EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

09.24.10

Who Needs Windows Back Doors When It’s So Insecure?

Posted in Asia, Microsoft, Security, Windows at 3:11 pm by Dr. Roy Schestowitz

Mohammad Mosaddeq

Summary: Stuxnet is allegedly part of a plan to infect computer systems in Iran for political reasons, according to an increasing body of evidence

SO, it’s starting to look like Stuxnet [1, 2, 3, 4, 5, 6, 7, 8, 9, 10] was part of a plot to derail Iran’s nuclear programme [1, 2]. Stuxnet makes use of zero-day Windows vulnerabilities rather than back doors. Will governments finally realise that foreign governments can use Windows against them? Software freedom is essential to one’s autonomy.

The debate about Stuxnet and Iran is only starting. So far we’ve come across the following reports (there are many more):

i. Advanced Computer Worm Was Specifically Designed to Attack Iranian Nuclear Reactor, Experts Say

The sophisticated computer worm called Stuxnet, which has been targeting industrial operations around the world, was likely designed to take out Iran’s new Bushehr nuclear reactor, cybersecurity experts say. It’s the first known cyber-super-weapon designed to destroy a real-world target, reports the Christian Science Monitor.

Researchers studying the worm say it was built by an advanced attacker with plentiful resources — possibly a nation-state. Initially, experts thought it was designed for industrial espionage, but upon examining its code, they now think it was built for sabotage.

ii. Synchronize Your OpenOffice Documents With Google Docs, Zoho And WebDAV Servers Using Ooo2gd

iii. Microsoft confirms it missed Stuxnet print spooler ‘zero-day’

Contrary to reports, a bug that Microsoft patched last week had been publicly discussed a year and a half ago, security researchers said this week.

Microsoft confirmed Wednesday that it overlooked the vulnerability when it was revealed last year.

The vulnerability in Windows Print Spooler service was one of four exploited by Stuxnet, a worm that some have suggested was crafted to sabotage an Iranian nuclear reactor.

iv. Stuxnet virus may be aimed at Iran nuclear reactor

A highly sophisticated computer worm that has spread through Iran, Indonesia and India was built to destroy operations at one target: possibly Iran’s Bushehr nuclear reactor.

That’s the emerging consensus of security experts who have examined the Stuxnet worm. In recent weeks, they’ve broken the cryptographic code behind the software and taken a look at how the worm operates in test environments. Researchers studying the worm all agree that Stuxnet was built by a very sophisticated and capable attacker, possibly a nation state, and it was designed to destroy something big.

[...]

One of the things that Langner discovered is that when Stuxnet finally identifies its target, it makes changes to a piece of Siemens code called Organisational Block 35. This Siemens component monitors critical factory operations, things that need a response within 100 milliseconds. By messing with Operational Block 35, Stuxnet could easily cause a refinery’s centrifuge to malfunction, but it could be used to hit other targets too, Byres said. “The only thing I can say is that it is something designed to go bang,” he said.

Whoever created Stuxnet developed four previously unknown zero-day attacks and a peer-to-peer communications system, compromised digital certificates belonging to Realtek Semiconductor and JMicron Technology, and displayed extensive knowledge of industrial systems. This is not something that your run-of-the-mill hacker can pull off. Many security researchers think that it would take the resources of a nation state to accomplish.

[...]

Now that the Stuxnet attack is public, the industrial control systems industry has come of age in an uncomfortable way. And clearly it will have more things to worry about. “The problem is not Stuxnet. Stuxnet is history,” said Langner. “The problem is the next generation of malware that will follow.”

Any politically-motived Windows worm shows that technology and politics cannot be separated and they come at a high cost to the public (a side effect). Some people point fingers at Israeli hackers.

Malware believed to be targeting Iran’s Bushehr nuclear power plant may have been created by Israeli hackers

[...]

However Graham Cluley, senior consultant with the online security company Sophos, warned against jumping to conclusions about the target of the attack, saying “sensationalist” headlines were “a worry”. Clulely is wary of reports linking Stuxnet with Israel: “It’s very hard to prove 100% who created a piece of malware, unless you are able to gather evidence from the computer they created it on – or if someone admits it, of course.”

But he said that its characteristics did not suggest a lone group. “I think we need to be careful about pointing fingers without proof, and I think it’s more appropriate – if true – to call this a state-sponsored cyber attack rather than cyber terrorism.”

Stuxnet works by exploiting previously unknown security holes in Microsoft’s Windows operating system. It then seeks out a component called Simatic WinCC, manufactured by Siemens, which controls critical factory operations. The malware even uses a stolen cryptographic key belonging to the Taiwanese semiconductor manufacturer RealTek to validate itself in high-security factory systems.

Should the whole world be flooded with Windows worms just because of political altercations of few nations? Should a better operating system like GNU/Linux be used to mitigate international threats. When does the cyber threat become greater than nuclear threats in an age when everything from food production to energy extraction [1, 2] and travel depends on connected computers? Without energy and transportation, food cannot be grown, cultivated, and delivered; that is where the most fundamental needs can or cannot be met, especially at times of natural disaster or war, so leaving one’s critical systems (that’s almost any system) under Microsoft’s reign is a strategic blunder. Proprietary software is subjected to the sovereignty of its sole maker.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Links 25/4/2018: Ubuntu 18.04 Coming Shortly, Fedora 28 Next Month

    Links for the day



  2. Koch Brothers and Big Oil Could Not Buy the Decisions in Oil States, SAS

    In Oil States Energy Services v Greene’s Energy Group, a case which Koch-funded think tanks meddled in (including those whose panel guests send me threatening legal letters), ends up with dissent from a Koch-connected Justice citing or quoting those very same Koch-funded think tanks



  3. The European Patent Office (EPO) Wastes a Lot of Money on External PR Agencies for Battistelli's 'Heist'

    The EPO's management is once again scattering/throwing EPO budget at PR agencies and media companies (publishers/broadcasters) to disseminate a bunch of puff pieces and virtually ignore the very obvious conflict of interest, which should be a scandal on par with that of FIFA (resulting in the arrest of its boss, Mr. Blatter)



  4. Today's EPO is Not Compatible With the Law and It's Grossly Incompatible With Truth and Justice

    Today, once again, the EPO openly advocates software patents while media promotes loopholes (notably hype waves)



  5. Quick Mention: As Expected, the US Supreme Court Cements PTAB's Role With Trump-Appointed Gorsuch Dissenting

    Oil States has been decided and it's very good news for the Patent Trial and Appeal Board (PTAB); even Conservatives-leaning Justices support PTAB



  6. Links 24/4/2018: Preview of Crostini, Introducing Heptio Gimbal, OPNsense 18.1.6

    Links for the day



  7. Patent Maximalists Step Things Up With Director Andrei Iancu and It's Time for Scientists to Fight Back

    Science and technology don't seem to matter as much as the whims of the patent (litigation) 'industry', at least judging by recent actions taken by Andrei Iancu (following a hearing before the Senate Judiciary Committee)



  8. Mythology About Patents in the East

    Misconceptions (or deliberate propaganda) about patent policy in the east poison the debate and derail a serious, facts-based discussion about it



  9. Patent Trolls Watch: Red River Innovations, Bradium Technologies/General Patent, and Wordlogic

    A quick look at some patent trolls that made the news this Monday; we are still seeing a powerful response to such trolls, whose momentum is slipping owing to the good work of the Patent Trial and Appeal Board (PTAB)



  10. Holding Benoît Battistelli Accountable After the EPO

    The many abuses and offenses committed by Mr. Battistelli whilst he enjoyed diplomatic immunity can and should be brought up as that immunity expires in two months; a good start would be contacting his colleagues, who might not be aware of the full spectrum of his abuses



  11. Links 23/4/2018: Second RC of Linux 4.17 and First RC of Mesa 18.1

    Links for the day



  12. The Good Work of the Patent Trial and Appeal Board (PTAB) and the Latest Attempts to Undermine It

    A week's roundup of news about PTAB, which is eliminating many bad (wrongly-granted) patents and is therefore becoming "enemy number one" to those who got accustomed to blackmailing real (productive) firms with their questionable patents



  13. District Courts' Patent Cases, Including the Eastern District of Texas (EDTX/TXED), in a Nutshell

    A roundup of patent cases in 'low courts' of the United States, where patents are being reasoned about or objected to while patent law firms make a lot of money



  14. The Federal Circuit's (CAFC) Decisions Are Being Twisted by Patent Propaganda Sites Which Merely Cherry-Pick Cases With Outcomes That Suit Them

    The Court of Appeals for the Federal Circuit (CAFC) continues to reject the vast majority of software patents, citing Section 101 in many such cases, but the likes of Managing IP, Patently-O, IAM and Watchtroll only selectively cover such cases (instead they’re ‘pulling a Berkheimer’ or some similar name-dropping)



  15. Patents Roundup: Metaswitch, GENBAND, Susman, Cisco, Konami, High 5 Games, HTC, and Nintendo

    A look at existing legal actions, the application of 35 U.S.C. § 101, and questionable patents that are being pursued on software (algorithms or "software infrastructure")



  16. In Maxon v Funai the High 'Patent Court' (CAFC) Reaffirms Disdain for Software Patents, Which Are Nowadays Harder to Get and Then Defend

    With the wealth of decisions from the Court of Appeals for the Federal Circuit (CAFC) wherein software patents get discarded (Funai being the latest example), the public needs to ask itself whether patent law firms are honest when they make claims about resurgence of software patents by 'pulling a Berkheimer' or coming up with terms like “Berkheimer Effect”



  17. Today's European Patent Office Works for Patent Extremists and for Team UPC Rather Than for Europe or for Innovation

    The International Association for the Protection of Intellectual Property (AIPPI) and other patent maximalists who have nothing to do with Europe, helped by a malicious and rather clueless politician called Benoît Battistelli, are turning the EPO into a patent-printing machine rather than an examination office as envisioned by the EPC (founders) and member states



  18. The EPO is Dying and Those Who Have Killed It Are Becoming Very Rich in the Process

    Following the footsteps of Ron Hovsepian at Novell, Battistelli at the EPO (along with Team Battistelli) may mean the end of the EPO as we know it (or the end altogether); one manager and a cabal of confidants make themselves obscenely rich by basically sacrificing the very organisation they were entrusted to serve



  19. Short: Just Keep Repeating the Lie (“Quality”) Until People Might Believe It

    Battistelli’s patent-printing bureau (EPO without quality control) keeps lying about the quality of patents by repeating the word “quality” a lot of times, including no less than twice in the summary alone



  20. Shelston IP Keeps Pressuring IP Australia to Allow Software Patents and Harm Software Development

    Shelston IP wants exactly the opposite of what's good for Australia; it just wants what's good for itself, yet it habitually pretends to speak for a productive industry (nothing could be further from the truth)



  21. Is Andy Ramer's Departure the End of Cantor Fitzgerald's Patent Trolls-Feeding Operations and Ambitions?

    The managing director of the 'IP' group at Cantor Fitzgerald is leaving, but it does not yet mean that patent trolls will be starved/deprived access to patents



  22. EPO Hoards Billions of Euros (Taken From the Public), Decreases Quality to Get More Money, Reduces Payments to Staff

    The EPO continues to collect money from everyone, distributes bogus/dubious patents that usher patent trolls into Europe (to cost European businesses billions in the long run), and staff of the EPO faces more cuts while EPO management swims in cash and perks



  23. Short: Calling Battistelli's Town (Where He Works) “Force for Innovation” to Justify the Funneling of EPO Funds to It

    How the EPO‘s management ‘explained’ (or sought to rationalise) to staff its opaque decision to send a multi-million, one-day ceremony to Battistelli’s own theatre only weeks before he leaves



  24. Short: EPO Bribes the Media and Then Brags About the Paid-for Outcome to Staff

    The EPO‘s systematic corruption of the media at the expense of EPO stakeholders — not to mention hiring of lawyers to bully media which exposes EPO corruption — in the EPO’s own words (amended by us)



  25. Short: EPO's “Working Party for Quality” is to Quality What the “Democratic People's Republic of Korea” is to Democracy

    To maintain the perception (illusion) that the EPO still cares about patent quality — and in order to disseminate this lie to EPO staff — a puff piece with the above heading/photograph was distributed to thousands of examiners in glossy paper form



  26. Short: This Spring's Message From the EPO's President (Corrected)

    A corrected preface from the Liar in Chief, the EPO's notoriously crooked and dishonest President



  27. Short: Highly Misleading and Unscientific Graphics From the EPO for an Illusion of Growth

    A look at the brainwash that EPO management is distributing to staff and what's wrong with it



  28. Short: EPO Explains to Examiners Why They Should and Apparently Can Grant Software Patents (in Spite of EPC)

    Whether it calls it "CII" or "ICT" or "Industry 4.0" or "4IR", the EPO's management continues to grant software patents and attempts to justify this to itself (and to staff)



  29. Links 21/4/2018: Linux 4.9.95, FFmpeg 4.0, OpenBSD Foundation 2018 Fundraising Campaign

    Links for the day



  30. As USPTO Director, Andrei Iancu Gives Three Months for Public Comments on 35 U.S.C. § 101 (Software Patenting Impacted)

    Weeks after starting his job as head of the US patent office, to our regret but not to our surprise, Iancu asks whether to limit examiners' ability to reject abstract patent applications citing 35 U.S.C. § 101 (relates to Alice and Mayo)


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts