Greetings! Please Share & Subcribe.
Virus uniquely programmed to attack Iran's nuclear facility showed power of cyber-weapons had reached chilling new level
The pieces of the puzzle began to take shape, and then fall into place, on 17 June last year, when Sergey Ulasen was emailed by a dealer in Tehran about an irritating problem some of his clients were having with their computers.
Ulasen works in the research and development department of a small company called VirusBlokAda in Minsk, the capital of Belarus, which has been giving advice about computer security since 1997.
"These computers were constantly turning off and restarting," Ulasen told the Guardian. "It was very strange. At first we thought maybe it was just a problem with the hardware. But when they said that several computers were affected, not just one, we understood that it was a problem with the software the computers were running."
Ulasen was given remote access to one of the malfunctioning machines, but he soon realised he needed help. He roped in a colleague, Oleg Kupreyev, the firm's senior analyst, and they spent a week unravelling samples of the computer virus they had "captured" which was affecting the Iranian machines.
The longer they looked, the more they realised they had uncovered an extraordinary piece of engineering, unlike anything either of them had come across before. Ulasen published his findings on a few online message boards and gave the virus a name, TmpHider.
Months later, a clearer picture emerged.
Ulasen, 28, was unaware that the computers that had gone on the blink were among those being used by Iranian scientists involved in efforts to enrich uranium as part of the country's nuclear programme. The malware that had disrupted their work turned out to be so fiendishly clever that Iran accused the US and Israel of developing it. And the virus itself had been given a new name: Stuxnet, which may go down in history as the cyber-weapon that changed the face of modern warfare.
The story of Stuxnet is complicated, not least because the false trails laid by those trying to conceal conventional espionage become nearly impossible to follow when they are in the virtual world of computer codes and software design.
But specialists from GCHQ, the Ministry of Defence, and independent analysts agree on this: Stuxnet was ingeniously complex, probably took several people many years to develop, and has opened the eyes of every government to the destructive possibilities of a new type of covert attack.
Though there is no conclusive proof, and there may never be, the circumstantial evidence about its origins suggests that Iran was probably right. Very few countries had the motive, the money or the capability to create Stuxnet.
This virus was not a blunt instrument. It was designed to disable specific control systems running 9,000 Iranian centrifuges, which are used to enrich uranium, causing some of them to spin out of control. It also covered its tracks by fooling operators into believing that the equipment was working as usual.
Infecting these computers was a work of mind-boggling enterprise. According to Symantec, one of the world's leading security firms, the operation to introduce the virus into the Iranian network would have involved old-school theft and an unwitting insider at the Iranian facility, as well as daring and skill.
To start with, its creators needed to know exactly the sort of computer configuration that the Iranians were using to run the centrifuges at their underground uranium-enrichment plant at Natanz. They found this out by stealing the blueprints they needed, using, of course, a virus. Traces of an early version of Stuxnet have been found that show the virus went on a reconnaissance mission in mid-2009, infiltrating the network, scanning the systems and recording what it found.
This would have given the developers the layout they needed; it showed Iran was using certain types of program logic controllers to run the centrifuges – PLCs are used in all sorts of businesses and industries to help machines run automatically.
To test the updated virus that would cause the sabotage, its creators must have built a mirror image of the Iranian facility, computers and all, allowing them to practise and refine their targeting. Because PLCs are so common, they programmed Stuxnet to ignore any PLC that was running a machine at slow speed; it needed to hunt down the PLCs that were running motors at high speed, because they were more likely to be controlling the centrifuges. The New York Times reported earlier this year that this testing phase might have taken place at Israel's Dimona complex, in the Negev desert.
Wherever it happened, this task alone would have taken 10 developers at least six months, Symantec estimates. But even then, the job was barely half done.
The new Stuxnet still had to be introduced back into the Iranian network without raising alarm. So they hid the virus in a driver file built into a standard Microsoft Windows program being used by the Iranians. In normal circumstances, the Windows software would automatically raise the alarm that a new, potentially unauthorised file had been installed as soon as a computer was switched on. But Stuxnet's authors got round this. They stole two genuine digital certificates from companies in Taiwan, and used the details on them to fool the Windows program into thinking the new files had been properly authorised.
Even then, Stuxnet had to be downloaded at Natanz, a massive and well-protected nuclear site in the middle of the desert near Kashan in central Iran. In all likelihood, a contractor working at the site, probably using a laptop on which the Windows program was installed, plugged into the system to conduct routine work. Who that was and exactly when it happened, nobody knows.
Unknown flaws
Once connected, Stuxnet was designed to proliferate aggressively. And it went unnoticed for so long because it was able to exploit four previously unknown flaws in the Windows program.
To find one flaw – or "zero-day" vulnerability – in a programme is regarded as rare. To find four would have required a monumental research effort. Over several months, Stuxnet surreptitiously tracked down the right PLCs and started to vary the speeds of the motors spinning the centrifuges, making some of them go wildly out of control.
Analysts who unravelled Stuxnet noted that the virus bookmarked what it was doing, using the figure 19790509. That could be a random number. Or it could be a nod to 9 May 1979 – the date a Jewish-Iranian businessman called Habib Elghanian was executed in Iran. He was accused of spying for Israel.
A 67-page Symantec report concludes: "The real world implications of Stuxnet are beyond any threat we have seen in the past. Stuxnet is the type of threat we hope to never see again."
There are conflicting reports about how many centrifuges were affected, and how much damage was done, and the Iranians have understandably tried to play down its impact. Don't be fooled, warns Ilias Chantzos, a Symantec director. He believes that Stuxnet is forcing governments to re-evaluate "the way we understand threats to critical infrastructure and national security".
"It is the first virus that was designed to achieve a kinetic effect. It was not designed to steal data or to deny access. It was designed to manipulate an industrial control system to operate outside its intended instructions. Someone had the intent to weaponise a virus. Before Stuxnet the possibility to attack [a control system] using cyber was explored theoretically but was more seen as in the realm of cinema and creative science-fiction-thriller writing. Now it is a real-life scenario."
Claire Yorke, an expert in cyber-security at the thinktank Chatham House, says: "Although the origin of the virus is still unknown, its sophistication and complexity suggests it would have required significant time and resources beyond the capability of non-state actors. The virus used several secretive 'back doors' into the Iranian computer networks and would likely have taken months to have been developed and tested to a level at which it could achieve the intended results."
She adds: "While viruses such as Stuxnet are a rare occurrence and sit at the leading edge of the technical spectrum, they could be seen as evidence of future modes of attack."
The UK's response to such threats, and to the broader and much more prosaic issues of security online, was set out in last year's strategic defence and security review, which gave £650m to beef up the country's cyber-defences. The coalition made cyber-security a tier one priority – the highest – and a new infrastructure across government is being created to tackle a problem that has been growing, and mutating, for more than 20 years.
The Cabinet Office has traditionally taken the lead on this, with Neil Thompson, one of the country's leading intelligence specialists, now heading the over-arching Office of Cyber Security and Information Assurance. This includes the Cyber Security Operations Centre, based at GCHQ, which already has about 30 staff, drawn from different government departments.
One measure of the importance now attached to this work is that Thompson's colleagues say he is in almost daily contact with Howard Schmidt, the US's cyber-security co-ordinator, who was appointed by Barack Obama after the president declared that cyber was a strategic priority for the White House.
The difficulty for GCHQ, and for all the other agencies with an interest in the subject, is that the spectrum of potential threats is very broad, and state-on-state attacks – while potentially devastating – probably account for only a fraction of it. Cyber-security includes the activities of fraudsters, other criminals and, to a far lesser extent, terrorists, who all all operate online and attempt to use cyber-tools to steal information or disrupt everyday services.
Most of what GCHQ sees involves systematic efforts to break through or sneak round the firewalls put around the computer systems run by government departments, banks and big business.
Iain Lobban, the director of GCHQ, said that more than 20,000 malicious emails were found on government networks each month, and 1,000 of them were specifically targeted. In a rare public speech last autumn, Lobban also conceded that some computer worms have successfully burrowed their way in and caused "significant disruption".
"Cyberspace is contested every day, every hour, every minute, every second," he said. "I can vouch for that from the displays in our own operations centre of minute-by-minute cyber-attempts to penetrate systems around the world."
GCHQ estimates that 80% of these kinds of attacks can be dealt with by better computer "hygiene": more care being taken with passwords, for instance. Five hundred people in the organisation's Cheltenham HQ are involved in giving advice to Whitehall and industry about the threats and how best to counter them.
Obsession
Anxiety about valuable data being stolen without anyone noticing is shared across all sectors. It is an obsession for banks and corporate giants in the City of London, who would argue that the theft of intellectual property is a much more pressing concern for the UK economy than a Stuxnet-style raid on one of Britain's nuclear plants. The Cabinet Office agrees, which is why Lobban has been trying to encourage a more holistic approach to cyber-security, encouraging firms to share information about the threats they have identified.
Once-niche security firms that struggled to make ends meet in the 1990s now find themselves feted and providing advice to the UK's top companies. They also have hundreds more analysts than the government, and databases at least as rich as any owned by the state. Symantec, for instance, can monitor one-third of the world's entire email traffic every minute of the day from hubs it has set up around the globe.
But while the cyber-security industry in the UK blossoms, GCHQ's real value is in looking at the 20% of threats that cannot be dealt with by ordinary means – seeking out those that might threaten the national infrastructure by, say, crippling energy companies, or the communications systems run by the emergency services.
Some Whitehall officials have drawn solace from Stuxnet, saying that the analysis of the virus "has shown how difficult it is to do this stuff". But they also recognise that the cyber-domain is particularly attractive to some states because of the low bar for entry. State-sponsored cyber-activity is growing, and will continue to do so, said one official, because it is still a comparatively cheap means of warfare compared with buying warships and fighter jets. "You don't need much money, and you don't need many people," said the official. "You could put two students in a room, give them computers and let them have a go."
At the very top end of such capability are targeted weapons such as Stuxnet. But there are other, cruder methods for causing mass disruption.
So called "denial of service" attacks have become quite common, though not on the scale that crippled parts of Estonia in 2007 at the height of a diplomatic row with Russia. During that episode, the country's main computer systems were bombarded with requests for information by other computers which had been ordered to do so after being infected with malicious software – malware. The network of "bad" computers ("botnet") that launched the attack came from all over the world, including the US, Brazil and Canada.
The attack crippled Estonia's parliament, banks and main businesses for up to a fortnight. Russia was assumed to have been behind it.
National Security
Experts have long thought that the UK would be, and probably should be, working up its own range of cyber-weapons, and last year the government hinted this was now a priority. The strategic defence and security review said: "Over the last decade the threat to national security and prosperity from cyber attacks has increased exponentially … We will also work to develop, test and validate the use of cyber capabilities as a potentially more effective and affordable way of achieving our national security objectives."
Now ministers have openly acknowledged the need to develop new offensive weapons, new questions need to be answered - and not just those about the protocols and legal basis for using them.
One senior defence official noted that traditional arms manufacturers had "smelt the money" and were now diversifying to include cyber-capabilities, recasting the military-industrial complex. Three years ago, Britain's biggest arms manufacturer, BAE Systems, bought Detica, an established and well-respected technology firm. Earlier this year, the firm worked with the Cabinet Office to publish a cost of cybercrime report – but some independent experts, such as Professor Peter Sommer, who lectures at the LSE, regarded Detica's involvement in an independent report as a mistake.
He said the Cabinet Office had to show it had "the independence to repel the lobbyists" if it was to retain its credibility. There was another key issue. "One of the things the major software companies don't want us to discuss is the huge number of flaws in their software. The flaws provide countless opportunities for criminals and other attackers and they exist because the software houses are more interested in revenue from selling us new gimmicks in their products than testing them so that they are solidly safe to use."
Much better to spend much more money on "the basics of looking after your computer, the way you use it and how sensibly to assess cyber-related risks," Sommer said.
"That's why I want to see significant government funding going to organisations such as GetSafeOnline rather than on exotic experimental kit from the big international armaments companies."
In truth, officials acknowledge that the UK will need to both spend at the low end, and at the high end, to keep ahead on cyber-security.
"Cyber is not for geeks any more," said one official. "It's for everyone. The threats are here and now."
Glossary
Malware
A Malicious software program is designed to damage or do other unwanted actions on a computer system.
Common examples of malware include viruses, worms, Trojan horses, and spyware. All of them work in a slightly different way. A virus, for instance, needs to attach itself to an existing piece of software, but a worm can work independently of it.
Botnet
A botnet is a group of computers controlled from a single source which run related software programs and scripts. The term usually refers to multiple computers that have been infected with malicious software.
To create a malicious botnet, a hacker must first compromise several computers.
Hacker
While this term originally referred to a clever or expert programmer, it is now more commonly used to refer to someone who can gain unauthorised access to other computers. A hacker can "hack" his or her way through the security levels of a computer system or network.
Zero-day vulnerability
A zero-day attack or threat is one that exploits a hitherto unknown flaw in a computer programme. Developers are supposed to test their software rigorously before they go on sale, but flaws are still found once they are in use. Companies then send out patches to repair the flaws.
GUARDIAN
0 Comments