Stuxnet marks the start of the next security arms race

[Renew Deal]

More information about Stuxnet continues to dribble out, and each new fact and rumor never fails to astound me. As covered by InfoWorld's Robert Lemos, the New York Times reported that a U.S.-Israeli team accessed inside information in creating Stuxnet to wreak havoc on Iran. Most of the report was anonymously sourced, so it's impossible to tell how much of it's true. Still, the tone doesn't seem overly speculative -- and suggests Stuxnet is a revealing study in the future of cyber warfare, with potentially greater damaging force than a heavy bomb attack.

Stuxnet was easily the world's most successful cyber warfare attack to date and an incredible study in the future of the field. If the Times article is correct, the programming code of Stuxnet was more effective than any bomb run could have been. While the Stuxnet worm was purportedly spinning the Iranian nuclear facility's centrifuges to the point of damage, it was simultaneously sending false "Everything is OK" signals to the control equipment, and the engineers sat by (at least initially) as the destruction occurred.

Most nuclear facilities are air-gapped, meaning that it's relatively difficult to get the destructive worm into its target site or sites. To counter these protective measures, it seems that the original Stuxnet coders either had trusted insiders initiating the worm's spread or relied upon compromised USB keys or management computers.
<snip>

With the announcement of the purported success of Stuxnet, the next-generation arms race is on. Ironically, while Stuxnet has possibly slowed down the international proliferation of nuclear arms, it's also officially launched the next big weapons battle.

http://www.infoworld.com/d/security-central/stuxnet-marks-the-start-the-next-security-arms-race-282

[bemildred]

1. Social engineering is not hardly new or earth-shaking. nt