STUXNET, rootkits and other nasties...
05-15-2012, 08:03 PM
#1
Gets Weekends Off
Thread Starter
Joined APC: Nov 2010
Position: Journo by night, irrigator by day
Posts: 220
STUXNET, rootkits and other nasties...
Wikipedia's definition [excerpt]
Stuxnet is a computer worm discovered in June 2010. It initially spreads via Microsoft Windows, and targets Siemens industrial software and equipment. While it is not the first time that hackers have targeted industrial systems, it is the first discovered malware that spies on and subverts industrial systems, and the first to include a programmable logic controller (PLC) rootkit.
The worm initially spreads indiscriminately, but includes a highly specialized malware payload that is designed to target only Siemens supervisory control and data acquisition (SCADA) systems that are configured to control and monitor specific industrial processes. Stuxnet infects PLCs by subverting the Step-7 software application that is used to reprogram these devices.
Note: Stuxnet wasn't discovered, it was revealed. Had mossad[?] not deployed STUXNET it would still be concealed, inactive and invisible to malicious software scanners. In fact it is not unknown for worms like this to piggy back on virus scanners to other host systems and remain dormant. This kind of code is designed to remain dormant until it spreads to its target system, in this cast the Iranian's nuclear processing centrifuge system.
All this technology is sold as robust. In actual fact it is very fragile. A java script of no more than 25 characters could wipe all of your hard drives [permanently] and collapse APF for a while if skillfully deployed.
Just a little something for you all to discuss with your contemporaries when discussing the woes of Automation. BTW Stuxy is now being used as a sandbox. If you are computer nerd and want to play with stuxnet, or want to know more feel free to PM me.
I'd love to know your thoughts...
05-16-2012, 01:05 AM
#2
With The Resistance
Joined APC: Jan 2006
Position: Burning the Agitprop of the Apparat
Posts: 6,191
My thought is that burning up Iranian centrifuges was an an incredibly effective ploy, if only for the short term. Thousands of somewhat difficult to obtain machines turned to junk, it was a win/win at low human cost.
Who would want to do such a thing? Possibly the entire world.
Tech can clearly be used for good or evil, it has no morals, in this case the result was on the side of good. No rational country has a problem with peaceful nuclear power, but when you threaten millions weekly with the new toy you are building and refuse international inspection it casts strong doubts on motives.
Who would want to do such a thing? Possibly the entire world.
Tech can clearly be used for good or evil, it has no morals, in this case the result was on the side of good. No rational country has a problem with peaceful nuclear power, but when you threaten millions weekly with the new toy you are building and refuse international inspection it casts strong doubts on motives.
Last edited by jungle; 05-16-2012 at 01:29 AM.
05-16-2012, 01:49 AM
#3
Gets Weekends Off
Thread Starter
Joined APC: Nov 2010
Position: Journo by night, irrigator by day
Posts: 220
My thought is that burning up Iranian centerfuges was an an incredibly effective ploy, if only for the short term. Thousands of somewhat difficult to obtain machines turned to junk, it was a win/win at low human cost.
Who would want to do such a thing? Possibly the entire world.
Who would want to do such a thing? Possibly the entire world.
My point is that many people question automated systems on board aircraft in relation to electromagnetic phenomena or software 'crashes' but I have yet to read an objective intelligent discussion about malicious code being deployed to non conventional systems.
Like I say, I'm a realist. I am not tying to be sensational. I would be very surprised if uploads to aircraft were not kept very secure. But still systems like ACARS are a means of accessing systems at a chip level from the outside world.
05-16-2012, 02:03 AM
#4
With The Resistance
Joined APC: Jan 2006
Position: Burning the Agitprop of the Apparat
Posts: 6,191
Well it sounds like we're both realists, sometimes the end justifies the means...
My point is that many people question automated systems on board aircraft in relation to electromagnetic phenomena or software 'crashes' but I have yet to read an objective intelligent discussion about malicious code being deployed to non conventional systems.
Like I say, I'm a realist. I am not tying to be sensational. I would be very surprised if uploads to aircraft were not kept very secure. But still systems like ACARS are a means of accessing systems at a chip level from the outside world.
My point is that many people question automated systems on board aircraft in relation to electromagnetic phenomena or software 'crashes' but I have yet to read an objective intelligent discussion about malicious code being deployed to non conventional systems.
Like I say, I'm a realist. I am not tying to be sensational. I would be very surprised if uploads to aircraft were not kept very secure. But still systems like ACARS are a means of accessing systems at a chip level from the outside world.
Not to say it can't happen, but any input is tightly managed, much like I imagine current Iranian centrifuges are now managed.
05-22-2012, 09:08 PM
#6
Gets Weekends Off
Joined APC: Dec 2008
Posts: 299
Eh, I'd be more concerned about other parts of our infrastructure being handled poorly. Specifically how the FAA has outsourced the Next-Gen ATC system to folks who are sub-contracting it out and in the process have compromised for a less reliable system. When ATC facilities have circuits into a large service providers layer-3 router who has a port to a Costco store and a cable company, do you really trust that we have the appropriate levels of separation? Or are we simply buying a service on the cheap just to make the thing work and rely upon the word or SLAs from a vendor.
Regarding STUXNET, I think the main thing to focus on is complexity. The more complex the system, the higher the likelihood that things can and will go wrong. If you sacrifice isolation and air gaps for better interconnectivity/communication with systems in order to share more data, you expose things. If you add enhanced diagnostic capabilities you expose things you might not have wanted to. Luckily aviation has stayed dead-stupid in the critical systems (mostly), so it is not as bad as other areas such as electrical utility SCADA systems being open to anyone on the Internet. On top of all this, the monolithic, slow and draconian FAA related certification on equipment does a fine job of keeping bright shiny object features out (more as a side effect).
I'd like to think that people vending products in the aviation space that are critical are doing the due diligence and hiring the right skillful auditors to perform attacks on their wares before they release them.
Regarding STUXNET, I think the main thing to focus on is complexity. The more complex the system, the higher the likelihood that things can and will go wrong. If you sacrifice isolation and air gaps for better interconnectivity/communication with systems in order to share more data, you expose things. If you add enhanced diagnostic capabilities you expose things you might not have wanted to. Luckily aviation has stayed dead-stupid in the critical systems (mostly), so it is not as bad as other areas such as electrical utility SCADA systems being open to anyone on the Internet. On top of all this, the monolithic, slow and draconian FAA related certification on equipment does a fine job of keeping bright shiny object features out (more as a side effect).
I'd like to think that people vending products in the aviation space that are critical are doing the due diligence and hiring the right skillful auditors to perform attacks on their wares before they release them.
05-23-2012, 01:14 AM
#7
Gets Weekends Off
Thread Starter
Joined APC: Nov 2010
Position: Journo by night, irrigator by day
Posts: 220
Regarding STUXNET, I think the main thing to focus on is complexity. The more complex the system, the higher the likelihood that things can and will go wrong. If you sacrifice isolation and air gaps for better interconnectivity/communication with systems in order to share more data, you expose things. If you add enhanced diagnostic capabilities you expose things you might not have wanted to. Luckily aviation has stayed dead-stupid in the critical systems (mostly), so it is not as bad as other areas such as electrical utility SCADA systems being open to anyone on the Internet. On top of all this, the monolithic, slow and draconian FAA related certification on equipment does a fine job of keeping bright shiny object features out (more as a side effect).
There is of coarse a huge elephant in the room, whose name is MicroSoft. I'm not going to turn this into an OS debate, there is no need; UNIX. The reason the skys are safe is the same as the reason Y2K was a scam; UNIX. UNIX accounts for the human desire for the existential expression of its concept of 'time' by counting seconds since 1970, and converting it to a human friendly DD/MM/YYYY x HH:MM:SS format. No Y2K.[On February 13, 2009 at exactly 23:31:30 (UTC) *NIX time reached a epoch] The reason root-kits can't 'host' on UNIX systems as Kernel [core code set] address every 'process' with an ID [PID]. Processes [or programs attempting to 'execute'] that don't get an ID properly, aren't allowed to 'run' [forced kill process]. Its really as simple as that!
The Penn and Teller no BS about stuxnet would conclude that it is a means for windows users to access programmers features in chips that control 'automated systems' in industry. These features are normally hidden to 'user' level access.
In a relm without walls or fences, what need is there for windows or gates?.. sorry.
UNIX in this case means all UNIX like operating systems including, but not limited to UNIX , Solaris, BSD, Linux, Android, AndroidOS, the 'apple cats' and the plethora of 'i' operating systems.
05-23-2012, 04:41 PM
#9
Gets Weekends Off
Thread Starter
Joined APC: Nov 2010
Position: Journo by night, irrigator by day
Posts: 220
... I wonder if by 2038 if there will be a movement, a digital historic group perhaps, that will act to protect any antique 32 bit systems.
It is true though.. the 2038 problem is a real issue, as opposed to y2k. That was a slight problem with a happy ending for marketers / vendors...
FYI, any one running a unix like os [including apple OS] on a 64bit system mark this date in your planner:15:30:08 on Sunday, 4 December 292,277,026,596..... you are good to go for another 290 billion years before your next known time anomaly...
