,
10 tweets,
3 min read
Read on Twitter
Exclusive: How Secret Dutch Mole Aided U.S.-Israeli Stuxnet Cyber Attack on Iran. For yrs an enduring mystery has surrounded the Stuxnet attack: How did US/Israel get the malware onto computers at the highly secured uranium enrichment plant? Now we know. news.yahoo.com/revealed-how-a…
In 2004, the CIA and Mossad asked Dutch intelligence to help them get into the Natanz facility in Iran. Dutch intel had a mole in Iran who then set up two front companies, one of which got him into the Iranian plant before the summer of 2007.
With intelligence obtained by the mole, the developers of Stuxnet were able to target their attack; he then helped them get it onto the air-gapped sytems in Iran in 2007.
There is evidence to support claim that attackers updated Stuxnet in Sept 2007 based on intel from Dutch mole; @symantec researchers @liam_omurchu & Eric Chien note that on Sept 24, 2007 the attackers compiled the payloads that targeted the PLCs that controlled the centrifuges.
Stuxnet had two payloads, one targeting the Siemens 315 PLC, one targeting the Siemens 417 PLC. The payloads for both got updated/compiled on Sept 24, 2007. They were compiled a just a few hours apart; the 417 code was compiled at 2:57pm; the 315 code was compiled at 6:53pm.
The 417 attack code was the only one the attackers unleashed at Natanz in 2007 - it showed up in the wild in Nov. 2007 when someone uploaded it to Virus Total. The 315 attack code didn't get unleashed until June 2009, and then again in March and April 2010.
I should note that we always suspected the 2007 version of Stuxnet got onto machines via an inside mole; I wrote in the Stuxnet book that this version of the code had only one way of spreading - via USB - so the attackers needed direct or near-direct access to the target machines
When they unleashed later version of Stuxnet in 2009, they didn't use Dutch mole. Instead they infected employees at 5 Iranian companies so they'd unwittingly carry Stuxnet to target. This always meant to me that the attackers had lost the direct access they had in 2007...
But as @liam_omurchu suggests in story published today, it's also possible they simply no longer needed that direct access, since later version of Stuxnet was fully automated for spreading
For anyone who wishes to know more about the Stuxnet story, I published a book on the operation - Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon - which you can find here: amazon.com/Countdown-Zero…
