rayne! brilliant post.

Nice to see you, rosalind and jo6pac. ;-)

Good gravy but that Langner gets this geek grrl hot under the collar. Unf. I’m really digging the point he makes in the presentation to NATO above, right here:

[40:13] The big problem that we have, as good and intelligent as it sounds, is proliferation. The proliferation of cyberweapon technology cannot be controlled for one very simple reason. When you think about nuclear weapons, what a proliferant needs is, in a nutshell, the know-how to do it, and then he needs the fissile material. And for counter-proliferation your only chance to do anything, is in respect to the production and the distribution of the fissile material. You can’t do anything about the spreading of know-how. So if you’re an engineer and you do some research you’re going to be able to design, develop, and produce your own nuclear weapon–if you have fissile material. All counter-proliferation is affecting the development, the production, and the distribution of fissile material.

[41:20] Now let’s look how this looks like in respect to cyber weapons. You also need know-how, but you don’t need fissile material, you only need bits and bytes. And you can’t control the proliferation of bits and bytes. That’s impossible.

Anybody working with cyberweapons must understand this maxim: Information wants to be free.

Not free like beer, but free like a puppy. It must move around and it will make a mess, and those who choose cyberweapons must be willing to deal proactively with this fundamental truth.

EDIT – 7:55pm EST —
Damn but I frigging love this presentation to NATO in the embedded video as much as I love the SCADA one.
At 1:04:27 my sweet geek boy Langner says, “…And you can’t secure what you don’t understand.” The previous minute he basically outlines a case for futureshock–even the designers no longer understand the entire system. They only grok their little bit. Clearly, the Senate Intelligence Committee cannot comprehend this.

@bmaz:

1) Find something that really fucking pisses you off. Won’t take long. Don’t settle for merely annoying; pick the thing that makes you wish you had access to a programmable personal drone and a lack of morals.

2) Pour yourself a stiff cocktail, take a few swigs, let the burn get a firm grip on your already burning belly. (My latest poison is some cheap gin I need to excise from my inventory.)

3) Dump. Make a cloud of pixels fly above your head.

4) Edit for lucidity but not for politeness.

5) Hit Publish.

There you go, my secret methodology for righteous ranting.

Recall Congress’ reaction to the risks from Y2K; Stuxnet and its precursors and variants may pose a far bigger risk than Y2K, worthy of deeper consideration.

Y2K posed no risk. Microsoft computers could not count up to 2000. Laughably hilarious.

Bill Gates was worried about lawsuits because his defective computer operating systems could not change 1999 to 2000. There was little actual consequence other than hype. Stuxnet operates on the vulnerabilities of their present defective operating systems of Microsoft.

Microsoft does not fix its vulnerabilities. It exploits them for profit. Taxpayers get to pay for Microsoft’s patented spyware. Any critical systems that use Microsoft, can and will be hacked.

@Frank33: You’ll think differently after watching Langner’s videos. As he says, “…this is how the pros do it,” using so-called “design flaws” not vulnerabilities. Zero day exploits are “design flaws.” How is it there are so many holes in this cheese even after several different generations of this operating system?

Microsoft has become an asset, in the same way that Erik Prince and Blackwater were assets. For all intents and purposes this company was the fifth but silent partner in Operation Olympic Games.

As for Y2K: nobody really knew pre-2000 what the degree of risk was for Y2K failures, because nobody really thought that far ahead when they wrote code. Developers typically concentrated on solving for X — they didn’t think, ‘solve for X AND don’t cause future problems’ of a kind that might not be predicted in 1988.

This same focused mindset is in part what allowed Stuxnet to become a global risk. Each cluster of developers concentrated on taking out their portion of the Natanz program. One can easily see any overall umbrella program manager keeping an extremely low profile, forcing each portion of the project to work in a silo so as to preserve plausible deniability. Injection team (specializing in Microsoft OS) probably had very little to do with the PLC team (specializing in Siemens app); only a test bed team may have seen the entire project, and that’s debatable.

@Gitcheegumee: LOL nice to see you stop by to see me scream out the window into the void!

—–

Have been thinking for a year-plus now about the likely solution to Stuxnet for any business using PLCs.

It’s not debugging Siemen’s SCADA software to patch against this infection. The infection could reoccur at any time, on the fly, as long as the PLC is attached to a network and Microsoft apps are involved.

* Rip out Siemens PLCs, for starters–and Siemens surely must have had some idea this was a risk, or were they that stupid, too? Is it possible the were compensated for the potential loss of PLC business?

* Swap out middleware/communications environment and relevant OS up to the PLCs with open source–a business could do that, but this may have some wrinkles of its own in terms of support. If the gov’t is the entity involved and not a private business, you can expect Microsoft to launch a massive FUD program to halt a change away from their proprietary system. Just ask the state of Massachusetts about their experience.

* Reduce all links between networks and PLCs–this is probably the single easiest measure, but highly dependent on the nature of the business.

For starters. Don’t get me going about ports on devices.

Aha!
I didn’t read the other comments first, my bad. I get it now.

That article about Linux usage throughout the world was really interesting, Rayne. One tidbit in there:

Linux popularity in the United States
In the United States, interest appears significantly stronger in Utah and California than the rest of the country. California’s high position is understandable, considering it is the home of Silicon Valley, but we are not sure why the interest for Linux is even higher in Utah. Perhaps some of our readers might shed some light on this?

Also the popularity of searches for Linux in Cuba was interesting too.

So what’s going on in Utah? What’s going on in Cuba? :)

Also, I did not realize that DiFi’s committee signed off on this. Brilliant. How many others are out there?

I couldn’t help but draw a parallel between the War on Terror and this cyberwar Stuxnet thing. In both cases, where are the biggest threats coming from? Who is creating them? Well it seems to me that we are creating the biggest threats to ourselves by ourselves. We pay to create the threats. We pay to fend off the threats. Who wins? Who loses? The war industry wins. The rest of us lose.

@Rayne: A lot of people never thought their software would be around until 2000. I started coding for the four-digit year back in the 80s. Some of my colleagues laughed at me for it. Others though it was a waste of disk space, which was very precious back then. Software doesn’t have a long shelf life, generally. But in the mainframe world, some things hung around for a long long time especially after the migration to client-server and the web, a lot of old legacy code on the mainframe was left in place and interfaces between the two were done instead of replacing the mainframe stuff.

@Bustednuckles: Howdy! nice to see you. I think for most Americans it’s not a matter of whether we love/hate a company like Chevron. It’s extremely important for the public to realize firms that deal in volatile chemical products–sensitive for their toxicity or flammability–are being processed in their very backyards using PLC equipment that may be infected.

For instance, Chevron has a refinery in Richmond CA (see this link). Note how close the tanks are located to water; I’m sure this has enabled transport of either crude inbound or gasoline/chemicals outbound by ocean tanker at the waterfront depot. However, note the proximity of family homes nearby along the water front, particulary along Ocean Avenue. (Wonder how some of these very wealthy folks feel about Stuxnet…wait, you mean nobody in major US media or government told them? Huh.)

I should point out that Chevron is hiring a SCADA apps analyst in their Bakersfield CA office, recruiting through a headhunter; their post indicates they’ll accept visas/green cards. (Amazing what one can find in Monster.com…) The guy working on PLCs will be hundreds of miles away from refineries in other people’s backyards, so it’s not personal, just business.

Ugh. I have a rather large chemical company upwind from my home. I hope like hell they’ve been hardening.

@joanneleon: Utah, like Massachusetts, has been pushing for open source to reduce costs for the state to operate. They have been on the vanguard for 6+ years now. Cuba is a matter of financial need; they cannot afford proprietary prices, have a culture of hacking all manner of goods to make do under US embargo. Further, they may not want to support an American corporation, particularly one that requires regular backdoor access to computers for so-called patches.

I think it’s critically important for Americans to realize that the ubiquity of certain applications here is not the same overseas. Germany has been a leader for 10+ years in Linux development; they do not have the same saturation of Windows OS in their manufacturing environments. A Germany entity involved with Operation Olympic Games would have an entirely different attitude toward the OS to PLC interface for this reason alone.

And yeah, I was think about folks like you who did coding back in the day. We didn’t have a lot of extra digits laying around; the earliest desktop computers were little more than faster systems for handling information that could contained on a punch card or tape, and goodness knows there wasn’t any room for two more digits on those. (Brings back nightmares from one of my earliest high school jobs–sorting punch cards every night that had been keyed with data from drawing changes for a design office at a Fortune 100 automaker. Blecch.)

I wonder if Rayne is following CrySysLab at Budapest University, and Kaspersky Lab, re SkyWiper, other advanced persistent trojans.

Another vantage I might check would be standard anomalies, like Babak’s Quantico circuit of EW blog fame back in the day of the mirror babybell nocs, when Ashcroft Buscho were signing off on FISC circumvention, exigent letters with real time co-located terminals were getting written, and guys with cellphones were putting explosives in duffle bags in Grand central station, Madrid in 2004 (Atocha).

The last CrySysLab.hu report I perused was spring 2011, at which time there were SkyWiper DLLs that were encrypted and blackbox. That was part of the stux suite, Subsequently there were other exploits possibly to modify those early DLL’s which existed in the wild, possibly also carried spy-style to unconnected instrumentation, i.e., no internet port, all proprietary private nets. Flame ostensibly was one of those.

Condoleezza Rice is delivering the conference final keynote in 4 months at RSA. Maybe someone could ask her, privately, how solid she feels about all the cyberespionage.

Chevron is partof a cartel, now, legally. It’s profit margins vary little, and its books remain robust, even when it has to shut its Richmond facility. The neighbors have a long history of toxic exposures, and most are poor and in impaired health from decades of lacking environmental regulations, though Chevron has a firm history of civic involvement. As a kid I can remember a game we played in the East Bay beginning around Benecia and ending south in Berkeley and Oakland, as that entire 30 miles of Contra Costa coast along the bay was rank with odors of petroeum refining.

One jocund elderly codewriter I met observed simply about the Y2K CLOCK function, that there was so much overtime paid to programmers of COBOL and FORTRAN who came out of retirement for 18 months around that time, that life on the sinecure looked much brighter afterward. In a way, code always was modular, looping, OOP; but new processor bandwidth has opened the door to legacy problems.

My sense, too, is that SCADA coding probably is tight in some quarters, but lax in others. Siemens, after all, has a background working as a global telco, and has made big iron for Europe, Africa, and the Middle East for 50+ years.

OK, bear with me, I am the antithesis of a computer geek.
So what I just read, if I am correct, is that Microsoft is the common platform used for delivery of these cyber attacks, yes?
All of these attacks are Windows exploits?
So, say, Using UBUNTU or some other operating system would make them impotent?
Just a quick clarification, thanks.

@Rayne:
Chevron has oilfields in Kern County, so Bakersfield makes sense. (It’s a bit more central than, say, Taft or McKittrick.)

Also, I’m not sure how much high-end housing exists in Richmond, but it probably isn’t much. It’s not considered a ‘good’ area. (My sister lives and works on the north end of Richmond. The local mall has Macy’s. Penney’s, Sears, and Walmart.)

Hmmm.

Insight: In hours, caustic vapors wreaked quiet ruin on biggest U.S. refinery
(Reuters) – In the end, all it took was a small chemical spill — perhaps less than a barrelful — to bring down the newest, mightiest oil refinery in the United States.

@qweryous: YEAH. THAT. Nice job finding that story, a good example of a what-if.

Let me make it clear that the accident at that particular refinery may have had causes that had absolutely nothing to do with malware.

BUT…that’s what Stuxnet could do. Just as it was intended to cause invisible and erroneous variability in enrichment equipment, it could be tweaked to do the same in other environs. AND the result would initially look like an accident with potentially numerous causes. A PLC regulating release-and-mix of a chemical agent could appear to go haywire; a replacement PLC might work temporarily, then do the same damned thing. The damage might be big enough to cause immediate evacuation of surrounding area and health problems, or just a little persistent annoyance and possible health problems — not to mention the financial/economic damage inflicted. This example was a billion bucks to the companies, but did this line going out of production and subsequent reporting cause prices in the gasoline market to rise? Have each of us already been paying for a possible malware attack? Will we ever know definitively the cause of this particular leak?

The public hasn’t been told about how often there are leaks in the petroleum industry, either. The media is part of the problem; I can think of a leak that showed up in monitoring, and no local newspaper reported. Only @SkyTruth noticed it, and they didn’t have the means to access the closest local papers (stupid papers did not have emails for tips, and/or no social media presence–I know, because I looked on behalf of @SkyTruth).

With the media failing to report all but billion dollar boo-boos well after the fact as in that Reuters story (note the 3-week gap between leak and report), it’s quite likely that a cyberweapon could “detonate” in our own backyards and we’d find out far, far too late.

Ugh. In hindsight, I think this comment should have been the next in the series on Stuxnet.

EDIT — 1:24 PM EST —
Nuts. I gotta’ point out to readers one more key point from qweryous’ linked Reuters’ article.

The refinery is the product of a joint venture between Royal Dutch Shell and Aramco.

Aramco is a STATE-OWNED enterprise; it is, for all intents and purposes, the Kingdom of Saudi Arabia.

Were Stuxnet-like malware to be deployed against refinery operations, this is an issue that one must keep in mind. Attacks on some business operations are intended to target not local populations, not industries, but the nation-state owners.

Welcome to the asymmetric warfare of the 21st century. We are all collateral damage now.