Water Pump Used To Get $1 Billion Stuxnet Malware Into Iranian Nuclear Facility (securityweek.com) 36
An anonymous reader quotes a report from SecurityWeek.com: A Dutch engineer recruited by the country's intelligence services used a water pump to deploy the now-infamous Stuxnet malware in an Iranian nuclear facility, according to a two-year investigation conducted by Dutch newspaper De Volkskrant. Stuxnet, whose existence came to light in 2010, is widely believed to be the work of the United States and Israel, its goal being to sabotage Iran's nuclear program by compromising industrial control systems (ICS) associated with nuclear centrifuges. The malware, which had worm capabilities, is said to have infected hundreds of thousands of devices and caused physical damage to hundreds of machines.
De Volkskrant's investigation, which involved interviews with dozens of people, found that the AIVD, the general intelligence and security service of the Netherlands, the Dutch equivalent of the CIA, recruited Erik van Sabben, a then 36-year-old Dutch national working at a heavy transport company in Dubai. Van Sabben was allegedly recruited in 2005 -- a couple of years before the Stuxnet malware was triggered -- after American and Israeli intelligence agencies asked their Dutch counterpart for help. However, the Dutch agency reportedly did not inform its country's government and it was not aware of the full extent of the operation. Van Sabben was described as perfect for the job as he had a technical background, he was doing business in Iran and was married to an Iranian woman.
It's believed that the Stuxnet malware was planted on a water pump that the Dutch national installed in the nuclear complex in Natanz, which he had infiltrated. It's unclear if Van Sabben knew exactly what he was doing, but his family said he appeared to have panicked at around the time of the Stuxnet attack. [...] Michael Hayden, who at the time was the chief of the CIA, did agree to talk to De Volkskrant, but could not confirm whether Stuxnet was indeed delivered via water pumps due to it still being classified information. One interesting piece of information that has come to light in De Volkskrant's investigation is that Hayden reportedly told one of the newspaper's sources that it cost between $1 and $2 billion to develop Stuxnet.
De Volkskrant's investigation, which involved interviews with dozens of people, found that the AIVD, the general intelligence and security service of the Netherlands, the Dutch equivalent of the CIA, recruited Erik van Sabben, a then 36-year-old Dutch national working at a heavy transport company in Dubai. Van Sabben was allegedly recruited in 2005 -- a couple of years before the Stuxnet malware was triggered -- after American and Israeli intelligence agencies asked their Dutch counterpart for help. However, the Dutch agency reportedly did not inform its country's government and it was not aware of the full extent of the operation. Van Sabben was described as perfect for the job as he had a technical background, he was doing business in Iran and was married to an Iranian woman.
It's believed that the Stuxnet malware was planted on a water pump that the Dutch national installed in the nuclear complex in Natanz, which he had infiltrated. It's unclear if Van Sabben knew exactly what he was doing, but his family said he appeared to have panicked at around the time of the Stuxnet attack. [...] Michael Hayden, who at the time was the chief of the CIA, did agree to talk to De Volkskrant, but could not confirm whether Stuxnet was indeed delivered via water pumps due to it still being classified information. One interesting piece of information that has come to light in De Volkskrant's investigation is that Hayden reportedly told one of the newspaper's sources that it cost between $1 and $2 billion to develop Stuxnet.
Dead, two weeks after payload deployment (Score:5, Informative)
Re: Dead, two weeks after payload deployment (Score:2)
Re: (Score:2)
Spook: will you ...
You: no.
Re: (Score:1, Funny)
That's still two weeks longer than if he were to have discovered incriminating evidence about Hillar---
Smart (Score:3)
Re: Smart (Score:2)
Stuxnet wasn't even worth it (Score:4, Interesting)
Stuxnet began to successfully interfere with the centrifuges, but Mossad was impatient and got greedy, and pushed an update that would make the sabotage happen more frequently. An engineer noticed the malware attempting to update by pure chance, and it led to the *massively expensive* operation being discovered and made worthless. They did manage to get a few nuclear engineers executed by the Iranian government, however, as they were suspected of the sabotage.
I really recommend Episode 7 of the Malicious Life podcast, which goes into great detail about Stuxet
Re: (Score:2)
Re: (Score:2)
I had thought this was on relatively standard 'big iron' type equipment, hence the problem when it got out...it became a world wide problem expressly because it was compatible with a wide base of installs. Maybe it's just time inflation but 1-2 billion doesn't seem terribly high for something like this.
Re: (Score:2)
I can wrap my brain around a $200 hammer as a physical good. Things get expensive once you factor in certifications, machining to tight tolerances, low production volumes, etc.
But software? You aren't really going to get efficiencies by putting more than a few dozen people on the project. Even if you're paying every single member of that team millions per year and need to build them a bespoke undergroup facility to work in or something, you're still at least an order of magnitude away from a billion. T
Re: (Score:2)
It's grift
Re: (Score:2)
Definitely several orders of magnitude cheaper. I guess this guy just tried to misrepresent his own worth by overstating the cost of the op.
Hero (Score:2)
Re: (Score:3, Insightful)
Re: (Score:3)
Nope. This is black. Have you overlooked what _other_ damage it did? Actual white hats are careful in targeting stuff.
Re: (Score:2)
What other damage did it do? From my reading, Stuxnet was remarkably narrowly targeted and only actually broke things in the Iranian nuclear program.
I'm personally agnostic on whether it constitutes "white" or "black" hat hacking.
Re: (Score:2)
Penetrating in secret with the intention to cause damage isn't white hat, even if you believe they're the good guys.
key learning separate your different control nets. (Score:1)
key learning separate your different control nets when doing something like this that someone else may be interested in destroying.
One set to control your super critical nuclear centrifuges and one net to control the water pumps and other required equipment or maybe even separate each set of networks for each different supplier of industrial equipment so something cannot be come in on one piece of less carefully examined/controlled equipment and infect/destroy other components in a more critical area.
And cl
Re: (Score:2)
The other key learning is that even when something is _this_ critical to a nation, they still screw up hiring the right people for IT security.
Infiltrated? (Score:1)
That sounds like he went and installed a water pump, without them knowing. I am willing to bet it actually means "Went to work there to install a water pump"
Re: Infiltrated? (Score:2)
Uh⦠less James Bond, more real world. Hiring someone into a valid job is a perfectly normal form of infiltration.
What about his wife's family? (Score:5, Insightful)
Re: What about his wife's family? (Score:1, Troll)
Journalists: Destroying peoples lives since they started writing.
Note to everyone: never, ever, ever trust a journalist. Ever. Never disclose any information. In the end, their only end goal is to destroy and discredit you and the people you love all in the name of âoejournalistic integrity.â
Re: (Score:2, Redundant)
Stuxnet in a water pump? (Score:3)
Article says
Ralph Langner, a researcher who conducted an in-depth analysis of Stuxnet after the malware’s existence came to light, noted that “a water pump cannot carry a copy of Stuxnet”.
Indeed, I wonder how it moved laterally from the water pump. Was it a connected water pump? What fool would grant network access to a water pump in a nuclear facility?
Re: (Score:2)
Re: (Score:2)
After all, a water pump for a nuclear power plant is nothing like the water pump in your car.
Re: (Score:2)
The variable frequency drive could controlling the water pump is more likely. Modern ones are quite talkative and on Ethernet networks. The slightly older ones use Modbus.
Re: Stuxnet in a water pump? (Score:2)
What fool would grant network access to a water pump in a nuclear facility?
Water pumps in a nuclear facility are more complicated than the one in your turtle tank?
Re: (Score:2)
Well, a water pump cannot, but a networked control unit for a water pump sure as hell can.
A lot of innuendo in that article. (Score:2)
$1 and $2 billion (Score:1)
it cost between $1 and $2 billion to develop Stuxnet
I call BS on this. You could pay an army of 1,000 software developers $1 million each at that rate. Or a huge team of 100 developers $10 million each. The numbers don't make sense.