manage being a Nuke Bomb owner in a sensible way? Really?
A "bomb" in the hands or the Iranians is truly a terrifying thing.
And hundreds of bombs in the hands of crazy terrorist harboring and financing muslim government no eh ? See Pakistan.
And although India is not a muslim country, they are about as trigger happy as the Pakistanis insofar as nuclear weapons are concerned.
Israel, has hundreds of nuclear warheads, the majority of which are being carried on modern AIP submarines bought from Germany.
And what about NK, a crazy country that fires real artillry shells on South Korea and even sinks SK ships ?
The least of our worries is Iran.
But I guess, same as Iraq, when you can't kind a rational casus belli just invent one. Now where are those WMD in Iraq ?
I agree, it's quite disturbing that Israel has these weapons.
Re: (Score:3)
Re: (Score:2)
I am and no fear was created.
maybe you could update your troll bait since he lost the election.
Re: (Score:2)
I am not an American, but I will tell you it is no accident that Russia had 2 nuke subs parked off the coast this week.
The perception of everyone I speak to is that Romney is a crazy. His being elected would lead to a major war using false flag in a matter of months.
What amazes me is the perception of Romney voters, they simply cannot see it.
Re: (Score:2)
Re: (Score:1)
It's somewhat naive to think that Iran hasn't already purchased some nuclear weapons from a country that is willing to sell. North Korea wasn't interested in nuclear weapons for it's own use, so much as the political clout it brings and the financial benefit of being able to sell to countries like Iran. It Israel and Iran start to duke it out, I expect Israel would use small scale nuclear weapons first.
Re:US is truly more terrifying (Score:1)
Americans are crazy and have no problem invading one foreign country after another. Even a foreign country that has done nothing wrong to them but has been bombed and its own citizens put into oppression the American government and their allies.
At least Iran does not invade other countries nor threatens them unless of course the other countries interfere with them first.
A reminder it was the US government who installed the Shah in the first place that started that countries hatred to the US. If any country
Re: (Score:2)
A nuclear weapon in the hands of people who have already used them and call for 'FIRST STRIKE' is truly a terrifying thing. There fixed it for you, at least it's accurate now. Especially when those same people are all to happy to murder innocent people by remote control and guilt it measured by, seems like they might be up to something, kill them anyhow and success is measured by effective of public relations lies about success and it's treason to tell the truth.
Re: (Score:2)
Not quite.
Most of those killed in drone attacks were terrorists: military [dawn.com]
Re: (Score:2)
Innocent until publicly proven guilty in a court of law dickwad.
Re: (Score:2)
Innocent until publicly proven guilty in a court of law
You are quite mistaken, and a big hint is your phase, "court of law." A court of law is used in criminal matters to judge guilt or innocence before imposing punishment of the guilty. Dealing with Al Qaida, the Taliban, and company, is primarily a question of war and military action, not law enforcement, arrests, and courts of law. (Besides, what legal jurisdiction do you propose over the tribal territories in Pakistan? The Pakistani government itself cannot reliably control events there.) Bin Laden mad
Re: (Score:1)
A "bomb" in the hands of the Iranians is truly a terrifying thing.
The USA is the only country to deploy nuclear weapons (Japan), anthrax (Korea), napalm or agent Orange (Vietnam) during a war. A "bomb" in the hands of the Americans is a truly terrifying thing.
Not a surprise (Score:1)