Showing posts with label Stuxnet. Show all posts
Showing posts with label Stuxnet. Show all posts

Friday, September 27, 2013

Predicting the News That Will Be Reported - Not That Hard

I sometimes wonder at what passes for news.  News is thought to be the reporting of events that are not expected, you know, man bites dog stuff.  Here are some utterly predictable news stories. I am not bothering to link because the stories are ubiquitous.

  • News organizations do little to report that the latest Intergovernmental Panel on Climate Change does little to explain the recent lack of temperature rise (over the last 15 years or so).  There is an unsubstantiated claim that either deep sea warming or volcanoes have caused the relative lack of temperature rise.  The focus of news has been on the dire predictions of the report.  Those dire predictions keep getting pushed further into the future.
  • Health care exchanges' online systems are having technical problems and won't be ready on October 1. Sorry, this was too easy to know in advance.  Complex rules make for complex software.  If the Secretary of HHS can't seem to be clear about who is exempted or not, as one small example, how is a programmer supposed to write code?  
  • Younger, healthier workers to pay more under ACA.  This is a feature, not a bug of the system.  The problem for the administration is that most people have figured this out and are going to judge the penalties insufficient to cause them to sign up.  
  • New revelations of other ways that the NSA was spying on you keep popping up.  Let's face it, the NSA considered every way imaginable to spy on U.S. citizens.
While we are on the ease of predicting the news, I predict the Republicans will cause a government shutdown lasting a day or so, and then cave, as the media whips up a false "The Sky is Falling and It's Republican's Fault" headlines.  If the Republicans would adopt a sensible strategy they wouldn't need to go through this pain.  They should pass bills that fund the rest of government in piecemeal fashion, then fight over the ACA funding in the HHS appropriation.  Medicare and Social Security payments continue, for example, so there is not any real pain to voters from a shutdown.  Why the House Republicans get backed into a corner is beyond my comprehension. Nothing prevents them from breaking up the appropriations bill to suit their agenda; they control the House for crying out loud.  The Republicans real leverage lies in the fact that "discretionary" operations of the HHS can be tied to defunding the ACA, but popular programs aren't put at risk.

Finally, there isn't any reason the Republicans couldn't start dismantling the law a bit at a time, by repealing the tax on medical devices for example, rather than going for the whole enchilada of defunding.  They could really be popular by delaying the individual mandate by one year.  Best of all, they could cause the system to collapse by repealing all exceptions granted by the Secretary of HHS.  Imagine the delicious irony of Obama vetoing a bill that Republicans pass that required tight adherence to a law he sponsored.  The Republicans lack of imagination on the subject is appalling.  But that's not news either.

What You Should Be Reading
  • Iran backed hackers are already attacking Navy computers.  After America threatens to bomb Syria, Syrian hackers threaten retaliation.  Later, Iranian infiltration of U.S. Navy computers is revealed.  Iran is a major sponsor of the Syrian regime.  Love fest with Iranians ensues and we are now counting on Syria to cooperate in turning over chemical weapons.  As I predicted here and here, the Iranians tie the accusations to the U.S. semi-admission of introducing the Stuxnet virus into their nuclear program.  The incompetence of this administration's foreign policy apparatus is staggering.




Friday, September 21, 2012

Leaking Stuxnet

The Supermassive blackhole of incompetence that is the Obama administration has unleashed potential serious repercussions because of administration leaks that U.S. was behind the Stuxnet virus.  First, a little background.  The Stuxnet virus is an extremely sophisticated malware payload that targeted Iranian enrichment centrifuges.  What is little known, is that the there appears to be a "man in the loop" to direct the damage that the virus causes.  The virus was first spread through the use of infected USB thumb drives.  (Safety tip: there are multiple reasons you should never use these devices, ever.)  Then the virus spreads to other computers on the infected network and calls home.  It is looking for the signature of a software package used to program a Programable Logic Controller (PLC).  The virus is clearly sending information to a home computer and receiving updated instructions from a "man in the loop."  In this case the the individual controlling the virus went looking for software designed specifically to control the Siemens PLCs to control uranium enrichment centrifuges. You can view a simplified explanation of the process without reference to Iran or Siemens at Symantec.

The man in the loop is a big problem for the U.S., along with the leak that the U.S. was involved in the attack.  From the WaPo:
A damaging cyberattack against Iran’s nuclear program was the work of U.S. and Israeli experts and proceeded under the secret orders of President Obama, who was eager to slow that nation’s apparent progress toward building an atomic bomb without launching a traditional military attack, say current and former U.S. officials.
Is there any doubt that the political purpose of the leak was to enhance the administrations cred with regards to being tough on Iran?  This is the worst administration for politically motivated leaks I have ever seen.  What might be the consequences?

The subject of cyberwarfare is a little murky now, but I have no doubt that the general laws of warfare apply to cyberspace as well.  The Stuxnet attack seemed targeted to a military capability of Iran, avoiding civilian collateral damage.  By itself, the scrupulousness of the attack would make me believe that it was a U.S. product.  However, by leaking our involvement, the administration has left us open to a reprisal by the Iranians, against which we might have little recourse under international law.  International law provides for a proportional response to an attack by a foreign power; especially if that attack lacks sanction under any reasonable rubric of self defense or U.N. resolution.  If Iran respond with a cyber attack of their own, we have no recourse, not even through deniability, because the Iranians can claim proportional response.

Further, the disclosure puts U.S. personnel at risk who were involved in the construction of Stuxnet.  As a legal matter, the keys stolen from a Taiwanese firm that allowed the USB to hijack portions of the Windows operating system, were stolen illegally.  The admission makes the U.S. government a de facto partner or perpetrator of a criminal act that we have signed treaties to prevent.  Conceivably, a lawsuit to prise open information regarding the construction of the virus could follow.

To be clear, I support covert means to derail the Iranian nuke program.  But, the leakers should be punished, except that they have probably been sanctioned the President himself, for selfish political gain.  Damn the country, he needs re-election.  

In case you wanted the basic explanation: