01.17.11

The Exciting Story of Stuxnet and Received Wisdoms

Posted in Crazy Weapons, Cyberterrorism at 11:22 am by George Smith

By now you have heard of or read the exciting story of Stuxnet as a joint Israeli-US cyberweapon. The first of its kind, setting back Iran’s nuclear program for years. Ushering in a new age of cyberwar, it demonstrates the application of the neatest high-tech braininess in malware creation. And so on.

The new ages of cyberwar have been coming for awhile — well over a decade. But they never arrive. Or they have in various ways, just not quite as billed and conflict remains pretty much as always. That is, one needs to make a computer program physically damaging.

Which is where Stuxnet has fit the bill.

Briefly, the received wisdoms, collected by the Times for a cracking good read, describes Stuxnet as actually causing Iran’s uranium centrifuges to tear themselves apart. That is, by taking over the controlling software and forcing an unbalanced operation while reporting that all was OK at the front desk.

The fly in the ointment, and apparently one weak link in Iran’s nuclear program, is the centrifuge in question, called the P-1, sold to Iran by Pakistan.

It’s a crap piece of highly-engineered kit required to work reliably under a great deal of physical stress. However, one doesn’t read this in the NY Times piece until we’re almost at the end of the story.

Reports the Times:

But the United States and its allies ran into the same problem the Iranians have grappled with: the P-1 is a balky, badly designed machine. When the Tennessee laboratory shipped some of its P-1’s to England, in hopes of working with the British on a program of general P-1 testing, they stumbled, according to nuclear experts.

“They failed hopelessly,??? one recalled, saying that the machines proved too crude and temperamental to spin properly.

The New York Times article reports as elegantly and with the same inarguable finality one might see or read from Alex Jones and his many exposes on conspiracy and international doings.

Weaving together the lore on Stuxnet, which has been building for months, it employs anonymous intelligence from unnamed sources. It tells of a plan — a collaboration of Israel and the US, to install their own P-1 centrifuge cascades so as to study the shortcomings of the Iranian production facilities. And eventually glomming onto the idea, a little serendipitously, that controller software could be subverted in an attack on them.

At which point, work went forward to put Stuxnet together and test it on an Israeli P-1 centrifuge cascade secretly installed at Dimona.

Now, here’s the thing: A named expert on Israel’s nuclear program told the times that “Israel succeeded — with great difficulty — in mastering the [P-1] centrifuge technology.”

So, reiterating, the P-1 is a crap centrifuge which needs a lot of work to sustain. It has a good failure rate all by itself. The United States could not make them work. But the Israelis, after a great deal of effort, did.

According to the New York Times story, the Iranians have had a great deal of P-1 centrifuge failure. Which might be expected after reading the material on the nature of the machine.

Circumstantially, the New York Times story, in sources and tone, attributes virtually all of it to Stuxnet.

Maybe it’s absolutely true. Or maybe only partially so. And perhaps the P-1 centrifuges have bedeviled the Iranian bomb program all along because they are rubbish, with or without state-operated malware added.

If some Iranian nuclear scientists could be persuaded to send material to WikiLeaks …

For current purposes it’s good to look at the story from the perspective that, as time goes on, it will grow in stature and mythic proportion. It will be cited time after time in every news story and paper on cyberwar ever written. And because of this it will have a continuing effect on secret military policy on the development of more malware cyberweapons, which will always be green-lighted, no matter how bad the ideas are.

I’ve argued before that there’s no deterrent to nations like the US or Israel tossing a cyberweapon at the world network. In this case, all the justifications are about stopping the Iran bomb program. But the art of virus-writing, even from its crudest days when done by kids, has always been loaded with justifications.

Ours will just be better. Or if not better just more secret and impossible to influence. Trust us. We’re responsible. And never bad international neighbors. Bad ideas with consequences unforeseen down the road never go to our heads.

If one believes all of the New York Times story there is also some good news in it. And it’s not necessarily the part about knocking out 1,000 centrifuges.

It’s that the development of Stuxnet, as reported, is beyond the capabilities of those who routinely write worms for criminal purposes. That coterie doesn’t have the resources to build something like a mock centrifuge facility and then test things on it.

However, since the history of malware distribution shows that whatever gets put on the world network gets to contribute its various bits and pieces to everyone else writing bad stuff.

Permalink