ZERO DAYS: Obama Order Sped Up Wave of Cyberattacks Against Iran

Started by rmstock, September 19, 2016, 11:29:13 PM

Previous topic - Next topic

rmstock


{ The STUXNET worm discovered in September 2010 had at least 4 Zero Day
  exploits inside and 2 master digital certificates. ZERO DAYS, the Documentary
  was released in July 2016. The material and its contents was however already
  known in June 2012, which implicates that at least four more years were added
  to the guaranteed break-in quality of these at least 4 Zero Day Exploits.
  In short: ZERO DAYS the Documentary has been shelved for four years ...
}


MIDDLE EAST
Obama Order Sped Up Wave of Cyberattacks Against Iran
By DAVID E. SANGER JUNE 1, 2012
http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html?_r=0
   
  "WASHINGTON — From his first months in office, President Obama secretly
   ordered increasingly sophisticated attacks on the computer systems that
   run Iran's main nuclear enrichment facilities, significantly expanding
   America's first sustained use of cyberweapons, according to
   participants in the program.
   
   Mr. Obama decided to accelerate the attacks — begun in the Bush
   administration and code-named Olympic Games — even after an element of
   the program accidentally became public in the summer of 2010 because of
   a programming error that allowed it to escape Iran's Natanz plant and
   sent it around the world on the Internet. Computer security experts who
   began studying the worm, which had been developed by the United States
   and Israel, gave it a name: Stuxnet.
   
   At a tense meeting in the White House Situation Room within days of the
   worm's "escape," Mr. Obama, Vice President Joseph R. Biden Jr. and the
   director of the Central Intelligence Agency at the time, Leon E.
   Panetta, considered whether America's most ambitious attempt to slow
   the progress of Iran's nuclear efforts had been fatally compromised.
   
   "Should we shut this thing down?" Mr. Obama asked, according to members
   of the president's national security team who were in the room.
   
   Told it was unclear how much the Iranians knew about the code, and
   offered evidence that it was still causing havoc, Mr. Obama decided
   that the cyberattacks should proceed. In the following weeks, the
   Natanz plant was hit by a newer version of the computer worm, and then
   another after that. The last of that series of attacks, a few weeks
   after Stuxnet was detected around the world, temporarily took out
   nearly 1,000 of the 5,000 centrifuges Iran had spinning at the time to
   purify uranium.
   
   This account of the American and Israeli effort to undermine the
   Iranian nuclear program is based on interviews over the past 18 months
   with current and former American, European and Israeli officials
   involved in the program, as well as a range of outside experts. None
   would allow their names to be used because the effort remains highly
   classified, and parts of it continue to this day.
   
   These officials gave differing assessments of how successful the
   sabotage program was in slowing Iran's progress toward developing the
   ability to build nuclear weapons. Internal Obama administration
   estimates say the effort was set back by 18 months to two years, but
   some experts inside and outside the government are more skeptical,
   noting that Iran's enrichment levels have steadily recovered, giving
   the country enough fuel today for five or more weapons, with additional
   enrichment.
   
   Whether Iran is still trying to design and build a weapon is in
   dispute. The most recent United States intelligence estimate concludes
   that Iran suspended major parts of its weaponization effort after 2003,
   though there is evidence that some remnants of it continue.
   
   Iran initially denied that its enrichment facilities had been hit by
   Stuxnet, then said it had found the worm and contained it. Last year,
   the nation announced that it had begun its own military cyberunit, and
   Brig. Gen. Gholamreza Jalali, the head of Iran's Passive Defense
   Organization, said that the Iranian military was prepared "to fight our
   enemies" in "cyberspace and Internet warfare." But there has been scant
   evidence that it has begun to strike back.
   
   The United States government only recently acknowledged developing
   cyberweapons, and it has never admitted using them. There have been
   reports of one-time attacks against personal computers used by members
   of Al Qaeda, and of contemplated attacks against the computers that run
   air defense systems, including during the NATO-led air attack on Libya
   last year. But Olympic Games was of an entirely different type and
   sophistication.
   
   It appears to be the first time the United States has repeatedly used
   cyberweapons to cripple another country's infrastructure, achieving,
   with computer code, what until then could be accomplished only by
   bombing a country or sending in agents to plant explosives. The code
   itself is 50 times as big as the typical computer worm, Carey
   Nachenberg, a vice president of Symantec, one of the many groups that
   have dissected the code, said at a symposium at Stanford University in
   April. Those forensic investigations into the inner workings of the
   code, while picking apart how it worked, came to no conclusions about
   who was responsible.
   
   A similar process is now under way to figure out the origins of another
   cyberweapon called Flame that was recently discovered to have attacked
   the computers of Iranian officials, sweeping up information from those
   machines. But the computer code appears to be at least five years old,
   and American officials say that it was not part of Olympic Games. They
   have declined to say whether the United States was responsible for the
   Flame attack.
   
   Mr. Obama, according to participants in the many Situation Room
   meetings on Olympic Games, was acutely aware that with every attack he
   was pushing the United States into new territory, much as his
   predecessors had with the first use of atomic weapons in the 1940s, of
   intercontinental missiles in the 1950s and of drones in the past
   decade. He repeatedly expressed concerns that any American
   acknowledgment that it was using cyberweapons — even under the most
   careful and limited circumstances — could enable other countries,
   terrorists or hackers to justify their own attacks.
   
   "We discussed the irony, more than once," one of his aides said.
   Another said that the administration was resistant to developing a
   "grand theory for a weapon whose possibilities they were still
   discovering." Yet Mr. Obama concluded that when it came to stopping
   Iran, the United States had no other choice.
   
   If Olympic Games failed, he told aides, there would be no time for
   sanctions and diplomacy with Iran to work. Israel could carry out a
   conventional military attack, prompting a conflict that could spread
   throughout the region.
   
   A Bush Initiative
   
   The impetus for Olympic Games dates from 2006, when President George W.
   Bush saw few good options in dealing with Iran. At the time, America's
   European allies were divided about the cost that imposing sanctions on
   Iran would have on their own economies. Having falsely accused Saddam
   Hussein of reconstituting his nuclear program in Iraq, Mr. Bush had
   little credibility in publicly discussing another nation's nuclear
   ambitions. The Iranians seemed to sense his vulnerability, and,
   frustrated by negotiations, they resumed enriching uranium at an
   underground site at Natanz, one whose existence had been exposed just
   three years before.
   
   
   Iran's nuclear enrichment facility at Natanz. Credit Hasan Sarbakhshian/Associated Press
   
   Iran's president, Mahmoud Ahmadinejad, took reporters on a tour of the
   plant and described grand ambitions to install upward of 50,000
   centrifuges. For a country with only one nuclear power reactor — whose
   fuel comes from Russia — to say that it needed fuel for its civilian
   nuclear program seemed dubious to Bush administration officials. They
   feared that the fuel could be used in another way besides providing
   power: to create a stockpile that could later be enriched to bomb-grade
   material if the Iranians made a political decision to do so.
   
   Hawks in the Bush administration like Vice President Dick Cheney urged
   Mr. Bush to consider a military strike against the Iranian nuclear
   facilities before they could produce fuel suitable for a weapon.
   Several times, the administration reviewed military options and
   concluded that they would only further inflame a region already at war,
   and would have uncertain results.
   
   For years the C.I.A. had introduced faulty parts and designs into
   Iran's systems — even tinkering with imported power supplies so that
   they would blow up — but the sabotage had had relatively little effect.
   General James E. Cartwright, who had established a small cyberoperation
   inside the United States Strategic Command, which is responsible for
   many of America's nuclear forces, joined intelligence officials in
   presenting a radical new idea to Mr. Bush and his national security
   team. It involved a far more sophisticated cyberweapon than the United
   States had designed before.
   
   The goal was to gain access to the Natanz plant's industrial computer
   controls. That required leaping the electronic moat that cut the Natanz
   plant off from the Internet — called the air gap, because it physically
   separates the facility from the outside world. The computer code would
   invade the specialized computers that command the centrifuges.
   
   The first stage in the effort was to develop a bit of computer code
   called a beacon that could be inserted into the computers, which were
   made by the German company Siemens and an Iranian manufacturer, to map
   their operations. The idea was to draw the equivalent of an electrical
   blueprint of the Natanz plant, to understand how the computers control
   the giant silvery centrifuges that spin at tremendous speeds. The
   connections were complex, and unless every circuit was understood,
   efforts to seize control of the centrifuges could fail.
   
   Eventually the beacon would have to "phone home" — literally send a
   message back to the headquarters of the National Security Agency that
   would describe the structure and daily rhythms of the enrichment plant.
   Expectations for the plan were low; one participant said the goal was
   simply to "throw a little sand in the gears" and buy some time. Mr.
   Bush was skeptical, but lacking other options, he authorized the effort.
   
   Breakthrough, Aided by Israel
   
   It took months for the beacons to do their work and report home,
   complete with maps of the electronic directories of the controllers and
   what amounted to blueprints of how they were connected to the
   centrifuges deep underground.
   
   Then the N.S.A. and a secret Israeli unit respected by American
   intelligence officials for its cyberskills set to work developing the
   enormously complex computer worm that would become the attacker from
   within.
   
   The unusually tight collaboration with Israel was driven by two
   imperatives. Israel's Unit 8200, a part of its military, had technical
   expertise that rivaled the N.S.A.'s, and the Israelis had deep
   intelligence about operations at Natanz that would be vital to making
   the cyberattack a success. But American officials had another interest,
   to dissuade the Israelis from carrying out their own pre-emptive strike
   against the Iranian nuclear facilities. To do that, the Israelis would
   have to be convinced that the new line of attack was working. The only
   way to convince them, several officials said in interviews, was to have
   them deeply involved in every aspect of the program.
   
   Soon the two countries had developed a complex worm that the Americans
   called "the bug." But the bug needed to be tested. So, under enormous
   secrecy, the United States began building replicas of Iran's P-1
   centrifuges, an aging, unreliable design that Iran purchased from Abdul
   Qadeer Khan, the Pakistani nuclear chief who had begun selling
   fuel-making technology on the black market. Fortunately for the United
   States, it already owned some P-1s, thanks to the Libyan dictator, Col.
   Muammar el-Qaddafi.
   
   When Colonel Qaddafi gave up his nuclear weapons program in 2003, he
   turned over the centrifuges he had bought from the Pakistani nuclear
   ring, and they were placed in storage at a weapons laboratory in
   Tennessee. The military and intelligence officials overseeing Olympic
   Games borrowed some for what they termed "destructive testing,"
   essentially building a virtual replica of Natanz, but spreading the
   test over several of the Energy Department's national laboratories to
   keep even the most trusted nuclear workers from figuring out what was
   afoot.
   
   Those first small-scale tests were surprisingly successful: the bug
   invaded the computers, lurking for days or weeks, before sending
   instructions to speed them up or slow them down so suddenly that their
   delicate parts, spinning at supersonic speeds, self-destructed. After
   several false starts, it worked. One day, toward the end of Mr. Bush's
   term, the rubble of a centrifuge was spread out on the conference table
   in the Situation Room, proof of the potential power of a cyberweapon.
   The worm was declared ready to test against the real target: Iran's
   underground enrichment plant.
   
   "Previous cyberattacks had effects limited to other computers," Michael
   V. Hayden, the former chief of the C.I.A., said, declining to describe
   what he knew of these attacks when he was in office. "This is the first
   attack of a major nature in which a cyberattack was used to effect
   physical destruction," rather than just slow another computer, or hack
   into it to steal data.
   
   "Somebody crossed the Rubicon," he said.
   
   Getting the worm into Natanz, however, was no easy trick. The United
   States and Israel would have to rely on engineers, maintenance workers
   and others — both spies and unwitting accomplices — with physical
   access to the plant. "That was our holy grail," one of the architects
   of the plan said. "It turns out there is always an idiot around who
   doesn't think much about the thumb drive in their hand."
   
   In fact, thumb drives turned out to be critical in spreading the first
   variants of the computer worm; later, more sophisticated methods were
   developed to deliver the malicious code.
   
   The first attacks were small, and when the centrifuges began spinning
   out of control in 2008, the Iranians were mystified about the cause,
   according to intercepts that the United States later picked up. "The
   thinking was that the Iranians would blame bad parts, or bad
   engineering, or just incompetence," one of the architects of the early
   attack said.
   
   The Iranians were confused partly because no two attacks were exactly
   alike. Moreover, the code would lurk inside the plant for weeks,
   recording normal operations; when it attacked, it sent signals to the
   Natanz control room indicating that everything downstairs was operating
   normally. "This may have been the most brilliant part of the code," one
   American official said.
   
   David E. Sanger looks at some of the political implications of
   President Obama's aggressive foreign policy.
   By Ben Werschkul, Channon Hodge and Kassie Bracken on Publish Date June
   1, 2012. . Watch in Times Video »
   
   

   David E. Sanger looks at President Obama's aggressive foreign policy

   Later, word circulated through the International Atomic Energy Agency,
   the Vienna-based nuclear watchdog, that the Iranians had grown so
   distrustful of their own instruments that they had assigned people to
   sit in the plant and radio back what they saw.
   
   "The intent was that the failures should make them feel they were
   stupid, which is what happened," the participant in the attacks said.
   When a few centrifuges failed, the Iranians would close down whole
   "stands" that linked 164 machines, looking for signs of sabotage in all
   of them. "They overreacted," one official said. "We soon discovered
   they fired people."
   
   Imagery recovered by nuclear inspectors from cameras at Natanz — which
   the nuclear agency uses to keep track of what happens between visits —
   showed the results. There was some evidence of wreckage, but it was
   clear that the Iranians had also carted away centrifuges that had
   previously appeared to be working well.
   
   But by the time Mr. Bush left office, no wholesale destruction had been
   accomplished. Meeting with Mr. Obama in the White House days before his
   inauguration, Mr. Bush urged him to preserve two classified programs,
   Olympic Games and the drone program in Pakistan. Mr. Obama took Mr.
   Bush's advice.
   
   The Stuxnet Surprise
   
   Mr. Obama came to office with an interest in cyberissues, but he had
   discussed them during the campaign mostly in terms of threats to
   personal privacy and the risks to infrastructure like the electrical
   grid and the air traffic control system. He commissioned a major study
   on how to improve America's defenses and announced it with great
   fanfare in the East Room.
   
   What he did not say then was that he was also learning the arts of
   cyberwar. The architects of Olympic Games would meet him in the
   Situation Room, often with what they called the "horse blanket," a
   giant foldout schematic diagram of Iran's nuclear production
   facilities. Mr. Obama authorized the attacks to continue, and every few
   weeks — certainly after a major attack — he would get updates and
   authorize the next step. Sometimes it was a strike riskier and bolder
   than what had been tried previously.
   
   "From his first days in office, he was deep into every step in slowing
   the Iranian program — the diplomacy, the sanctions, every major
   decision," a senior administration official said. "And it's safe to say
   that whatever other activity might have been under way was no exception
   to that rule."
   
   But the good luck did not last. In the summer of 2010, shortly after a
   new variant of the worm had been sent into Natanz, it became clear that
   the worm, which was never supposed to leave the Natanz machines, had
   broken free, like a zoo animal that found the keys to the cage. It fell
   to Mr. Panetta and two other crucial players in Olympic Games — General
   Cartwright, the vice chairman of the Joint Chiefs of Staff, and Michael
   J. Morell, the deputy director of the C.I.A. — to break the news to Mr.
   Obama and Mr. Biden.
   
   An error in the code, they said, had led it to spread to an engineer's
   computer when it was hooked up to the centrifuges. When the engineer
   left Natanz and connected the computer to the Internet, the American-
   and Israeli-made bug failed to recognize that its environment had
   changed. It began replicating itself all around the world. Suddenly,
   the code was exposed, though its intent would not be clear, at least to
   ordinary computer users.
   
   "We think there was a modification done by the Israelis," one of the
   briefers told the president, "and we don't know if we were part of that
   activity."
   
   Mr. Obama, according to officials in the room, asked a series of
   questions, fearful that the code could do damage outside the plant. The
   answers came back in hedged terms. Mr. Biden fumed. "It's got to be the
   Israelis," he said. "They went too far."
   
   In fact, both the Israelis and the Americans had been aiming for a
   particular part of the centrifuge plant, a critical area whose loss,
   they had concluded, would set the Iranians back considerably. It is
   unclear who introduced the programming error.
   
   The question facing Mr. Obama was whether the rest of Olympic Games was
   in jeopardy, now that a variant of the bug was replicating itself "in
   the wild," where computer security experts can dissect it and figure
   out its purpose.
   
   "I don't think we have enough information," Mr. Obama told the group
   that day, according to the officials. But in the meantime, he ordered
   that the cyberattacks continue. They were his best hope of disrupting
   the Iranian nuclear program unless economic sanctions began to bite
   harder and reduced Iran's oil revenues.
   
   Within a week, another version of the bug brought down just under 1,000
   centrifuges. Olympic Games was still on.
   
   A Weapon's Uncertain Future
   
   American cyberattacks are not limited to Iran, but the focus of
   attention, as one administration official put it, "has been
   overwhelmingly on one country." There is no reason to believe that will
   remain the case for long. Some officials question why the same
   techniques have not been used more aggressively against North Korea.
   Others see chances to disrupt Chinese military plans, forces in Syria
   on the way to suppress the uprising there, and Qaeda operations around
   the world. "We've considered a lot more attacks than we have gone ahead
   with," one former intelligence official said.
   
   Mr. Obama has repeatedly told his aides that there are risks to using —
   and particularly to overusing — the weapon. In fact, no country's
   infrastructure is more dependent on computer systems, and thus more
   vulnerable to attack, than that of the United States. It is only a
   matter of time, most experts believe, before it becomes the target of
   the same kind of weapon that the Americans have used, secretly, against
   Iran.

   
   This article is adapted from "Confront and Conceal: Obama's Secret Wars
   and Surprising Use of American Power,"
to be published by Crown on Tuesday.

   
   A version of this article appears in print on June 1, 2012, on page A1
   of the New York edition with the headline: Obama Order Sped Up Wave Of
   Cyberattacks Against Iran. Order Reprints| Today's Paper|Subscribe

   
   

   
   RELATED COVERAGE
     
   How a Secret Cyberwar Program Worked JUNE 1, 2012

     
   Iran, the United States and a Political Seesaw APRIL 13, 2012
   interactive
       
   
   Iran Confirms Attack by a Virus That Steals Data MAY 29, 2012
     
   Iranian Oil Sites Go Offline Amid Cyberattack APRIL 23, 2012
         
   TIMES TOPIC
   Cyberattacks on Iran — Stuxnet and Flame
   
   "

``I hope that the fair, and, I may say certain prospects of success will not induce us to relax.''
-- Lieutenant General George Washington, commander-in-chief to
   Major General Israel Putnam,
   Head-Quarters, Valley Forge, 5 May, 1778

rmstock


``I hope that the fair, and, I may say certain prospects of success will not induce us to relax.''
-- Lieutenant General George Washington, commander-in-chief to
   Major General Israel Putnam,
   Head-Quarters, Valley Forge, 5 May, 1778