Schneier on Security

Richard Steven Hack • July 11, 2011 6:48 PM

Very nice piece, well researched.

The amusing thing is that the whole Stuxnet effort, that is, the effort directed against Iran, was a complete waste of time since Iran does not have and has never had a nuclear weapons program.

In the same vein, as journalist Seymour Hersh recently revealed in a New Yorker article, the US has spent an incredible effort to try to detect such a program – including devices like replacing building bricks and street signs in Tehran with nuclear radiation detection devices – and has been unable to find anything at all indicating that Iran has such a program.

It has long been my contention that both the US and Israel KNOW that Iran does not have a nuclear weapons program, and that the entire “crisis” is made up to cover the real motivation which is regime change for the benefit of Israel. However, this level of effort would seem to belie that.

OTOH, if the senior members of the US and Israeli governments want to keep their primary motivation secret, it would still behoove them to send marching orders to the lower level grunts to do this sort of thing. Otherwise, people would get suspicious that maybe there really wasn’t anything to this “Iran bomb” business.

It’s hard to gin up a war – especially after the Iraq debacle – if people don’t believe there is a reason for it.

In 2007 the 16 intelligence agencies in the US generated an NIE – a National Intelligence Estimate – that Iran had stopped whatever nuclear weapons program they had in 2003 and had not restarted it. George W. Bush in his memoirs claimed this sabotaged his efforts to get a war with Iran.

Over the past year, those agencies re-assessed that estimate and earlier this year put out a new NIE – which has not been publicly released in even a redacted form – which basically agreed with the 2007 NIE. It hasn’t been released because it would embarrass Obama as much as the 2007 one did Bush.

I have long considered that whatever nuclear weapon program Iran ever had was probably a “research database” intended to determine how to build a bomb – but was never an actual development and deployment program. This would be “due diligence” for any country’s military who was being threatened by one or more nuclear powers.

So I was pleased to see in Sy Hersh’s piece the fact that the Defense Intelligence Agency believed that the only program Iran ever had was one it initiated because it was concerned that Iraq’s Saddam Hussein might have such a program. They didn’t even care about Israel or the US – it was Iraq that worried them (for obvious good reason given the eight-year war Iran fought with Iraq in the ’80’s.) The DIA estimate didn’t make it into the NIE because it would have been even more embarrassing to admit that Iran’s only nuclear weapons program was some “paper studies”.

None of this satisfies Israel, of course. Rumor has it that Israel is planning to attack Iran within the next two months, given that senior US Defense officials will be resigning in the fall, and possibly to offset a Palestinian effort to gain statehood in the United Nations.

While I don’t give an specific credence to these rumors, neither would such an action surprise me. Israel has long intended to start a war between the US and Iran, although it would prefer the US start the war on its own. Dick Cheney offered Israel a $30 billion arms package during the Bush Administration as a bribe to do so, but Israel took the money and still refused to initiate the war by themselves. And Bush apparently thought he couldn’t do that with the damning 2007 NIE out in public.

Obama, however, may be made of sterner stuff. OTOH, it would appear Obama is more interested in starting a war with Pakistan than Iran at this point. After all, a war with Pakistan which is far larger and more powerful than Iran would generate the sort of war profits the corporations that own and operate Obama – like General Dynamics – really appreciate.

But Israel would prefer an attack on Iran at this point, I suspect, so we might end up with both over the next couple years. And you thought Iraq and Afghanistan were disasters. You ain’t seen nothing yet! 🙂

Richard Steven Hack • July 12, 2011 8:02 AM

RobertT: I agree it probably wasn’t as simple as having random flash drives make it into the facility. Although we do know what happens when you drop random flash drives in the corporate parking lot – they get put in corporate PCs. Probably works as well at nuclear facilities…

I suspect that it entailed some covert ops to get the first sticks into the system.

What interests me is how the virus spread from Iran to India and elsewhere. That couldn’t have been strictly from flash drives unless Iranian technicians are flying all over the world.

But I bet I know who DOES fly all over the world – IAEA inspectors, that’s who. If you infect THEIR flash drives, almost by definition those drives will be inserted into Iranian, Indian and many other national nuclear facilities in order to download certain data logs and other reports created in compliance with that nation’s Safeguards Agreement.

Which makes me wonder whether the IAEA were involved in the conspiracy to distribute this malware. This is HIGHLY likely because the IAEA since ElBaradei left has been even more politicized than before and is basically now the US’ poodle. It is known that various diplomats at the IAEA have been pushing the US-EU-Israel agenda against Iran for some time, even during ElBaradei’s tenure – people such as Ollie Heinonen.

So my guess is Stuxnet was deliberately distributed via IAEA flash drives directly to nuclear facility work stations or IAEA systems hooked up to local nuclear facility networks.

Richard Steven Hack • July 12, 2011 10:20 PM

Nick P: Yes, a Russian contractor would definitely be a possibility. However, he would have to be either subverted or bribed, since the Russians have no reason to subvert Iran, still less India.

Also, that same Russian contractor, if he was complicit, would have had to have a reason for infecting India and other countries – unless the goal there was to throw off people from suspecting Iran was the real target. And in that respect, how could the real perps be sure that is how it would work out?

RobertT: “I’m certain that procedurally they are not permitted to plug their laptops into Iranian networks.” Which is why they’d use a flash drive, right? One way or the other, either an Iranian infected flash drive was passed to the IAEA, or vice versa. There’s no reason an Iranian drive would be carried to India, so I suspect the reverse.

I’m sure the IAEA monitoring entails some actual systems on site and/or passing of computer data from Iranian systems to IAEA systems or vice versa somehow. It can’t all be just paperwork.

OTOH, the same argument against that is why would the IAEA be infecting other countries deliberately, except as a confusion tactic. Unless they didn’t realize it.

It’s quite possible several such unwitting vectors were used: Russian contractors, IAEA inspectors, and Iranians. But either someone was a vector who traveled to other countries or other countries had their own vectors to conceal Iran as the main target.

Dirk: The above would imply what you suggest – that this was a pilot program for something bigger. And definitely Israel and the US would both be major suspects, because Israel is one of the worst spy nations in the world (consistently listed in the FBI’s top list of countries spying against the US in both military and commercial espionage) and the US intelligence community also has an insatiable desire to spy on everyone else.

It reminds me of the INSLAW PROMIS software scandal. Both Israel and the US intelligence community were in on that and used it to spy on everyone else.

Richard Steven Hack • July 15, 2011 7:05 PM

Travis: It acted as a worm by moving between networks. This is the definition of a worm.

But the primary means of dissemination into a network in the first place was flash drives, followed by a secondary move between network shares and RPC.

Most of its propagation was limited to the LAN it was on. Since some LANS are actually WANS, presumably there was movement between networks in that manner. I suspect this is how it jumped countries and continents. There is likely also some movement across countries and continents via flash drives as we have discussed via contractors and inspectors and others.

It wasn’t an “Internet worm” in the sense that it spread solely via the Internet like Blaster or Conficker. It was not designed to do so.

It’s that simple.