The NSA apparently perfectly aligned 4 zeros days in Siemens and Microsoft products to spread the malware from USB into the Iranian LAN (shared printers, industrial PICs etc).
The fact that they could choose and align 4 zero days indicates that the NSA probably has a large list of zeros days.
- They got exact hardware details and topology of the centrifuges somehow.
- They've stolen Realtek's driver signing keys.
- The virus looks like a simple worm which can infect other USB devices and doesn't unpack beyond a certain point if it can't find the SCADA equipment and the correct device ID & topology (It's like a homing cruise missile which looks like an RC plane from distance until it finds its target).
It's possibly the most sophisticated hacking campaign when social and technical aspects combined.
It’s the most sophisticated one _we know of_
I have been to Realtek's offices in Hsinchu many times. While the other efforts may have taken major resources I don't think getting their private keys would have been hard at all. Especially back then. IMHO the building and some people could be easily compromised and I suspect they didn't really care much about security.
Some ideas about the reason they had this particular hardware and software combination:
- The SCADA hardware they got was not compatible with newer software which runs on more modern OSes.
- The SCADA software didn't have any newer version which runs on newer OSes (Windows 7 and further versions are more restrictive in terms of direct HW access).
- Since there are sanctions it was the only hardware and software combo they were able to legally obtain.
Industrial control is like automotive industry. Everything is improved in minuscule steps and by encapsulating everything in more modern carriers. A good example is MODBUS. They still carry the same data, the old way. Only thing is it's either encapsulated in USB or TCP/IP. Why? Because it works and allows perfect backward compatibility.
Since neither the hardware and the software has to run latest version of Doom (metaphorically), if the application is reliable, it's left as is. Even if it runs on DOS 6.22.
Fun fact: There's an auto repair shop in Poland which runs its main application on a C64 [0].
[0]: https://www.popularmechanics.com/technology/gadgets/a23139/c...
[0]: https://www.goodreads.com/book/show/18465875-countdown-to-ze...
"USB drives in the parking lot" could be the tech industry's Korean fan death.
They are used to great effect in pentesting. I think it's natural to see a drive and think "Oh no, I need to get this back to a coworker."
A common counterargument comes up when discussing devices like smart speakers. Defenders say that the devices are too low-power and that we would be able to notice power usage changes and sniff network data being sent if spying were happening. IMO, this is true to an extent, but also any onboard preconfigured recognition of certain products could easily send info back to, say, Amazon servers and you wouldn't be able to distinguish it from a "false positive" question to "Alexa". Knowing the extent to which these capabilities are plausible and/or would have been caught by now if they existed is, to me, murky.
This also applies to on-board chips and wireless data. Would we not notice from power usage and sniffing?
I hear a lot about Intel's ME, but not much about AMD's PSP. I assume it's just as bad. At least we know how to hobble the ME.
No, we just think we know how to hobble the ME.
https://www.ebay.com/itm/191879410081
Not on all systems. It's neutralized and disabled on my Librem 15: https://puri.sm/learn/intel-me/.
Oh boy. That's some serious delusion in 2020. Wireless cards and higher end network interface cards are independent computers. Your processor has another processor (Intel ME and others) in it. Baseband Management Controllers are also independent computers on their own right.
With closed firmware and wireless capabilities, you can never know what they're doing at a given time.
Stuxnet reached systems which were seriously air gapped. Consider a what a laptop with a witty wireless card firmware can do.
I'm not getting into TEMPEST attacks and their newer versions, passive surveillance, etc.
I've listened tales about Cisco devices which were configured to isolate and prevent internet traffic but, they mistakenly forgot to drop some magic packets. Uh.
---
Random facts about this stuff:
- Your Intel system runs a special version of Minix on its Management Engine. A version of Minix customized for Intel by its original developer.
- There are photos of Cisco devices which were delightfully enchanced by NSA before shipping to its customer via special firmware and/or hardware. NSA still retains this capability.