Obama Order Sped Up Wave of Cyberattacks Against Iran(nytimes.com)
nytimes.com
Obama Order Sped Up Wave of Cyberattacks Against Iran
http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html
21 comments
I think they are confusing the terms here. What they mean is that the worm itself is 20 mb in size where as average is about 1 mb. So The worm's code is 20x. They probably don't know that worm's size and it's source code are two different things. They are NYT not a tech blog, so i guess this is excusable.
but i think they got their point across well enough; technical trvialities don't matter at all in this case.
How did they possibly know the code is 50 times that big. Is the code out in the open?
The relationship between compiled code and source code is not as mysterious as you're making it out to be. This is not a hard analysis to conduct.
Incidentally, from friends who do serious malware reversing work (we do not do any malware work): the "50x bigger, feels like pro contractors" assessment rings true for several other reasons; for instance, the style of programming used in the worm itself.
Incidentally, from friends who do serious malware reversing work (we do not do any malware work): the "50x bigger, feels like pro contractors" assessment rings true for several other reasons; for instance, the style of programming used in the worm itself.
"Several layers of masking obscured the zero-day exploit inside, requiring work to reach it, and the malware was huge — 500k bytes, as opposed to the usual 10k to 15k." - http://www.wired.com/threatlevel/2011/07/how-digital-detecti...
This is a great read and very informative!
This is a great read and very informative!
Yes it is, but your parent post was asking how they knew how large the source code was. This quotation is reporting the size of the final binary.
Where did the article say 'source code'? Machine code is still 'code'.
You have to consider the audience the NY Times is targeting. Just knowing what a compiler is puts one in relatively sparse company.
You have to consider the audience the NY Times is targeting. Just knowing what a compiler is puts one in relatively sparse company.
Yes.
Mr. Obama, according to officials in the room, asked a series of questions, fearful that the code could do damage outside the plant. The answers came back in hedged terms. Mr. Biden fumed. “It’s got to be the Israelis,” he said. “They went too far.”
In fact, both the Israelis and the Americans had been aiming for a particular part of the centrifuge plant, a critical area whose loss, they had concluded, would set the Iranians back considerably. It is unclear who introduced the programming error.
I guess it's naive to think they might be using git and could resolve this with a simple `git blame`...
In fact, both the Israelis and the Americans had been aiming for a particular part of the centrifuge plant, a critical area whose loss, they had concluded, would set the Iranians back considerably. It is unclear who introduced the programming error.
I guess it's naive to think they might be using git and could resolve this with a simple `git blame`...
It's a little different when half the goal is to leave no trace of who wrote the software (and everything is obfuscated to hell).
This is clearly an approved leak from the administration. The number of sources and specifics make it very easy to catch whoever leaked this information. If this wasn't approved, the leaker is going to be sitting next to bradly manning within a week, and there is no moral cause to leak this information, so it is safe to assume this was an approved leak.
The real question, is why did the administration leak the story, and why now? Is it politically motivated because Obama wants to seem tough on Iran in an election year? Is it to trick the Iranians into thinking the program is over? Maybe versions 2, 3, and 4 are already in place, and it will be demoralizing to Iran's program if they keep getting setback.
The real question, is why did the administration leak the story, and why now? Is it politically motivated because Obama wants to seem tough on Iran in an election year? Is it to trick the Iranians into thinking the program is over? Maybe versions 2, 3, and 4 are already in place, and it will be demoralizing to Iran's program if they keep getting setback.
The real question, is why did the administration leak the story, and why now?
The latest round of multi-lateral talks on Iran's nuclear program just concluded a few days ago in Baghdad. I think they're trying to send the message to Iran that they will never be able to have a clandestine nuclear weapons program. The world is going to know about it. So if a nuclear power option is on the table for Iran this might give them a little extra motivation to accept all international regulations/inspections as a precondition. What are they actually going to be able to hide? Not much apparently.
The other goal here is to make Iran's position that they only want nuclear power, not nuclear weapons, even more difficult to accept. They are enduring sanctions and refusing to accept all of the regulations/inspections for what purpose exactly? They could have had nuclear power years ago if they were willing to accept these conditions. The longer they hide behind 'nuclear power only' the harder it is to believe. At some crucial point I have no doubt we'll be leaking detailed information about their weapons program. When that happens Iran will have to probably admit they do want nuclear weapons and from there the war question pretty much resolves itself.
The latest round of multi-lateral talks on Iran's nuclear program just concluded a few days ago in Baghdad. I think they're trying to send the message to Iran that they will never be able to have a clandestine nuclear weapons program. The world is going to know about it. So if a nuclear power option is on the table for Iran this might give them a little extra motivation to accept all international regulations/inspections as a precondition. What are they actually going to be able to hide? Not much apparently.
The other goal here is to make Iran's position that they only want nuclear power, not nuclear weapons, even more difficult to accept. They are enduring sanctions and refusing to accept all of the regulations/inspections for what purpose exactly? They could have had nuclear power years ago if they were willing to accept these conditions. The longer they hide behind 'nuclear power only' the harder it is to believe. At some crucial point I have no doubt we'll be leaking detailed information about their weapons program. When that happens Iran will have to probably admit they do want nuclear weapons and from there the war question pretty much resolves itself.
Great point. After reading the article, I completely forgot that Iran was still claiming that they didn't have a weapons program. This now proves that claim is complete nonsense and now that this is public, the US can show the UN security council and infinite amount of data that shows Iran has a weapons program.
Good points. I think the tough on Iran story is probably part of it. Also I think it could be a way to test the public/media reaction to news of US cyber terrorism against other nations.
Flame hit the mainstream news not too long ago, that may have something to do with it.
Great point, that makes sense to me. Derivative malware is being created, and the administration went public to send a wakeup call to domestic industries to be vigilant. Rather than telling sensitive companies and organizations like Los Alamos, and waiting for a leak, the administration leaked the info to the NYT to control the message. Now that the story is out, the CIA/NSA can work with sensitive industries to contain the fallout of derivative malware like Flame.
The timing makes sense.
The timing makes sense.
...there is no moral cause to leak this information...
From the article: "Last year, the nation announced that it had begun its own military cyberunit..."
One could argue that a nation's citizens have a moral right to know that their government is exposing them to potential retaliation by sabotaging the facilities of another sovereign nation via cyberattack.
Also from the article: "But there has been scant evidence that it has begun to strike back."
Wasn't the DigiNotar hack used by Iran to obtain fake certificates for Google domains?
From the article: "Last year, the nation announced that it had begun its own military cyberunit..."
One could argue that a nation's citizens have a moral right to know that their government is exposing them to potential retaliation by sabotaging the facilities of another sovereign nation via cyberattack.
Also from the article: "But there has been scant evidence that it has begun to strike back."
Wasn't the DigiNotar hack used by Iran to obtain fake certificates for Google domains?
I agree...or Sanger has another agenda by leaking this. But either way, this is more purposeful than just trying to break a story.
This shouldn't be a surprise to anyone. The set of { countries that are capable of creating something like Stuxnet and getting it into the plant } intersection with the set of { countries fearful of Iran } comes down to { US, Israel }.
You might add UK in there and UK might have assisted the US in the creation of Stuxnet if the US had asked.
You might add UK in there and UK might have assisted the US in the creation of Stuxnet if the US had asked.
I'm very curious who gets hired to write the code for a project like this. What caliber are they, what kinds of backgrounds do they come from, and how are they recruited to these positions? Is this more likely to be done by a government agency or a defense contractor?
I have always assumed that the world's most talented hackers work in places like Silicon Valley and Wall Street, but Stuxnet was clearly the work of some brilliant minds, so I'm curious.
I have always assumed that the world's most talented hackers work in places like Silicon Valley and Wall Street, but Stuxnet was clearly the work of some brilliant minds, so I'm curious.
I think there are defense contractors that develop and weaponize exploits, rootkits, and so on for the government and while I'm sure some of that work was used in Stuxnet, I think anything specific to Stuxnet was handled by actual governmental agencies. The article names the NSA and an Israeli unit.
As for recruiting, you wouldn't ever get recruited directly to such a project - you'd already need a TS/SCI clearance and to have proven yourself within the NSA. As for recruiting into the general field of classified cybersecurity, it's not too much different from any other field; they post job ads, scour college campuses, probably advertise at defcon, etc. Generally if you're getting hired without a clearance it's not for a specific position - it takes upwards of half a year before you get cleared and can start, at which point they figure out which project to put you in.
As for the most talented hackers, keep in mind the subject area: Wall Street has very little demand for security researchers, and Silicon Valley's demand for them is minuscule compared to the government's.
As for recruiting, you wouldn't ever get recruited directly to such a project - you'd already need a TS/SCI clearance and to have proven yourself within the NSA. As for recruiting into the general field of classified cybersecurity, it's not too much different from any other field; they post job ads, scour college campuses, probably advertise at defcon, etc. Generally if you're getting hired without a clearance it's not for a specific position - it takes upwards of half a year before you get cleared and can start, at which point they figure out which project to put you in.
As for the most talented hackers, keep in mind the subject area: Wall Street has very little demand for security researchers, and Silicon Valley's demand for them is minuscule compared to the government's.
VUPEN provides 0-days to governments http://www.vupen.com/english/
For example this one seems fairly direct to me: http://www.clearancejobs.com/jobs/1536410/cyber-software-eng...
Can someone explain to me how Google Earth is considered a 'security research' tool (as mentioned in 'Preferred Qualifications')?
I'm woefully clueless when it comes to this realm of software, so I'd love for some insight.
I'm woefully clueless when it comes to this realm of software, so I'd love for some insight.
[deleted]
If it's Israel then they come from the military which is the first place students go after school - so they do in fact have access to the world's most talented hackers. A lot of them go on to create startups after finishing service.
See: http://news.ycombinator.com/item?id=977176 for a bit more.
See: http://news.ycombinator.com/item?id=977176 for a bit more.
Israel owns companies such as IAI which in turn operate subsidiaries such as IAI ELTA (http://www.iai.co.il/17887-en/Groups_ELTA.aspx)
They also operate a nuclear program.
They have world class technical universities.
The military is a huge employer for engineers and researchers in Israel.
If they can create and market high-tech SIGINT / ELINT / EW / COMINT systems, a nation like Israel should be able to create programs such as STUXNET. They have the know how and expertise.
In response to your question. In Israel, a small country, you have mandatory military service, a close relationship between the private sector, government and military, I think the path for an engineer is very clear cut if he or she wants to enter this domain of work. Vice versa, the government will have no problem finding you.
They also operate a nuclear program.
They have world class technical universities.
The military is a huge employer for engineers and researchers in Israel.
If they can create and market high-tech SIGINT / ELINT / EW / COMINT systems, a nation like Israel should be able to create programs such as STUXNET. They have the know how and expertise.
In response to your question. In Israel, a small country, you have mandatory military service, a close relationship between the private sector, government and military, I think the path for an engineer is very clear cut if he or she wants to enter this domain of work. Vice versa, the government will have no problem finding you.
Both agencies and contractors employee people with the skillsets needed to write these kinds of things. While there are a large number of incompetent government employees and contractors, there are also a small number of frighteningly talented developers working in this area.
It's the same with any big company, and it kind of boils down to the adage: "20% of the people do 80% of the work".
i sometimes wish that there's some sort of darwinian selection system that could be put in place, in order to improve the overall efficiency and productivity of companies...but then again, i m writing this from my work terminal...
The work is farmed out to the National Labs and federally funded RDCs from a coordinating office:
"Olympic Games borrowed some for what they termed "destructive testing," essentially building a virtual replica of Natanz, but spreading the test over several of the Energy Department's national laboratories to keep even the most trusted nuclear workers from figuring out what was afoot."
The engineers working on the P-1s are employed by Sandia, ORNL, LANL, Mitre, RAND, SRI, etc and are in the dark about project specifics due to compartmentalization. Want a job:
http://www.sandia.gov/careers/students_postdocs/internships/...
"Olympic Games borrowed some for what they termed "destructive testing," essentially building a virtual replica of Natanz, but spreading the test over several of the Energy Department's national laboratories to keep even the most trusted nuclear workers from figuring out what was afoot."
The engineers working on the P-1s are employed by Sandia, ORNL, LANL, Mitre, RAND, SRI, etc and are in the dark about project specifics due to compartmentalization. Want a job:
http://www.sandia.gov/careers/students_postdocs/internships/...
Just a guess, but the public options are basically the NSA and their contractors (ex. Booz Allen Hamilton). There are excellent hackers in those places.
You'd be surprised how many brilliant hackers are working in department stores for very low wages, just doing tech support or some other job.
Holy shit. Stuxnet was just confirmed as being developed by the US and Israel.
This really makes you wonder at what point do you go from calling something "some digital nudging about between nations" to "war".
To me this seems to qualify as terrorism and sabotage on all accounts. I'm pretty sure I know how the US would react if they had been on the receiving end of this sort of attack.
To me this seems to qualify as terrorism and sabotage on all accounts. I'm pretty sure I know how the US would react if they had been on the receiving end of this sort of attack.
Sabotage sure, but I have a hard time seeing this qualified as terrorism - terrorism is an a violent act against civilians designed to instill fear in the general population.
e.g., bombing trains, airports, buildings, poisoning food supplies, etc.
Actions against the military establishment of a country can hardly be qualified as terrorism.
That said, if the US had been on the pointy end of this stick I'm sure many politicians would not have hesitated to the use the T-word themselves...
e.g., bombing trains, airports, buildings, poisoning food supplies, etc.
Actions against the military establishment of a country can hardly be qualified as terrorism.
That said, if the US had been on the pointy end of this stick I'm sure many politicians would not have hesitated to the use the T-word themselves...
> ...terrorism is an a violent act against civilians designed to instill fear in the general population.
http://www.guardian.co.uk/commentisfree/2012/jan/16/iran-sci...
http://rockcenter.msnbc.msn.com/_news/2012/02/09/10354553-is...
http://www.guardian.co.uk/commentisfree/2012/jan/16/iran-sci...
http://rockcenter.msnbc.msn.com/_news/2012/02/09/10354553-is...
So I looked at your links and I don't see how those activities "instill fear in the general population". They instill fear in those working for the military, sure, but that's not the general population.
I intend no offense, but can we for once not be pedants? The January 11th incident happened in a public, civilian area (http://wikimapia.org/#lat=35.75663&lon=51.450485&z=1...), it was the fourth such incident (that I know of), and witnesses described a man on a motorbike that attached the bomb to the car.
I'm pretty sure that if you happened to be a block away when a Livermore Lab nuclear scientist was killed by a focused car bomb delivered by a motorcyclist, you'd get a little jumpy and U.S. news reports would call it terrorism.
And, U.S. officials are claiming that the bombings are being carried out by the People’s Mujahedin of Iran, a terrorist organization, and Iran's own vice-president called it an act of terrorism.
For us to call this anything other than terrorism would be hypocrisy.
I'm pretty sure that if you happened to be a block away when a Livermore Lab nuclear scientist was killed by a focused car bomb delivered by a motorcyclist, you'd get a little jumpy and U.S. news reports would call it terrorism.
And, U.S. officials are claiming that the bombings are being carried out by the People’s Mujahedin of Iran, a terrorist organization, and Iran's own vice-president called it an act of terrorism.
For us to call this anything other than terrorism would be hypocrisy.
Actually if I knew the target was specifically targeted and killed by a careful operation I would be more relaxed knowing that my country's enemy was so careful about killing.
It's the same reason why people get in an uproar over a random murder, but barely care when the killing was targeting a specific person.
Terrorism is random. Killing a person because of how they help the military is not terrorism even if done in public. You can call it assassination if you wish (which plenty of people condemn), but it's not terrorism.
Remember Alexander Litvinenko? (The Russian spy who was killed with plutonium.) I don't remember any exclamations of terrorism.
It's the same reason why people get in an uproar over a random murder, but barely care when the killing was targeting a specific person.
Terrorism is random. Killing a person because of how they help the military is not terrorism even if done in public. You can call it assassination if you wish (which plenty of people condemn), but it's not terrorism.
Remember Alexander Litvinenko? (The Russian spy who was killed with plutonium.) I don't remember any exclamations of terrorism.
When Nidal Malik Hasan shot and killed 13 soldiers and one civilian at Fort Hood in 2009, 60% of Americans wanted the crime prosecuted as a terrorist act [1], the Bipartisan Policy Center referred to it as a terrorist act in a report [2], and Wikipedia currently refers to it as a "non-state terrorist attack" [3].
While there is not an internationally-agreed-upon definition of "terrorism", according to U.S. law, terrorism is defined as "premeditated, politically motivated violence perpetrated against noncombatant targets by subnational groups or clandestine agents" [4]. Premeditated, politically-motivated violence perpetrated against noncombatant targets by clandestine agents ... the Iranian car bombings would legally qualify as terrorism under U.S. law.
This is a very silly argument to be having here. I'd really rather be reading about some interesting technical aspect of the technological warfare against Iran, and I really don't want to keep on cluttering up the comments here with silliness.
[1]: http://www.rasmussenreports.com/public_content/politics/gene...
[2]: http://www.scribd.com/doc/95190520/Assessing-the-Terrorist-T..., search for "Fort Hood"
[3]: http://en.wikipedia.org/wiki/Fort_Hood_shooting
[4]: http://www.law.cornell.edu/uscode/text/22/2656f, subsection (d), paragraph (2).
While there is not an internationally-agreed-upon definition of "terrorism", according to U.S. law, terrorism is defined as "premeditated, politically motivated violence perpetrated against noncombatant targets by subnational groups or clandestine agents" [4]. Premeditated, politically-motivated violence perpetrated against noncombatant targets by clandestine agents ... the Iranian car bombings would legally qualify as terrorism under U.S. law.
This is a very silly argument to be having here. I'd really rather be reading about some interesting technical aspect of the technological warfare against Iran, and I really don't want to keep on cluttering up the comments here with silliness.
[1]: http://www.rasmussenreports.com/public_content/politics/gene...
[2]: http://www.scribd.com/doc/95190520/Assessing-the-Terrorist-T..., search for "Fort Hood"
[3]: http://en.wikipedia.org/wiki/Fort_Hood_shooting
[4]: http://www.law.cornell.edu/uscode/text/22/2656f, subsection (d), paragraph (2).
Nidal Malik Hasan killed people randomly. That makes a huge difference. Another difference is motivation: He killed from hate, not for a military purpose.
The whole point of picking a specific target is that you consider them a combatant. (You don't have to shoot a gun to be a combatant, helping the military is enough.) A civilian contractor for the military can be a combatant. So no, the Iranian car bombings would not legally qualify as terrorism under U.S. law - the bombings targeted a combatant.
Intent matters too: Are you are killing a person because of that specific person? (To prevent that person from contributing to the military.) Or are you killing so that other people see the killing and get scared?
You are right that it's a silly argument because your eyes appear to be closed on the matter (although to your credit you argue constructively). So lets turn this around, in your eyes in what scenario would it be assassination and not terrorism?
I don't think there are too many other technological details to be found, so this thread is likely to end up as a huge discussion of the morals of this action.
The whole point of picking a specific target is that you consider them a combatant. (You don't have to shoot a gun to be a combatant, helping the military is enough.) A civilian contractor for the military can be a combatant. So no, the Iranian car bombings would not legally qualify as terrorism under U.S. law - the bombings targeted a combatant.
Intent matters too: Are you are killing a person because of that specific person? (To prevent that person from contributing to the military.) Or are you killing so that other people see the killing and get scared?
You are right that it's a silly argument because your eyes appear to be closed on the matter (although to your credit you argue constructively). So lets turn this around, in your eyes in what scenario would it be assassination and not terrorism?
I don't think there are too many other technological details to be found, so this thread is likely to end up as a huge discussion of the morals of this action.
If the Tamil Tigers do it (Holder v. Humanitarian Law Project), then it is soliciting assistance for terrorist acts, but if the KKK does the same thing (Brandenburg v. Ohio) it is protected speech. I really don't know that there is more to say about it then that.
As Justice Potter Stewart said in his concurrence in Jacobellis v. Ohio, "I shall not today attempt further to define the kinds of material I understand to be embraced within that shorthand description; and perhaps I could never succeed in intelligibly doing so. But I know it when I see it, and the motion picture involved in this case is not that." (that's his complete concurrence)
The same could be true for terrorism. We know it when we see it. No objective definition necessary, so we will make do with it as a political label.
As Justice Potter Stewart said in his concurrence in Jacobellis v. Ohio, "I shall not today attempt further to define the kinds of material I understand to be embraced within that shorthand description; and perhaps I could never succeed in intelligibly doing so. But I know it when I see it, and the motion picture involved in this case is not that." (that's his complete concurrence)
The same could be true for terrorism. We know it when we see it. No objective definition necessary, so we will make do with it as a political label.
Not to be pedantic, but it was Polonium not Plutonium that was used in Alexander Litvinenko's assassination.
http://en.wikipedia.org/wiki/Polonium#Famous_poisoning_cases
http://en.wikipedia.org/wiki/Polonium#Famous_poisoning_cases
Ah my mistake. I saw Po and confused it with Pu.
It's really not pedantic, it's about using the right word. Terror means fear. Assassination means killing a specific person.
Assassinating Iranian nuclear scientists has the concrete and (for the presumed perpetrators) desired effect of denying Iran the service of those persons. Instilling terror in other nuclear scientists is a much lower order side effect.
Assassinating Iranian nuclear scientists has the concrete and (for the presumed perpetrators) desired effect of denying Iran the service of those persons. Instilling terror in other nuclear scientists is a much lower order side effect.
So assassinating any government officials by Iran in order to try to defend from future such assassinations of its scientists would also not be considered terrorism, as long as they claim it is a targeted response and if it happens to induce fear in the large number of government officials and others it is just a secondary effect?
Certainly not any.
But if a clear causation between removing a certain actor from the game and crippling the scientist assassination program is present, I don't see why not.
But if a clear causation between removing a certain actor from the game and crippling the scientist assassination program is present, I don't see why not.
It would more usually be qualified as an act of war.
terrorism is an a violent act against civilians designed to instill fear in the general population.
It got legally redefined by the government. Is now the unlawful use of force and violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.
Is now any unlawful forceful act with any wider motive, basically.
It got legally redefined by the government. Is now the unlawful use of force and violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.
Is now any unlawful forceful act with any wider motive, basically.
The functioning definition is something like:
> the unlawful use of force and violence against persons or property to intimidate or coerce the US government its allies, the US civilian population, or any segment thereof, in furtherance of political or social objectives.
See, when US does it is called "exporting democracy", "conducting an operation", "liberating", "collateral damage" -- basically anything but terrorism.
> the unlawful use of force and violence against persons or property to intimidate or coerce the US government its allies, the US civilian population, or any segment thereof, in furtherance of political or social objectives.
See, when US does it is called "exporting democracy", "conducting an operation", "liberating", "collateral damage" -- basically anything but terrorism.
Why is this downvoted? Seems relevant and fairly apt, if a bit too pointed.
It becomes a war when you do it openly.
And this sort of thing is nothing new, see http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage for example, and there is lots more.
The way you react is with total silence - you don't want anyone to know you were vulnerable. And that's also why these types of activities tend not to escalate.
Personally, if countries have to fight I'd prefer they do it quietly like this rather than open war. It's a lot easier to ratchet down the tensions when there has been no rhetoric about the enemy.
For example: http://en.wikipedia.org/wiki/2007_Israeli_airstrike_in_Syria - mostly silence on both parties part and no increase in hostilities.
And this sort of thing is nothing new, see http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage for example, and there is lots more.
The way you react is with total silence - you don't want anyone to know you were vulnerable. And that's also why these types of activities tend not to escalate.
Personally, if countries have to fight I'd prefer they do it quietly like this rather than open war. It's a lot easier to ratchet down the tensions when there has been no rhetoric about the enemy.
For example: http://en.wikipedia.org/wiki/2007_Israeli_airstrike_in_Syria - mostly silence on both parties part and no increase in hostilities.
I don't know about the states, but we (Israel) have been on the receiving end of actual terrorism and sabotage through Iranian proxy groups. Stuxnet seems mild compared to funding suicide bombings.
Yes, I thought as an outside observer that if successful, Stuxnet would have been a great nonviolent approach to achieving geopolitical ends.
And Iraq had weapons of mass destruction.
I could be wrong, but I don't think this is speculation:
* Iran funds Hezbolla: http://en.wikipedia.org/wiki/Funding_of_Hezbollah
* Iran funds the Islamic Jihad: http://en.wikipedia.org/wiki/Islamic_Jihad_Organization
* Iran funds Hamas: http://en.wikipedia.org/wiki/Iran%E2%80%93Israel_relations#I...
* Example of suicide bombing by the Islamic Jihad: http://www.dailymail.co.uk/news/article-2145621/Family-Danie...
I understand this is a highly-loaded political issue in the states, but, for Israel, Iranian funded terrorism is a threat in and of itself, nuclear weapon or not.
* Iran funds Hezbolla: http://en.wikipedia.org/wiki/Funding_of_Hezbollah
* Iran funds the Islamic Jihad: http://en.wikipedia.org/wiki/Islamic_Jihad_Organization
* Iran funds Hamas: http://en.wikipedia.org/wiki/Iran%E2%80%93Israel_relations#I...
* Example of suicide bombing by the Islamic Jihad: http://www.dailymail.co.uk/news/article-2145621/Family-Danie...
I understand this is a highly-loaded political issue in the states, but, for Israel, Iranian funded terrorism is a threat in and of itself, nuclear weapon or not.
Both sides commit terrorism, where terrorism is defined as "politically motivated violence against civilians".
Wait 15 minutes and then check wikipedia.
Terrorism. What about this inflicts terror? I guess you might be a bit scared, but not really all that scared. It's not like someone developed a virus to slowly irradiate people having x-rays.
Swap the names of the countries, and think about how it would have been reported if Iran had done the exact same thing to Israel/US.
"think about how it would have been reported"
so how something is reported changes its reality how? I think the spin media put on the facts creates the fear, not the facts itself. Breaking equipment is certainly not going to cause what the media might've spun it into (which is OMG nuclear meltdown OMG).
so how something is reported changes its reality how? I think the spin media put on the facts creates the fear, not the facts itself. Breaking equipment is certainly not going to cause what the media might've spun it into (which is OMG nuclear meltdown OMG).
The difference is that the US doesn't threaten to wipe countries off the map. Iran is an evil theocracy and can't be trusted with nuclear weapons. Drawing moral equivalencies between the US and a totalitarian terrorist state is ridiculous. It's like comparing North Korea with Belgium.
I think that this comment bears a certain indulgent mixture of patriotism and naïvety. Dismissing Iran as an "evil theocracy" and a "a totalitarian terrorist state" is not entirely without grounds, but I would invite commenters to tone down their statements if geopolitics is not among their interests.
>> Iran is an evil theocracy and can't be trusted with nuclear weapons.
As per history, I believe the US is the only nation that cannot be trusted with nuclear weapons.
As per history, I believe the US is the only nation that cannot be trusted with nuclear weapons.
As far as I know the US is the ONLY country to ever have used nuclear weapons in war. And they may not have wiped countries off the map but they certainly did a lot of damage to Hiroshima and Nagasaki.
Nobody can be trusted with nuclear weapons.
Nobody can be trusted with nuclear weapons.
The nukes were used at a time of ABSOLUTE WAR. Every major economy on earth was geared toward war; nearly all manufacturing capacity was put toward not being conquered by your enemies and dying. It's clear very few people understand what that means today, as it has been 70 years since an absolute war has occurred, in which the major nations of earth were fighting for their very existence.
Britain would have nuked Germany to save itself if it had the opportunity and the necessity to do so, and or to bring the war to an end and kill Hitler if the opportunity were there. France too would have nuked Germany to defend itself and kill Hitler if possible. Had the Jewish people been able to, they too would not have blinked at nuking Germany and trying to kill Hitler in the process.
Japan would have nuked the United States and the rest of the allies. Germany would have nuked everybody at their leisure to 'win.'
The Empire of Japan was an extraordinarily powerful nation. Their military technology was very advanced, and they demonstrated endlessly that they were willing to use it brutally in instigation of war. They slaughtered millions upon millions in their Chinese invasion. It took a very substantial portion of America's considerable industrial base to defeat Japan.
It took two nuclear bombs before Japan capitulated with an unconditional surrender. The first one wasn't enough, which more than proves they were willing to shed millions more lives to keep fighting. America would have had to invade Japan and would have killed millions in taking the island to stop the war.
America had nukes before everybody else, and if their desire had been to do so, could have wiped out every other capital and brought the entire planet to its knees, regularly nuking anybody that dared to twitch about a nuclear program.
America also could have allowed a war to proceed with the USSR immediately after WW2, and nuked the USSR repeatedly and instantly become the sole superpower.
And in the last 67 years, America has specifically chosen to not use nuclear weapons of any sort, despite the radical military advantage that it has possessed for most of that time. Nukes in Vietnam would have ended that conflict very quickly.
It's a tragedy that Hiroshima and Nagasaki were nuked. Japan instigated war, both in general in the Pacific, and against America. Japan joined with Nazi Germany in a pact to destroy the allies. It was absolute war. I hope nobody reading this today ever has to really come to understand what that means.
Britain would have nuked Germany to save itself if it had the opportunity and the necessity to do so, and or to bring the war to an end and kill Hitler if the opportunity were there. France too would have nuked Germany to defend itself and kill Hitler if possible. Had the Jewish people been able to, they too would not have blinked at nuking Germany and trying to kill Hitler in the process.
Japan would have nuked the United States and the rest of the allies. Germany would have nuked everybody at their leisure to 'win.'
The Empire of Japan was an extraordinarily powerful nation. Their military technology was very advanced, and they demonstrated endlessly that they were willing to use it brutally in instigation of war. They slaughtered millions upon millions in their Chinese invasion. It took a very substantial portion of America's considerable industrial base to defeat Japan.
It took two nuclear bombs before Japan capitulated with an unconditional surrender. The first one wasn't enough, which more than proves they were willing to shed millions more lives to keep fighting. America would have had to invade Japan and would have killed millions in taking the island to stop the war.
America had nukes before everybody else, and if their desire had been to do so, could have wiped out every other capital and brought the entire planet to its knees, regularly nuking anybody that dared to twitch about a nuclear program.
America also could have allowed a war to proceed with the USSR immediately after WW2, and nuked the USSR repeatedly and instantly become the sole superpower.
And in the last 67 years, America has specifically chosen to not use nuclear weapons of any sort, despite the radical military advantage that it has possessed for most of that time. Nukes in Vietnam would have ended that conflict very quickly.
It's a tragedy that Hiroshima and Nagasaki were nuked. Japan instigated war, both in general in the Pacific, and against America. Japan joined with Nazi Germany in a pact to destroy the allies. It was absolute war. I hope nobody reading this today ever has to really come to understand what that means.
Sorry to burst your bubble, but WW2 was not actually an "ABSOLUTE WAR". Very, very intense? Of course. But not absolute.
For example during WW2 all of the major participants had chemical warfare weapons. Several, including Germany, had significant stockpiles. (Germany actually had the most effective stockpiles, though they seem to have not believed this at the time.)
The only significant use of chemical warfare was by the Japanese against other Asian countries that did not have chemical weapons. Nobody else dared use those weapons on each other for fear of the response.
And so it has remained. A lot of countries have chemical weapons. There have been a lot of wars between countries armed with them. There have been a number of threats that they would be used (for instance Iraq threatened to use them on Israel during the first Gulf war). And yet the only time they get used is against opponents who are not similarly armed. (For instance Iraq fought a bloody war against Iran without using chemical weapons - then used them on parts of its own population who they thought had been disloyal in the war.)
This fact gives me hope that we will continue to not use nuclear weapons as well.
For example during WW2 all of the major participants had chemical warfare weapons. Several, including Germany, had significant stockpiles. (Germany actually had the most effective stockpiles, though they seem to have not believed this at the time.)
The only significant use of chemical warfare was by the Japanese against other Asian countries that did not have chemical weapons. Nobody else dared use those weapons on each other for fear of the response.
And so it has remained. A lot of countries have chemical weapons. There have been a lot of wars between countries armed with them. There have been a number of threats that they would be used (for instance Iraq threatened to use them on Israel during the first Gulf war). And yet the only time they get used is against opponents who are not similarly armed. (For instance Iraq fought a bloody war against Iran without using chemical weapons - then used them on parts of its own population who they thought had been disloyal in the war.)
This fact gives me hope that we will continue to not use nuclear weapons as well.
the main point i got was that retaliatory power was the disincentive to use weapons of mass destruction. Provided that relatiatory power exists, peace will ensure.
Many historians argue that dropping the bombs was unnecessary. With the USSR transitioning its army to the east and preparing to invade Japan, it was clear Japan was going to lose with or without nuclear weapons. There is evidence that the US sped up deployment of nuclear weapons so that their effectiveness could be demonstrated to the world before the war ended. This argument is usually used to point out that the bombs were used unnecessarily.
Obviously the bombs killed fewer people than a full scale invasion of Japan (and from the perspective of the US, the only casulities were Japanese, not American and Japanese). But many historians would argue that a full scale invasion of mainland Japan was never going to happen after the USSR decided to engage Japan as well. The writing was on the wall.
That said, I think you have a good point using the counterfactual of what would have happend if anyone else got to the nuclear weapon first. Germany would have absolutely nuked anyone and everyone if they could. Japan might have as well (not sure what they would have used it against, maybe the Panama canal? I don't see how they could have launched one against mainland USA without an ICBM). The UK and USSR probably would have if they could.
Basically anyone that showed the stomach to firebomb entire cities would also have used the nuclear weapons of the day if they could.
It also took a couple of years before the full appreciation of the dangers of nuclear fallout became apparent. Not to mention, the nuclear weapons used in WW2 have a tiny yield in comparison to modern nuclear weapons.
Obviously the bombs killed fewer people than a full scale invasion of Japan (and from the perspective of the US, the only casulities were Japanese, not American and Japanese). But many historians would argue that a full scale invasion of mainland Japan was never going to happen after the USSR decided to engage Japan as well. The writing was on the wall.
That said, I think you have a good point using the counterfactual of what would have happend if anyone else got to the nuclear weapon first. Germany would have absolutely nuked anyone and everyone if they could. Japan might have as well (not sure what they would have used it against, maybe the Panama canal? I don't see how they could have launched one against mainland USA without an ICBM). The UK and USSR probably would have if they could.
Basically anyone that showed the stomach to firebomb entire cities would also have used the nuclear weapons of the day if they could.
It also took a couple of years before the full appreciation of the dangers of nuclear fallout became apparent. Not to mention, the nuclear weapons used in WW2 have a tiny yield in comparison to modern nuclear weapons.
This post makes an extremely important and very very very poorly understood point. You are absolutely correct that whilst the conventional wisdom is that the US nuked Japan to avoid the loss of 500,000 lives invading the mainland the historical record is rather different. Recent scholarship has made this plain. For those interested I recommend starting with Gar Alperovitz's 'The Decision to Use the Atomic Bomb.'
On a point of detail, ironically it isn't true that 'the only casualties were Japanese." In Nagasaki there were a large number of conscripted foreign workers as well as the native Japanese population (mostly women and children).
Another good point about the firebombing. The US and UK airforce leaders were clear that if they lost the war the 1000 bomber raids onto civilian targets would likely be classified as war crimes and that they personally would be tried as war criminals.
On a point of detail, ironically it isn't true that 'the only casualties were Japanese." In Nagasaki there were a large number of conscripted foreign workers as well as the native Japanese population (mostly women and children).
Another good point about the firebombing. The US and UK airforce leaders were clear that if they lost the war the 1000 bomber raids onto civilian targets would likely be classified as war crimes and that they personally would be tried as war criminals.
You're definitely right that it was a war of decimation and sheer destruction (eg the fire bombing). It was a fight to the death. It's what makes a war like that so damn scary, the gloves literally come off. WW1 of course had plenty of that as well (chemical weapons). The civilian population required to support the industry necessary to build the war machines are part of the targeting if your intention is to survive that sort of conflict and stop the opponent's ability to produce more tanks, planes and weapons.
One other thing comes to mind -- the conflict in the Pacific had a more distinctly nasty racial and imperial cast than the conflict in Western Europe. The fighting was more savage, and the enemy more demonized (on both sides). This made it easier to carry out the destruction of a whole city.
I suppose Japan could have used strategic nuclear attacks, against the island gains the US forces were making in the Pacific, and potentially nuking our fleet groups.
They probably could have nuked Hawaii as well with some effort, and pushed the US forces even further back to shore and reduced our visibility / force projection.
They probably could have nuked Hawaii as well with some effort, and pushed the US forces even further back to shore and reduced our visibility / force projection.
Ever hear about King Leopold and the Congo. Belgium has a nasty history (U.S. estimates up to 15 million Congolese killed). Wikipedia shows "wiped off the map" propaganda by the west is just that. The real statement was a hope for regime change, something the U.S. calls for and instigates repeatedly.
Yes, this is an act of war. So what? Is Iran going to declare war on the US?
Yes, but they do that every Friday. Iran has been openly at war with the United States for over thirty years and loudly reminding the world of that fact at every opportunity. The only surprise in the US now committing an act of war against Iran is that the US has finally retaliated in some form other than complaining or giving Iran money and weapons in the misguided belief they might become friends.
they say they are at war, but they in their minds know they have no chance in hell to beat the USA in a conventional war.
They want to keep instigating hate towards the west. I believe the leaders of that country would like their population's rage to be directed at an external entity, and not cause unrest (among other things of course).
They want to keep instigating hate towards the west. I believe the leaders of that country would like their population's rage to be directed at an external entity, and not cause unrest (among other things of course).
I'm sure China have done plenty of - successful - attacks already. The States don't have an interest in disclosing these findings, nor do the Chinese, though.
"...is based on interviews...with current and former American, European and Israeli officials... None would allow their names to be used..."
Not exactly confirmed, but at least there are a few more details being (intentionally?) leaked. Good ole NYT is always ready to spill the words of unnamed 'officials', but the more interesting question is why, or why now?
Not exactly confirmed, but at least there are a few more details being (intentionally?) leaked. Good ole NYT is always ready to spill the words of unnamed 'officials', but the more interesting question is why, or why now?
This is sad. China has one more strong execuse to buff its national firewall.
Why is it sad? I'd prefer a cyberwar over a physical one.
And in any case the Chinese national firewall is utterly useless for preventing this.
And in any case the Chinese national firewall is utterly useless for preventing this.
It's all fun and games until a nuclear plant blows up.
I know, nuclear plant don't blow up, but you get my point.
I know, nuclear plant don't blow up, but you get my point.
> but you get my point.
No I don't. A physical war can also blow things up. How is a cyberwar worse?
This is not a game, it's a covert attack.
No I don't. A physical war can also blow things up. How is a cyberwar worse?
This is not a game, it's a covert attack.
I didn't say it was worse or better.
My point is: "cyberwar" can be responsible for painful and "real" physical damage in the physical world. In that regard it is in no way "better" than the "usual/conventionnal" physical wars.
> can be responsible for painful and "real" physical damage in the physical world
Well of course, that's the entire point! They are not trying to do entirely virtual actions à la Star Trek's A Taste of Armageddon.
However, you have to concede that at least so far the physical damage is far lower, and therefor unlike you I do regard it as better.
Well of course, that's the entire point! They are not trying to do entirely virtual actions à la Star Trek's A Taste of Armageddon.
However, you have to concede that at least so far the physical damage is far lower, and therefor unlike you I do regard it as better.
Imagine I could blow MasterCard and every single bit of data they possess up. Its consequences are worse than 15 nuclear bombs.
Really?
Lets say you did blow Mastercard up.
Worst case, the government prints money to pay off all the debts (a 'bailout' if you will). We've done this for far less than a cyber attack. There is some inflation, a lot of hand wringing about cyber security, and the world goes on. GDP might drop a bit, maybe it triggers a recession, but a year later we're back on our feet.
15 nuclear bombs could kill millions of people. Entire cities could be wiped out with 300+ years of history, architecture, irreplacable museum artifacts, etc. People in general would flee cities en mass. It would fundamentally shake the country and likely lead to the US retaliating in a nuclear war, or at least a large scale general war not seen since WW2. The US would probably roll a million man plus army across the middle east or north korea to destroy whatever country allowed the bombs to be built. That war would not be the (relatively) white gloved affair that are the current rules of engagement.
I understand hyperbole, but that statement is just false.
Lets say you did blow Mastercard up.
Worst case, the government prints money to pay off all the debts (a 'bailout' if you will). We've done this for far less than a cyber attack. There is some inflation, a lot of hand wringing about cyber security, and the world goes on. GDP might drop a bit, maybe it triggers a recession, but a year later we're back on our feet.
15 nuclear bombs could kill millions of people. Entire cities could be wiped out with 300+ years of history, architecture, irreplacable museum artifacts, etc. People in general would flee cities en mass. It would fundamentally shake the country and likely lead to the US retaliating in a nuclear war, or at least a large scale general war not seen since WW2. The US would probably roll a million man plus army across the middle east or north korea to destroy whatever country allowed the bombs to be built. That war would not be the (relatively) white gloved affair that are the current rules of engagement.
I understand hyperbole, but that statement is just false.
> I'd prefer a cyberwar over a physical one
As long as we heed the lesson from Star Trek, episode 23, "A Taste of Armageddon" and don't make cyberwars so clean that no one bothers to end them.
As long as we heed the lesson from Star Trek, episode 23, "A Taste of Armageddon" and don't make cyberwars so clean that no one bothers to end them.
[deleted]
What? Their "national firewall" is for censorship of certain websites, what does that have to do with this?
Didn't Pentagon said last year that they would consider cyber attacks as acts of war?
Yes. That position has now pretty much lost credibility, which in my view is no bad thing. I've had the good fortune to never experience actual war, but I'm pretty sure nobody with such experience, is in the slightest doubt about the difference between that and sabotaging computers, however annoying the latter might be. If cyber-conflict is going to take place, I think it's in everyone's interest to keep it at that level and stop it spilling over into war.
[deleted]
“It turns out there is always an idiot around who doesn’t think much about the thumb drive in their hand.”
Good quote. And there seems to always be a Windows PC around that auto-runs anything you stick into it.
Good quote. And there seems to always be a Windows PC around that auto-runs anything you stick into it.
The actual exploit stuxnet used to get onto Windows PCs didn't require the computer to have autorun turned on. The exploit runs on all newer versions of Windows (XP-7) and it triggers by browsing the device's contents with Explorer. (Specifically, it exploits a method Explorer uses to show icons on .lnk (Windows' sym-links) files.)
http://www.geek.com/articles/news/new-stuxnet-usb-exploit-th...
http://www.geek.com/articles/news/new-stuxnet-usb-exploit-th...
The most interesting information in here to me by far:
> In an interesting twist, it was discovered that the Stuxnet
> malware group makes use of device drivers which were digitally
> signed to make them appear as though they originated from
> hardware vendor Realtek Semiconductor Corp. The digital
> certificate has since been revoked but it is worrying that
> malware writers seemingly had access to a private key issued to
> a trusted supplier of device drivers.You're corroborating the grand-parent's point that Windows PCs autorun everything you stick into them. Granted, in this case it's not by design, but still...
That's kinda the point: blaming autorun will make people who are "smart" enough to switch off autorun feel secure.
But they aren't. There are vulnerabilities far more insidious than autorun.
But they aren't. There are vulnerabilities far more insidious than autorun.
Good job there are no Windows machines used for any critical infrastructure in our country then.
Nope, the stuxnet crew had a couple of zero days in their pocket. No need to do anything but stick it in. Limited user account? Doesn't matter, it performed a privledge escalation.
All IT is just gum and bailing wire. I don't even think its possible to truly secure a non-trivial OS. I'm just surprised at how infrequent stuff like this gets found out.
All IT is just gum and bailing wire. I don't even think its possible to truly secure a non-trivial OS. I'm just surprised at how infrequent stuff like this gets found out.
Yeah, but you have to consider they'd also say this even if a double-agent was used.
[deleted]
Is this a purposeful leak to take credit for a national security win before the election? Seems like they kept it under wraps pretty well until now.
There was a TED talk by Ralph langer in which he was asked if he thought the Mossad was behind Stuxnet, as that was the common belief. His response was that it must be the only cyber superpower -- the US.
There was a TED talk by Ralph langer in which he was asked if he thought the Mossad was behind Stuxnet, as that was the common belief. His response was that it must be the only cyber superpower -- the US.
This is an excerpt from a soon-to-be-published book, so some of the quotes might be much older.
I'm a little disappointed by the lack of named sources and/or documents. Most assertions are anonymous paraphrases or quotes. That seems thin, and makes the book seem rushed and exploitative.
What amazes me, and please excuse my naïvety, is that the congressmen are constantly pushing for more control online- whether that be monitoring skype, access to our facebook, or what have you. Basically taking our freedom in the name of 'Cyber Security', however on the other hand, they're the ones who are creating these viruses, exploiting systems and posing cyber threats.
What has the world come to?
What has the world come to?
It appears they "acquired" Realtek's code signing certificate. Can Realtek bring action against the U.S. for stealing the certificate?
Edit: For stealing the private key, I mean.
Edit: For stealing the private key, I mean.
HB Gary was passed the source in 2010: http://crowdleaks.org/hbgary-wanted-to-suppress-stuxnet-rese... Anonymous scooped the NYTimes.
To defend myself against the downvoters who may not have made the same connections: Aaron Barr talks to Defence Intelligence Agency and DoD about StuxNet in 2010, they had a copy given to them in 2009 that they claim was a US produced binary. Keep in mind stuxnet was 'discovered' in 2010.
First reference to Stuxnet being U.S. government produced?
They had a binary they believed was US produced. It was Stuxnet. It was 2009.
First reference to Stuxnet being U.S. government produced?
They had a binary they believed was US produced. It was Stuxnet. It was 2009.
How ironic that one of the first major forays into cyber warfare be codenamed "Olympic Games".
[deleted]
So now countries will fight cyber war, then what? cyber defense systems. So humans will never learn lessons, will they? How far is Skynet?
It's okay. We'll just add this line of code in: http://xkcd.com/534/
Meanwhile, the US continues to attempt to extradite Garry McKinnon from the UK - without a trace of irony.
This is like saying that because the US mistakenly invaded Iraq, it no longer has the moral authority to prosecute drive-by shootings. The syllogism holds on a message board but is useless in reality.
Are there any clues , how many people worked on stuxnet and flame.coding style methodology, how this project was managed etc. ? (Im still not convinced that this is from goverment)
Semantec has done several detailed analyses of Stuxnet. They are in no doubt this was an extremely well resourced project that was state financed.
Yeah I read that, but nobody seems to mention what coding and project management practices were used in development of this software.
If this software is really done by military then it's development process was following some strict military standards and regulation. and should be similar to existing other software.
Regulations like : How is software partitioned to modules? What interfaces it is using? Are this novel or existing techniques? and things like that.
If this software is really done by military then it's development process was following some strict military standards and regulation. and should be similar to existing other software.
Regulations like : How is software partitioned to modules? What interfaces it is using? Are this novel or existing techniques? and things like that.
The code was (obviously) obfuscated and encrypted in every way possible so that it's origin or any details about it's inception cannot be read if someone catches the code. To expect a readme file saying "managed by git on mac" in stuxnet's root directory is laughable.
Obama will do anything to avoid a conflict right now. If gasoline prices go up any more, his opposition will be running ads replaying the video of him saying he believes that gasoline should be in the $5-$7 range so alternative energy will become more adopted. (everyone knows this so it makes him very weak internationally)
So this should surprise no one. He used technology to get elected, and he will use technology to try and stop Iran without a physical military conflict.
So this should surprise no one. He used technology to get elected, and he will use technology to try and stop Iran without a physical military conflict.
[deleted]
[deleted](1)
All else aside, this is a clear pointer to government contractors.