It Was Only A Matter Of Time..

Gauss: Stuxnet-Linked Cyber Weapon Hits Lebanon.  ABC News, via Yahoo:

A new cyber weapon believed to be linked by code to the infamous Stuxnet worm has been discovered stealing banking information in Lebanon, according to Moscow-based cyber security firm Kaspersky Labs.


The new malware, dubbed Gauss for an in-code reference to a German mathematician, is designed to "steal and monitor data from clients of several Lebanese banks," among other nefarious abilities. The code also includes some kind of "special warhead" that is so well encrypted that Kaspersky has been unable to identify it.

Of the more than 2,500 instances of Gauss infections in the Middle East, more than 1,600 of them were discovered in Lebanon and nearly 500 in Israel, Kaspersky said in a blog post.

Kaspersky researchers said they discovered Gauss while investigating Flame, a massive espionage program revealed in May that was able to record nearly everything done on an infected computer, including real-world conversations that took place near it.

Kaspersky researchers had previously linked specific portions of code in Flame to Stuxnet, believed to be the first-ever true cyberweapon to do actual physical damage to its target, an Iranian nuclear facility, and Duqu, a surveillance worm based on Stuxnet. Now the Russian researchers said they believe Gauss to be related to those three as well.

"After looking at Stuxnet, Duqu and Flame, we can say with a high degree of certainty that Gauss comes from the same 'factory' or 'factories,'" the blog post said.

Kaspersky and several other cyber security firms said that Stuxnet and its kin are so sophisticated and required such a commitment of time and expertise that a nation-state was most likely behind their creations. A 2010 Congressional report on Stuxnet put the U.S. and Israel at the top of a short list of probable suspects and the New York Times reported Stuxnet was developed by the two countries as part of a wave of cyber aimed at Iran.

Peter Boogaard, a spokesperson for the U.S. Department of Homeland Security, said the agency is "coordinating with our federal and private sector partners to analyze" Gauss and is "working with organizations that could potentially be affected."

Kaspersky said that while a vast majority of the infections they've detected were centered in Lebanon, there were a few instances of Gauss detected on computer systems in the U.S. and the total number of infections is still unknown.

Wouldn't it be nice if we could apply this type of focused brain power to help humanity, as opposed to vanquishing it?  The Law of Unintended Consequences should be surfacing shortly..

Meet Flame, Son Of Stuxnet

Surprise!  "Hackers" up the ante!  Not really surprising, is it?  They're not really "hackers," either..  IT World.  Whole Thing, plus some comments:

Remember Stuxnet, the malware targeted at the Iranian nuclear industry? Say hello to Flame (Win32.Flame), a 20MB piece of modern cyberwar weaponry.



Detailed by Kaspersky Lab Expert Aleks in a Questions and Answers entry on SecureList, Flame is 20 times larger than Stuxnet and has been floating around the Middle East for two years or more. It is "a backdoor, a Trojan, and it has worm-like features," according to Kaspersky, and reports to about 80 command-and-control domains. Various Flame modules can be initialized on infected systems to change the information gathered.


Flame is able to infect a fully patched Windows 7 system, indicating it leverages a zero-day exploit not yet known to security researchers. The complexity and size of Flame indicates the likely developer was a "government-sponsored entity" according to the Wall Street Journal. Other names for Flame are Flamer, Wiper, Viper, and sKyWIper. It may be the "most complex malware ever found," according to a CrySyS Lab report.


Short sighted comment:

This is an advanced mechanism employed by a state agency. The article isn't overt, but the implication is clearly that this device is of US origin and purpose. Personally, I'm happy to see the US engaging in this sort of behavior. National Defense with low cost and no lives lost!



Andrew Middleton on wired.com

How ya gonna feel there, Andy, when Flame takes out the control systems of that nuclear plant you live downwind from?  How many lives will be lost if, during the middle of summer, entire power grids across the country are taken out, for weeks, even months?  Any cyber weapon we use can ultimately be used against us.  When you design software for cyber attack, that code can be captured, re-created and sent back at us with variants we might not be expecting.

These technologies are Digital Djinn:  They are magnificent powers, and should be treated with utmost respect.  Already though, it's too late.  They're already out in the cyberscape, ready to destroy, waiting to fulfill their programmed purpose, waiting until such time when the order does come.

Technologically Modern Society stands on a precipice much, much shakier than Technologically Modern Society could ever admit.  Most of the world will be oblivious to full on cyber warfare, though:  When it happens, no one will have power, so no one will fully know what's happening..  Besides, they'll probably be more focused on more immediate needs, like life during extended blackout chaos.  But trust me, there will some Episodes of Spectacular-ity during that conflict, that is for sure..

Pentagon chief: 'We're within an inch of war almost every day’

Jeremy Herb for The Hill.  Excerpts:

Defense Secretary Leon Panetta offered a blunt assessment of the threats facing the United States on Wednesday, saying the potential for another war breaking out remains high in places like North Korea.



“We’re within an inch of war almost every day in that part of the world,” Panetta said in an interview with CNN’s Wolf Blitzer, in response to a question about the threats in the Korean Peninsula. “And we just have to be very careful about what we say and what we do.”


Blitzer then asked Panetta, who joined with Secretary of State Hillary Clinton for an interview during the secretaries’ NATO meeting in Brussels, whether the North Korean threat kept him up at night.



“Unfortunately, these days there’s a helluva lot that keeps me awake,” Panetta responded, listing Iran, Syria, the Middle East, cyber warfare and weapons of mass destruction as other insomnia-inducing issues.

It's interesting he didn't mention India/Pakistan.  And wouldn't it have been quicker to say Fukushima?

Speaking Of GIGANTIC Balls..

Whose are bigger?  Anonymous, or This Dude? 

Both links courtesy of Raw Story.

IMF hit by 'very major' cyber security attack

The International Monetary Fund (IMF) says it has been targeted by a sophisticated cyber attack.

Officials at the fund gave few details but said the attack earlier this year had been "a very major breach" of its systems, the New York Times reports.

Candid.  Must be BIG.

In related news, Anonymous is back, baby..

Hackers penetrate U.S. defense contractors’ security networks

From Raw Story  Excerpts:

Reuters is reporting that unknown hackers have broken into the networks of Lockheed Martin and other major defense contractors and may have gained access to sensitive information on present and future weapons systems.

Reuters had reported earlier on Friday that "Lockheed Martin, the Pentagon's No. 1 supplier, is experiencing a major disruption to its computer systems that could be related to a problem with network security." The disruption began last Sunday, when security experts detected an intrusion.

According to an anonymous source with knowledge of the attacks, the hackers used data stolen in March from the RSA security division of EMC Corp. to duplicate security keys which gave them access to the networks.

"You have no idea how many people are freaked out right now," one security expert told Reuters, explaining that the RSA keys could no longer be considered fully secure.

I'm sure that last statement is a major understatement.  This article is just a tiny peek into the Cyber War, already in progress..  Will this endgame involve a massive explosion, or prevention of a massive explosion?  Another scary as hell, yet fascinating scenario.  Damn this Information Age and it's would be controllers and their silly deadly games..

Japan to Stuxnet: How Long Have You Been Standing There?

New cybervirus found in Japan / Stuxnet designed to attack off-line servers via USB memory sticks  From Daily Yomiuri Online.  Excerpts:

Stuxnet, a computer virus designed to attack servers isolated from the Internet, such as at power plants, has been confirmed on 63 personal computers in Japan since July, according to major security firm Symantec Corp.

The virus does not cause any damage online, but once it enters an industrial system, it can send a certain program out of control.

After Stuxnet finds its way onto an ordinary computer via the Internet, it hides there, waiting for a USB memory stick to be connected to the computer, when it transfers itself to the memory stick. When the USB device is then connected to a computer linked to an isolated server, it can enter the system and take control of it.
..
According to the security company, the virus is designed to target a German-made program often used in systems managing water, gas and oil pipelines. The program is used at public utilities around the world, including in Japan.

Was The Japanese Nuclear Crisis Compounded By The Stuxnet Worm?   Room Eight offers the Stuxnet virus as "crazy Pit Bull who didn't mean to attack" Japan, but did.  Horrible, but accidental.

Maybe. This one sounds more curious in a more conspiratorial light.. 10 Germans flee Japan's quake-hit nuclear plant.  Stuxnet targets Siemens equipment, which is German made..

Not to mention this little nugget from Slovenia.  Slovene nuclear plant fails to restart

I'm not sure if any of this can be combined or valid, but with Japan's opaque attitude towards public information, this theory, while thin at the moment, might not be later.  Consider this a bookmark.  If more evidence arises, we'll revisit.

File Under: Cyber War: This Could Be Big, or Dry Run?..

Foreign hackers attack Canadian government Excerpts:
An unprecedented cyberattack on the Canadian government from China has given foreign hackers access to highly classified federal information, and forced at least two key departments off the Internet, CBC News has learned.
..
Highly placed sources tell CBC News the cyberattacks were traced back to computer servers in China.
But they caution there is no way of knowing whether the hackers are Chinese, or some other nationality routing their cybercrimes through China to cover their tracks.
And:
..Sources have confirmed the attackers successfully penetrated the computer systems at the federal government’s two main economic nerve centres, the Finance Department and Treasury Board.
The hackers apparently managed to take control of computers in the offices of senior government executives as part of a scheme to steal the key passwords that unlock entire government data systems.
And:
For years, experts including the federal auditor general have been warning that security on the government’s networks is woefully inadequate and open to cyberattack. (This is why it will be disastrous for many, many governments and organizations is some full scale cyber war does erupt..)

For a trial run, this was pretty successful, as the next several attacks on slow-to-non-responsive governments or organizations targeted by these hackers will be. I'm guessing the next attack will be larger in scope, "show-ier," and more widely covered in the press. This is not to say that this attack won't be heavily covered in the press: It's fairly new, and has not completed one news cycle yet, but having said that, each time these hackers strike, the impact will be larger than the time before..

Hi: Remember Me? I'm Stuxnet. We Met Back In July..

Flaws in Stuxnet Worm Deflect Suspicion From US, Israel. From The Epoch Times. Poorly thought out interpretation of events. Excerpts in italics:

The New York Times published an article on Jan. 16 shining more light onto the issue. It stated that Israel built nuclear centrifuges identical to those in the Bushehr plant to test a computer worm, and had cooperation from the United States. Although there is still no direct proof that the United States or Israel were behind Stuxnet, the two countries were the main suspects to begin with.

Despite accusations that Stuxnet was a U.S.-Israel project, there are flaws in the worm that suggest it was created elsewhere. Black Hat DC conference on digital exploits and cyberattacks on Jan. 18, security consultant Tom Parker analyzed Stuxnet’s code.

Parker “presented a compelling case that Stuxnet may be the product of a collaboration between two disparate groups, perhaps a talented group of programmers that produced most of the code and exploits and a less sophisticated group that may have adapted the tool for its eventual use,” states a report from Threat Post, the security news service of anti-virus company Kaspersky Lab.

"This was probably not a Western state. There were too many mistakes made. There's a lot that went wrong," Parker said, according to Threat Post. “There's too much technical inconsistency. But, the bugs were unlikely to fail. They were all logic flaws with high reliability." In simple terms, there were technical shortcomings, but the virus was still highly reliable.

Nate Lawson, a cybersecurity expert with Root Labs, analyzed Stuxnet in a Jan. 17 blog post, stating, “I really hope it wasn’t written by the USA because I’d like to think our elite cyberweapon developers at least know what Bulgarian teenagers did back in the early ’90s.”

Funny, but probably not. Here's a differing opinion:

The “Stuxnet” computer worm made international headlines in July, when security experts discovered that it was designed to exploit a previously unknown security hole in Microsoft Windows computers to steal industrial secrets and potentially disrupt operations of critical information networks. But new information about the worm shows that it leverages at least three other previously unknown security holes in Windows PCs, including a vulnerability that Redmond fixed in a software patch released today. (The article was last updated September 22, 2010)

..Experts say the worm was designed from the bottom up to attack so-called Supervisory Control and Data Acquisition (SCADA) systems, or those used to manage complex industrial networks, such as systems at power plants and chemical manufacturing facilities.

The worm was originally thought to spread mainly through the use of removable drives, such as USB sticks. But roughly two weeks after news of Stuxnet first surfaced, researchers at Moscow-based Kaspersky Lab discovered that the Stuxnet worm also could spread using an unknown security flaw in the way Windows shares printer resources. Microsoft fixed this vulnerability today(possibly September 22), with the release of MS10-061, which is rated critical for Windows XP systems and assigned a lesser “important” threat rating for Windows Vista and Windows 7 computers.

In a blog post today, Microsoft group manager Jerry Bryant said Stuxnet targeted two other previously unknown security vulnerabilities in Windows, including another one reported by Kaspersky. Microsoft has yet to address either of these two vulnerabilities – known as “privilege escalation” flaws because they let attackers elevate their user rights on computers where regular user accounts are blocked from making important system modifications.

Anti-virus researchers also discovered that Stuxnet leverages a Windows vulnerability that Microsoft patched back in 2008. Roel Schouwenberg, a senior anti-virus researcher at Kaspersky, said initially it wasn’t clear why the worm’s designers included such an antiquated vulnerability, which would almost certainly set off alarm bells inside of any organization using common intrusion detection and prevention tools.

But Schouwenberg said the inclusion of that 2008 vulnerability made more sense when he learned that most industrial control system networks do not employ these defensive tools or even basic network logging, as is common in most corporate networks. Consequently, he said, Stuxnet behaves differently depending on what type of network it thinks it is running on. Stuxnet performs some rudimentary checking to see whether it is on a corporate network or a control systems network: If it detects that it is running on a corporate network, it won’t invoke the older 2008 vulnerability, Schouwenberg said.

What can't Bulgarian teens from the 90's do? They must be amazing in person!

Returning to the first link for more.. Tenuous-ness..

Like Parker, Lawson states that the Stuxnet worm is full of holes. Among the shortcomings are “the Stuxnet developers seem to be unaware of more advanced techniques for hiding their target,” and “It does not use virtual machine-based obfuscation, novel techniques for anti-debugging, or anything else to make it different from the hundreds of malware samples found every day.” (Go back and re-read the previous link)

Giving it credit, Stuxnet was highly effective and accomplished at what it was likely set loose to do—destroy Iran’s nuclear centrifuges. It was also incredibly clean and was free of any digital fingerprints that could trace it back to its creator.

The worm has no potential for monetary gain, which made the United States and Israel prime suspects.

And:

The larger issue currently at hand is that the code behind Stuxnet is now freely available. A virus, which likely took millions of dollars to create, that can physically control moving parts of infrastructure, and can access systems even if they are not connected to the Internet, is on the loose. (With more variants TBA, ASAP..)

A quick Google search reveals that Stuxnet is readily available for anyone to download via file sharing websites and links on message boards. Stuxnet has the potential to cause massive damage, and the main risk is possible alterations that hackers, terrorists, or foreign governments could make to the virus.

Think of Stuxnet as the cyberweapon equivalent of an improvised explosive device (IED). It is easily attainable and can cause huge damage, but the world now knows how to spot it. (Except that targeted networks sometimes don't even use the software to identify the particular(and specific) entry, which could change locations with each new version..)Like an IED, the real potential is in the alterations that can be made to make it more damaging and harder to spot.

Stuxnet is Low-Tech sophisticated, effective in its mission, has/had two points of entry not immediately addressed by Microsoft, cost millions to produce, and is essentially "public domain," now available for upgrades and remixes by.. Just about anybody! This event, and all related consequential behavior sounds a lot more advanced and strategic than it portrays itself. Which is a reflection of Stuxnet's creators.

The first Sons of Stuxnet should be arriving anytime now..

So.. How about that Super Bowl?

Hey! X Did Equal X!

Israeli cyber unit responsible for Iran computer worm – claim Excerpts in italics:
Computer experts have discovered a biblical reference embedded in the code of the computer worm that has pointed to Israel as the origin of the cyber attack.

The code contains the word "myrtus", which is the Latin biological term for the myrtle tree. The Hebrew word for myrtle, Hadassah, was the birth name of Esther, the Jewish queen of Persia.
In the Bible, The Book of Esther tells how the queen pre-empted an attack on the country's Jewish population and then persuaded her husband to launch an attack before being attacked themselves.

Israel has threatened to launch a pre-emptive attack on Iran's facilities to ensure that the Islamic state does not gain the ability to threaten its existence.
Ralf Langner, a German researcher, claims that Unit 8200, the signals intelligence arm of the Israeli defence forces, perpetrated the computer virus attack by infiltrating the software into the Bushehr nuclear power station
Mr Langer said: "If you read the Bible you can make a guess."

Israel threatened an attack, and an attack happened. Wouldn't it be more surprising if Israel didn't do it?

Let X=X

Iran's nuclear agency battles computer worm that can bring down power plants. Excerpts in italics:
Iranian media reports said Friday that the country's nuclear agency is trying to combat a complex computer worm that has affected industrial sites in Iran and is capable of taking over power plants.

The computer virus, which attacks a widely used industrial system, appears aimed mostly at Iran and its sophistication suggests a state may have been involved in creating it, Western cyber security companies said earlier in the day.

This is but the first of many super-cyberweapons. What might the future hold? Entire national infrastructures can all be attacked, all simultaneously. This utter and complete destruction can be mirrored in multiple countries. Battles will be waged along fiber optic tubes and via satellite. "Targeted Destruction" might be en vogue now, but what about the future? Will this different means of warfare lead to new and different tactics? And, lest we forget, each new variation will be more deadly and sophisticated than its predecessor. Global, long-duration chaos could happen almost instantly. And we as a planet may never return to the level of advancement achieved just prior to this technological annihilation, not in our lifetimes.

Welcome to the World of Tomorrow!