Stuxnet: Computer worm opens new era of warfare

Kroft: Does this surprise you that this happened?

Hayden: You need to separate my experience at CIA with your question, alright?

Kroft: Alright. You can't talk about the CIA?

Hayden: No and I don't want to even suggest what may have been on the horizon or not on the horizon. Or anything like that.

Kroft: If you look at the countries that have the capability of designing something like Stuxnet and you take a look at the countries that have -- would have a motive for trying to destroy Natanz...

Hayden: Where do those two sets intersect?

Kroft: You're pretty much left with the United States and Israel.

Hayden: Well, yes. But-- but-- it-- it-- there is no good with someone of my background even speculating on that question, so I won't.

Iran's president, Mahmoud Ahmadinejad, shown here at Natanz in 2008, blamed the cyberattack on "enemies of the state" and downplayed the damage. Both the U.S. and Israel maintain that it set back the Iranian program by several years. What's impossible to know is how much damage the attackers might have inflicted if the virus had gone undetected and not been exposed by computer security companies trying to protect their customers.

Ralph Langner: They planned to stay in that plant for many years. And to do the whole attack in a completely covert manner, that anytime a centrifuge would break, the operators would think, "This is again a technical problem that we have experienced, for example, because of poor quality of these centrifuges that we are using."

Liam O Murchu: We had a good idea that this was a blown operation, something that was never meant to be seen. It was never meant to come to the public's attention.

Kroft: You say blown. Meaning?

O Murchu: If you're running an operation like this to sabotage a uranium enrichment facility, you don't want the code uncovered, you want it kept secret. And you want it just to keep working, stay undercover, do its damage and disappear, and hopefully nobody would ever see it.

Kroft: Do you think this was a blown operation?

Hayden: No, not at all. I think it's an incredibly sophisticated operation.

But General Hayden did acknowledge that there are all sorts of potential problems and possible consequences that come with this new form of warfare.

Hayden: When you use a physical weapon it destroys itself, in addition to the target, if it's used properly. A cyberweapon doesn't. So there are those out there who can take a look at this, study it and maybe even attempt to turn it to their own purposes.

Such as launching a cyberattack against critical infrastructure here in the United States. Until last fall Sean McGurk was in charge of protecting it, as head of cyber defense at the Department of Homeland Security. He believes that Stuxnet has given countries like Russia and China, not to mention terrorist groups and gangs of cybercriminals for hire, a textbook on how to attack key U.S. installations.

Sean McGurk: You can download the actual source code of Stuxnet now and you can repurpose it and repackage it and then, you know, point it back towards wherever it came from.

Kroft: Sounds a little bit like Pandora's box.

McGurk: Yes.

Kroft: Whoever launched this attack--

• « Previous Page
• 1
• 2
• 3
• 4
• 5
• Next Page »

[tomfcbs]

It seems to me CBS got it wrong when they stated that Stuxnet source code was in the public domain.

I think they would do well to reassess that statement and issue a retraction if necessary, because it appears they confused the runtime executable code that was found with Source. That's alot less frightening!

[forumcomments]

Assuming governmentmt legislation would automatically prevent a security issue is oversimplifying the problem. Info security goes well beyond the internet and given the uniqueness of indusutries and technology menaingful legislation would take time. If we want quick assurance that the internet connections are relatively secure I would thuink requiring an indpeendet security review by qualified securiy coimopanies would be a good start. However, we would have to include security at a later date that would also combine the gov and private sector.

[smartasss1]

If a politician is trying to scare you to agree on something. chances are, he is under the payroll of some company who is pushing for a law that would benefit them.

In this case. technology security companies.

We won't die if we loose power for a few hours or our ATM goes down for a day. I doubt if hackers can put down an institution that is critical to our immediate survival. It won't be like a pearl harbor.
These people are just hyping it up.

We already have many security regulations.

1.Important companies and government institutions, already have expensive network security systems.
2. Businesses that transact credit cards and merchant accounts already have strict security regulations and an annual re-certification process.
3. Medical facilities that store patient information have strict security guidelines (HIPAA).

Extra government regulation on network security will just add to the large amount of bureaucracy already out there.

Instead of requiring everyone to make expensive security upgrades, money is better spent on improving network architecture.

1. Operating systems (windows) and network appliance manufacturers can improve their products. Security holes are common on environments that have poor security architecture.

2. At the ISP level: Uncertificated and anonymous e-mails can be restricted. Anonymous VOIP calls can be restricted.

3. eliminate proxy servers that host inbound sessions from other countries. maintain a black list of proxy servers that host anonymous outsiders.

4. some local area networks that need not be online can be disconnected from the internet.

[magicfireaxe]

I find the paragraph, about Congress trying to pass a cybersecurity law interesting. It says there is a fierce debate whether the Government should be allowed to require the owners of critical infrastructure (Private Corporations,etc) to improve the security of their computer networks. Does this not fall under National Security in importance? We don't require these owners to get better protection for their computer networks, yet we just made everyone in the US get health insurance. Seem like a similar type of situation!

[eddom9492]

There have been sophisticated virii around since before 1990, and this just now gets around.