SCADA

You Were Warned: Cybersecurity Expert Edition — Now with Space Stations

Over the last handful of days breathless reports may have crossed your media streams about Stuxnet infecting the International Space Station.

The reports were conflations or misinterpretations of cybersecurity expert Eugene Kaspersky’s recent comments before the Australian Press Club in Canberra. Here’s an excerpt from his remarks, which you can enjoy in full in the video embedded above:

[26:03] “…[government] departments which are responsible for the national security for national defense, they’re scared to death. They don’t know what to do. They do understand the scenarios. They do understand it is possible to shut down power plants, power grids, space stations. They don’t know what to do. Uh, departments which are responsible for offense, they see it as an opportunity. They don’t understand that in cyberspace, everything you do is [a] boomerang. It will get back to you.

[26:39] Stuxnet, which was, I don’t know, if you believe American media, it was written, it was developed by American and Israel secret services, Stuxnet, against Iran to damage Iranian nuclear program. How many computers, how many enterprises were hit by Stuxnet in the United States, do you know? I don’t know, but many.

Last year for example, Chevron, they agreed that they were badly infected by Stuxnet. A friend of mine, work in Russian nuclear power plant, once during this Stuxnet time, sent a message that their nuclear plant network, which is disconnected from the internet, in Russia there’s all that this [cutting gestures, garbled], so the man sent the message that their internal network is badly infected with Stuxnet.

[27:50] Unfortunately these people who are responsible for offensive technologies, they recognize cyber weapons as an opportunity. And a third category of the politicians of the government, they don’t care. So there are three types of people: scared to death, opportunity, don’t care.”

He didn’t actually say the ISS was infected with Stuxnet; he only suggested it’s possible Stuxnet could infect devices on board. Malware infection has happened before when a Russian astronaut brought an infected device used on WinXP machines with her to the station.

But the Chevron example is accurate, and we’ll have to take the anecdote about a Russian nuclear power plant as fact. We don’t know how many facilities here in the U.S. or abroad have been infected and negatively impacted as only Chevron to date has openly admitted exposure. It’s not a stretch to assume Stuxnet could exist in every manner of facility using SCADA equipment combined with Windows PCs; even the air-gapped Russian nuclear plant, cut off from the internet as Kaspersky indicates, was infected.

The only thing that may have kept Stuxnet from inflicting damage upon infection is the specificity of the encrypted payload contained in the versions released in order to take out Iran’s Natanz nuclear facility. Were the payload(s) injected with modified code to adapt to their host environs, there surely would have been more obvious enterprise disruptions.

In other words, Stuxnet remains a ticking time bomb threatening energy and manufacturing production at a minimum, and other systems like those of the ISS at worst case. →']);" class="more-link">Continue reading

Blowback: Stuxnet and the Ongoing Risk to Manufacturing Worldwide

Dear Chevron: Thanks for letting us know you’ve been infected with Stuxnet. It’s difficult to muster sympathy for your management or shareholders, because you were warned.This guy quite clearly warned your industry, as did other firms specializing in technology security.

Every single manufacturer around the world using supervisory control and data acquisition (SCADA) driven equipment in their processes was warned. Businesses at particular risk are those relying on certain ubiquitous applications in a networked environment.

Perhaps you heeded the warning months ago but didn’t disclose widely that your business was working on eliminating the exposures. If your business has been hardening your systems, great. However, the public does have a right to know know if your plant located in their backyard might blow up or release toxic chemicals because your firm was exposed to cyber warfare elements our country sponsored in some fashion.

This goes for any other firms out there that are dealing with the same exposure. Perhaps you believe it’s a business intelligence risk to let your competitors know you’ve got a problem– frankly, we’re way past that. The potential risks to the public outweigh your short-term profitability, and if your plant blows up/dumps chemicals/produces unsafe or faulty products because of Stuxnet, our public problem becomes your public relations/long-term shareholder value problem anyhow.

By the way: perhaps it might be worthwhile to actively recruit American citizens who qualify for security clearance when hiring SCADA application analysts to fix your Stuxnet problems. Why compound your problem for lack of foresight with regard to national security risks? We can see you’re hiring. Ahem. →']);" class="more-link">Continue reading

Emptywheel Twitterverse
JimWhiteGNV Home alone for most of the weekend to watch baseball, but first I'm going to make curried chicken with carrots and rutabaga. Because reasons
1hreplyretweetfavorite
JimWhiteGNV @Ali_Gharib You shared the smoke with it, didn't you?
1hreplyretweetfavorite
JimWhiteGNV Speaking of Iran douchebaggery, isn't it interesting that it appears that we won't get UANI case tried before negotiation deadline?
1hreplyretweetfavorite
JimWhiteGNV My only regret is that Menendez is going down for something other than his Iran douchebaggery. But I'll take it, and gladly.
1hreplyretweetfavorite
JimWhiteGNV RT @NCAACWS: WEEKEND ITINERARY Fri - Watch College Baseball Sat - Watch College Baseball Sun - Watch College Baseball SCHEDULE: http://t.…
2hreplyretweetfavorite
emptywheel RT @EamonJavers: NEW: US government officials complain Silicon Valley firms are dragging their feet on getting security clearances. http://…
3hreplyretweetfavorite
emptywheel @KevinBankston @csoghoian has a history of non-delivery with those he deems easy targets. @ageis @ashk4n @ahoymehearties @NewAmerica
3hreplyretweetfavorite
emptywheel @matthewt_ny Is there a Q&A during which you can ask "Why not Wall Street"?
3hreplyretweetfavorite
emptywheel @KevinBankston He's probably just trying to get whiskey out of @csoghoian. @ashk4n @ahoymehearties
4hreplyretweetfavorite
bmaz @emptywheel @matthewt_ny Or Schumer
4hreplyretweetfavorite
emptywheel @benjaminwittes Better if he respond indirectly by riling up prestigious judges on the other side of the world. @steve_vladeck
4hreplyretweetfavorite
emptywheel By Preet? RT @matthewt_ny: "He is a true superstar," among American lawyers, we're told of Preet.
4hreplyretweetfavorite
March 2015
S M T W T F S
« Feb    
1234567
891011121314
15161718192021
22232425262728
293031