Obama faces delicate decisions as cyberattack fears rise

White House photo

At the height of the economic crisis in 2008, Saturday Night Live’s “Weekend Update” comedy news show rolled out the character Oscar Rogers as a faux financial commentator. His advice on how to restore the economy? “Fix it! It needs to be fixed! Now!”

Four years later, lawmakers are grappling with a cybercrisis, and despite rising concerns, legislative debates over how to secure U.S. networks and infrastructure have often resembled nothing so much as Oscar Rogers yelling “Fix it!”

Now, with Congress looking unlikely to act anytime soon to fix vulnerabilities in the nation’s computer systems that leave them open to cyberattacks, President Obama is weighing the pros and cons of using anexecutive order to do what Congress hasn’t.

Experts in government and industry alike report a tide of attacks aimed at stealing information from individuals, companies, and government agencies, potentially making a strong case for presidential action.

Further bolstering the case are warnings from top national-security officials that a catastrophic attack on a critical system like those that run energy grids or chemical plants could cause damage to the economy or even loss of life.

But Obama needs to consider his options carefully, because any unilateral steps could invite accusations from his critics of overstepping his authority. As the acrimonious debate over antipiracy legislation illustrated earlier this year, simmering Internet issues can easily explode.

In the final days before the August recess, the Senate hit an impasse on broad cybersecurity legislation that the White House and national-security and defense leaders support. The bill stalled after businesses and Republicans said the legislation would create burdensome regulations for industry without doing enough to shore up defenses against cyberattacks.

Top White House counterterrorism aide John Brennan said earlier this month that Obama was looking at the possibility of an executive order but that there is no decision yet.

Lee Hamilton, a Democratic former House member who sits on a board that advises the Homeland Security Department and who examined government security failures as cochair of the 9/11 Commission, said that Obama is right to consider moving forward on his own. He said the stalemate in Congress is a “serious breakdown” reminiscent of failures before the terrorist attacks on Sept. 11, 2001.

“The preference would be to work together with Congress, but the threat is serious enough that an executive order is in line,” he said. “There is certainly a lack of urgency in dealing with this, and it’s not a business-as-usual problem. Given the fact that Congress hasn’t acted, the president has the obligation to put together options to secure the country.”

While the debate in Congress largely broke down along party lines, some prominent Republicans support the cybersecurity standards backed by the White House.

Top national-security advisers for GOP presidential candidate Mitt Romney, such as former Homeland Security Secretary Michael Chertoff and former National Security Agency and Central Intelligence Agency chief Michal Hayden, differed with Republicans in Congress and publicly called for the Senate to pass provisions that have Obama’s support.

Romney campaign spokeswoman Andrea Saul declined to elaborate on the Republican candidate’s assertion that more needs to be done to secure American networks, or comment on whether he would favor using an executive order in the absence of legislation. But she reiterated Romney’s promise to make cybersecurity an early priority and didn’t rule out executive action. Romney’s plan would require agencies to begin developing a new national cybersecurity strategy within the first 100 days of his administration. “Once the strategy is formulated he will determine how best it can be implemented,” Saul said in an e-mail.

Polls show that while Americans express concerns over cyberattacks, they, too, are divided over what should be done.

Separate surveys published by United Technologies/National Journal and The Washington Post over the summer found that a majority of Americans prefer that the government either not create standards for private companies, or keep any standards voluntary.

Backers of the White House’s proposals, however, say an executive order could add clarity to the debate and prove to skeptics that the government can play a greater role in protecting American networks without violating privacy or burdening private businesses.

“I think it’s hard to make things any messier than it was politically,” said James Lewis, an expert at the Center for Strategic and International Studies. “If done right, an executive order could help critics reconsider their arguments.”

That’s an analysis echoed by University of California (Berkeley) professor Steven Weber who said many people seem to be “sleepwalking” when it comes to the threat of cyberattacks. An executive order, he said, could reform cybersecurity policies before a catastrophic attack galvanizes public opinion.

An executive order could give Obama the chance to take a strong stand on a rising national-security concern while portraying Republicans in Congress as ditherers.

But an order is unlikely to accomplish all of the White House’s aims. It couldn’t hand DHS wider authority to ensure that certain private networks are secure. Nor could it entirely ease legal restrictions that prevent businesses from sharing threat information. Even policy changes for some federal network-security policies would likely need congressional action. Additionally, any action would need to avoid inciting privacy watchdogs who fear cybersecurity could be used as an excuse to undermine civil liberties.

And some analysts said the politics of an executive order could cut both ways for Obama. Presidents often win political debates that pit them against an unpopular Congress, especially one perceived as unable to do anything substantive, said Peter Feaver, a former National Security Council staffer during the Clinton and George W. Bush administrations. But if Obama were to take unilateral action, it would give his critics on the right an opening to paint him as an “imperial” president and to accuse him of saddling business with new regulations, Feaver said.

“In general, White Houses win in these fights with Congress, but this White House has played this card many times,” Feaver said. “This is an issue where there are bound to be unintended consequences and any cybersecurity measures will need a system to fix and update the provisions down the road. This administration has a hard sell assuring people to trust them to fix things later.”

Paul Rosenzweig, a consultant and visiting fellow at the conservative Heritage Foundation, said a cybersecurity executive order could play into both the “imperial presidency and do-nothing-Congress” narratives, but said he thinks there is a genuine possibility for a future compromise and unilateral action by Obama would do little to actually help secure private networks

via m.nextgov.com

http://m.nextgov.com/cio-briefing/2012/08/obama-faces-delicate-decisions-cybe…

Obama faces delicate decisions as cyberattack fears rise

White House photo

At the height of the economic crisis in 2008, Saturday Night Live’s “Weekend Update” comedy news show rolled out the character Oscar Rogers as a faux financial commentator. His advice on how to restore the economy? “Fix it! It needs to be fixed! Now!”

Four years later, lawmakers are grappling with a cybercrisis, and despite rising concerns, legislative debates over how to secure U.S. networks and infrastructure have often resembled nothing so much as Oscar Rogers yelling “Fix it!”

Now, with Congress looking unlikely to act anytime soon to fix vulnerabilities in the nation’s computer systems that leave them open to cyberattacks, President Obama is weighing the pros and cons of using anexecutive order to do what Congress hasn’t.

Experts in government and industry alike report a tide of attacks aimed at stealing information from individuals, companies, and government agencies, potentially making a strong case for presidential action.

Further bolstering the case are warnings from top national-security officials that a catastrophic attack on a critical system like those that run energy grids or chemical plants could cause damage to the economy or even loss of life.

But Obama needs to consider his options carefully, because any unilateral steps could invite accusations from his critics of overstepping his authority. As the acrimonious debate over antipiracy legislation illustrated earlier this year, simmering Internet issues can easily explode.

In the final days before the August recess, the Senate hit an impasse on broad cybersecurity legislation that the White House and national-security and defense leaders support. The bill stalled after businesses and Republicans said the legislation would create burdensome regulations for industry without doing enough to shore up defenses against cyberattacks.

Top White House counterterrorism aide John Brennan said earlier this month that Obama was looking at the possibility of an executive order but that there is no decision yet.

Lee Hamilton, a Democratic former House member who sits on a board that advises the Homeland Security Department and who examined government security failures as cochair of the 9/11 Commission, said that Obama is right to consider moving forward on his own. He said the stalemate in Congress is a “serious breakdown” reminiscent of failures before the terrorist attacks on Sept. 11, 2001.

“The preference would be to work together with Congress, but the threat is serious enough that an executive order is in line,” he said. “There is certainly a lack of urgency in dealing with this, and it’s not a business-as-usual problem. Given the fact that Congress hasn’t acted, the president has the obligation to put together options to secure the country.”

While the debate in Congress largely broke down along party lines, some prominent Republicans support the cybersecurity standards backed by the White House.

Top national-security advisers for GOP presidential candidate Mitt Romney, such as former Homeland Security Secretary Michael Chertoff and former National Security Agency and Central Intelligence Agency chief Michal Hayden, differed with Republicans in Congress and publicly called for the Senate to pass provisions that have Obama’s support.

Romney campaign spokeswoman Andrea Saul declined to elaborate on the Republican candidate’s assertion that more needs to be done to secure American networks, or comment on whether he would favor using an executive order in the absence of legislation. But she reiterated Romney’s promise to make cybersecurity an early priority and didn’t rule out executive action. Romney’s plan would require agencies to begin developing a new national cybersecurity strategy within the first 100 days of his administration. “Once the strategy is formulated he will determine how best it can be implemented,” Saul said in an e-mail.

Polls show that while Americans express concerns over cyberattacks, they, too, are divided over what should be done.

Separate surveys published by United Technologies/National Journal and The Washington Post over the summer found that a majority of Americans prefer that the government either not create standards for private companies, or keep any standards voluntary.

Backers of the White House’s proposals, however, say an executive order could add clarity to the debate and prove to skeptics that the government can play a greater role in protecting American networks without violating privacy or burdening private businesses.

“I think it’s hard to make things any messier than it was politically,” said James Lewis, an expert at the Center for Strategic and International Studies. “If done right, an executive order could help critics reconsider their arguments.”

That’s an analysis echoed by University of California (Berkeley) professor Steven Weber who said many people seem to be “sleepwalking” when it comes to the threat of cyberattacks. An executive order, he said, could reform cybersecurity policies before a catastrophic attack galvanizes public opinion.

An executive order could give Obama the chance to take a strong stand on a rising national-security concern while portraying Republicans in Congress as ditherers.

But an order is unlikely to accomplish all of the White House’s aims. It couldn’t hand DHS wider authority to ensure that certain private networks are secure. Nor could it entirely ease legal restrictions that prevent businesses from sharing threat information. Even policy changes for some federal network-security policies would likely need congressional action. Additionally, any action would need to avoid inciting privacy watchdogs who fear cybersecurity could be used as an excuse to undermine civil liberties.

And some analysts said the politics of an executive order could cut both ways for Obama. Presidents often win political debates that pit them against an unpopular Congress, especially one perceived as unable to do anything substantive, said Peter Feaver, a former National Security Council staffer during the Clinton and George W. Bush administrations. But if Obama were to take unilateral action, it would give his critics on the right an opening to paint him as an “imperial” president and to accuse him of saddling business with new regulations, Feaver said.

“In general, White Houses win in these fights with Congress, but this White House has played this card many times,” Feaver said. “This is an issue where there are bound to be unintended consequences and any cybersecurity measures will need a system to fix and update the provisions down the road. This administration has a hard sell assuring people to trust them to fix things later.”

Paul Rosenzweig, a consultant and visiting fellow at the conservative Heritage Foundation, said a cybersecurity executive order could play into both the “imperial presidency and do-nothing-Congress” narratives, but said he thinks there is a genuine possibility for a future compromise and unilateral action by Obama would do little to actually help secure private networks

via m.nextgov.com

http://m.nextgov.com/cio-briefing/2012/08/obama-faces-delicate-decisions-cybe…

Hacker Team Poison group promises to reveal LulzSec members identities: Are LulzSec the lesser of two evils?

By Alastair Stevenson: Subscribe to Alastair’s RSS feed

June 24, 2011 3:30 PM GMT

While LulzSec continues its Operation Anti-Security campaign against the world, rival group Team Poison has issued a statement promising to unmask LulzSec’s members.

The group reported its intention to reveal all LulzSec’s members true identities earlier this month. Speaking to Fox News a member working under the pseudonym Hex0010 commented “We’re here to show the world that they’re [LulzSec] nothing but a bunch of script kiddies.

“We’re going to let them do what they do. Then we’re going to do what we do”, adding, “We’re going to hit them hard.”

The claim comes just as LulzSec announced its new Operation Ant-Security campaign. The operation has seen LulzSec team-up with its 4Chan-born sibling Anonymous to help rebel and protest any and all cases of internet censorship and moderation through a series of coordinated cyber attacks and hacks.

Follow us  

Operation Anti-Security has already seen LulzSec claim responsibility for hacks and attacks on Arizona law enforcement, the U.K.’s Serious Organised Crimes Agency and two Brazilian Government owned websites.

In the midst of LulzSec’s first attack authorities arrested Ryan Cleary for suspected involvement in several of LulzSec’s operations. Since the arrest, while LulzSec has adamantly denied Cleary’s membership, the 19-year-old has been charged and appeared in Court. British police were granted an additional three days to question Cleary after the hearing.

In his statement Hex refuted LulzSec’s claims that Cleary was not a member. Hex commented to Fox News, “You can say he’s one of the people that ran it, you can say he’s a middleman. Depends on how you look at it. I think he’s a middleman.”

Team Poison has also claimed responsibility for an attack on suspected LulzSec member Sven Slootweg’s website.

Team Poison isn’t the first group to have made such claims. Already “cyber vigilante” outfit Team Ninja made a similar claim posting alleged names, addresses, phone numbers and at points pictures of individuals it claimed were LulzSec members.

The individuals named included a 34-year-old Brazilian named Sabu, Slootweg, a freelance journalist named Barret Brown and a U.S. Marine name Casey Gardiner — the truth of these claims is yet to be verified.

The fact that Team Poison is targeting LulzSec has not been universally hailed as good news. The hacking group has an extremely checkered past. It is believed to have connections both with the Mujahdeen Hacking Unit and Pakistan Cyber Army.

The Mujahdeen Hacking Unit was the hacking group that targeted Facebook late last year.

Additionally both groups are generally believed to hold strong anti-America, anti-Israel and anti-India ideologies.

Team Poison has also been constantly speculated as having overtly zealous religious leanings — a fact that may make several governments uncomfortable with the group’s involvement.

In the same interview with Fox Hex commented on the topic, “”We’re a group that consists of political hackers,” elaborating “A lot of people consider us being a religious type thing — in reality it’s not. When international governments are doing wrong and trying to hide from it, we’re there.”

Many analyst’s have already speculated that Team Poison’s targeting of LulzSec could be born of “professional jealousy”.

If true, then Team Poisons new involvement could be more harmful than helpful. The attack on LulzSec could lead to revenge attacks from both LulzSec and its comrade in arms Anonymous.

Additionally, as demonstrated by the laundry list of hacks and cyber attacks Team Poison is suspected of, the hatred for LulzSec could turn into a game of one-upmanship, with each group trying to hack a bigger target than the other.

Team Poison is yet to release the information it promised on Fox News.

via ibtimes.co.uk

June 24, 2011. DING FUCKING DING!

Next?

Hacker Team Poison group promises to reveal LulzSec members identities: Are LulzSec the lesser of two evils?

By Alastair Stevenson: Subscribe to Alastair’s RSS feed

June 24, 2011 3:30 PM GMT

While LulzSec continues its Operation Anti-Security campaign against the world, rival group Team Poison has issued a statement promising to unmask LulzSec’s members.

The group reported its intention to reveal all LulzSec’s members true identities earlier this month. Speaking to Fox News a member working under the pseudonym Hex0010 commented “We’re here to show the world that they’re [LulzSec] nothing but a bunch of script kiddies.

“We’re going to let them do what they do. Then we’re going to do what we do”, adding, “We’re going to hit them hard.”

The claim comes just as LulzSec announced its new Operation Ant-Security campaign. The operation has seen LulzSec team-up with its 4Chan-born sibling Anonymous to help rebel and protest any and all cases of internet censorship and moderation through a series of coordinated cyber attacks and hacks.

Follow us  

Operation Anti-Security has already seen LulzSec claim responsibility for hacks and attacks on Arizona law enforcement, the U.K.’s Serious Organised Crimes Agency and two Brazilian Government owned websites.

In the midst of LulzSec’s first attack authorities arrested Ryan Cleary for suspected involvement in several of LulzSec’s operations. Since the arrest, while LulzSec has adamantly denied Cleary’s membership, the 19-year-old has been charged and appeared in Court. British police were granted an additional three days to question Cleary after the hearing.

In his statement Hex refuted LulzSec’s claims that Cleary was not a member. Hex commented to Fox News, “You can say he’s one of the people that ran it, you can say he’s a middleman. Depends on how you look at it. I think he’s a middleman.”

Team Poison has also claimed responsibility for an attack on suspected LulzSec member Sven Slootweg’s website.

Team Poison isn’t the first group to have made such claims. Already “cyber vigilante” outfit Team Ninja made a similar claim posting alleged names, addresses, phone numbers and at points pictures of individuals it claimed were LulzSec members.

The individuals named included a 34-year-old Brazilian named Sabu, Slootweg, a freelance journalist named Barret Brown and a U.S. Marine name Casey Gardiner — the truth of these claims is yet to be verified.

The fact that Team Poison is targeting LulzSec has not been universally hailed as good news. The hacking group has an extremely checkered past. It is believed to have connections both with the Mujahdeen Hacking Unit and Pakistan Cyber Army.

The Mujahdeen Hacking Unit was the hacking group that targeted Facebook late last year.

Additionally both groups are generally believed to hold strong anti-America, anti-Israel and anti-India ideologies.

Team Poison has also been constantly speculated as having overtly zealous religious leanings — a fact that may make several governments uncomfortable with the group’s involvement.

In the same interview with Fox Hex commented on the topic, “”We’re a group that consists of political hackers,” elaborating “A lot of people consider us being a religious type thing — in reality it’s not. When international governments are doing wrong and trying to hide from it, we’re there.”

Many analyst’s have already speculated that Team Poison’s targeting of LulzSec could be born of “professional jealousy”.

If true, then Team Poisons new involvement could be more harmful than helpful. The attack on LulzSec could lead to revenge attacks from both LulzSec and its comrade in arms Anonymous.

Additionally, as demonstrated by the laundry list of hacks and cyber attacks Team Poison is suspected of, the hatred for LulzSec could turn into a game of one-upmanship, with each group trying to hack a bigger target than the other.

Team Poison is yet to release the information it promised on Fox News.

via ibtimes.co.uk

June 24, 2011. DING FUCKING DING!

Next?

Teampoison Hackers ‘Phone Bomb’ MI6 over Terror Detentions – International Business Times UK

The group last week defaced Croatia’s Nato website in protest at the West’s military intervention in Lybia in 2011 (screengrab

Hackers affiliated with the Teampoison Black-Hat group have attacked MI6 in protest at what is said was the detention of innocent people on terrorism charges.

The group, which recently defaced Croatia’s Nato website in protest at Western military intervention in Libya in 2011, launched a “phone bomb” on MI6’s London office, making non-stop calls for 24 hours.

“Every time they picked up the phone the server would play a robot voice which said ‘Teampoison’,” the leader of the group, called Trick, told Softpedia website.

The attack amounts to a phone denial of service akin to the Anonymous collective’s most common hacking tool, the Distributed Denial of Service (DDoS).

Follow us  

In the phone bomb, the hacker can be heard goading MI6 officials who threatened to alert the FBI.

“My name is Trick, I’m from Teampoison, my name is Robert West,” says the voice. “I got some terrorism for you here.”

The officers ask him where he is. “I’m in the UK,” Trick replies. “I don’t brush my teeth, I like tea, I’m from the UK.”

“What’s your actual philosophy?” asked the official. “I’m not familiar with it.”

“Our philosophy is pretty simple, it’s knowledge is power,” said the hacker. “And, uh, f**k the po-lice.”

“Yeah…” replies the official.

Teampoison also released a leaked call from the office in which agents discuss the attack along with the Teampoison statement condemning counter-terrorism strategies.

According to Teampoison, MI6 was targeted because officials “help lock up innocent people they themselves label as terrorists with no proof at all”.

The reason given for the latest attack was the extradition of Babar Ahmad, Adel Abdel Bary and others from the UK for trial in the US.

“We all know how the US treats innocent Muslims they label as terrorists, eg – Aafia Siddiqui,” said Teampoison.

Babar Ahmad and four other terror suspects lost their battle at the European Court of Human Rights against extradition.

Ahmad was first arrested in December 2003 and then released without charge. In August 2004, he was arrested again and and accused of running an important pro-jihad site, Azzam. The website allegedly played a role in inciting hatred against the West among young Muslims in Europe.

Bary has been held in the UK without trial for one of the longest periods on record. He has been accused of being Osama Bin Laden’s right-hand man in London and of promoting violent jihad against the West.

“Adel Abdel Bary has been in prison for 12 years in the UK. Apparently he received a phone call from Osama years ago, therefore they imprisoned him claiming they had a tape of the call but there was never a witness to prove it or show the tape,” reads Trick’s statement. “If I was to call George Bush would they lock George Bush up for receiving a phone call from a cyber-terrorist/hacker?”

Teampoison is affiliated with many anti-US and anti-Israel hacking teams such as Mujahideen Hacking Unit and ZCompany Hacking Crew (ZHC).

It is a rival of LulzSec, an offshoot of the Anonymous group which declared it was disbanding nine months ago after almost 50 days of constant attacks.

In February, six of the group’s most prominent members were arrested after the most prominent of them, known as Sabu, turned informant.

Teampoison released in June 2011 the alleged personal details of various LulzSec members alongside information on the AnonOps IRC server, including IP addresses and passwords.

For further news on Teampoison’s recent activities, check out the IBTimes UK Cyber Warfare section.

via ibtimes.co.uk

morons.

Teampoison Hackers ‘Phone Bomb’ MI6 over Terror Detentions – International Business Times UK

The group last week defaced Croatia’s Nato website in protest at the West’s military intervention in Lybia in 2011 (screengrab

Hackers affiliated with the Teampoison Black-Hat group have attacked MI6 in protest at what is said was the detention of innocent people on terrorism charges.

The group, which recently defaced Croatia’s Nato website in protest at Western military intervention in Libya in 2011, launched a “phone bomb” on MI6’s London office, making non-stop calls for 24 hours.

“Every time they picked up the phone the server would play a robot voice which said ‘Teampoison’,” the leader of the group, called Trick, told Softpedia website.

The attack amounts to a phone denial of service akin to the Anonymous collective’s most common hacking tool, the Distributed Denial of Service (DDoS).

Follow us  

In the phone bomb, the hacker can be heard goading MI6 officials who threatened to alert the FBI.

“My name is Trick, I’m from Teampoison, my name is Robert West,” says the voice. “I got some terrorism for you here.”

The officers ask him where he is. “I’m in the UK,” Trick replies. “I don’t brush my teeth, I like tea, I’m from the UK.”

“What’s your actual philosophy?” asked the official. “I’m not familiar with it.”

“Our philosophy is pretty simple, it’s knowledge is power,” said the hacker. “And, uh, f**k the po-lice.”

“Yeah…” replies the official.

Teampoison also released a leaked call from the office in which agents discuss the attack along with the Teampoison statement condemning counter-terrorism strategies.

According to Teampoison, MI6 was targeted because officials “help lock up innocent people they themselves label as terrorists with no proof at all”.

The reason given for the latest attack was the extradition of Babar Ahmad, Adel Abdel Bary and others from the UK for trial in the US.

“We all know how the US treats innocent Muslims they label as terrorists, eg – Aafia Siddiqui,” said Teampoison.

Babar Ahmad and four other terror suspects lost their battle at the European Court of Human Rights against extradition.

Ahmad was first arrested in December 2003 and then released without charge. In August 2004, he was arrested again and and accused of running an important pro-jihad site, Azzam. The website allegedly played a role in inciting hatred against the West among young Muslims in Europe.

Bary has been held in the UK without trial for one of the longest periods on record. He has been accused of being Osama Bin Laden’s right-hand man in London and of promoting violent jihad against the West.

“Adel Abdel Bary has been in prison for 12 years in the UK. Apparently he received a phone call from Osama years ago, therefore they imprisoned him claiming they had a tape of the call but there was never a witness to prove it or show the tape,” reads Trick’s statement. “If I was to call George Bush would they lock George Bush up for receiving a phone call from a cyber-terrorist/hacker?”

Teampoison is affiliated with many anti-US and anti-Israel hacking teams such as Mujahideen Hacking Unit and ZCompany Hacking Crew (ZHC).

It is a rival of LulzSec, an offshoot of the Anonymous group which declared it was disbanding nine months ago after almost 50 days of constant attacks.

In February, six of the group’s most prominent members were arrested after the most prominent of them, known as Sabu, turned informant.

Teampoison released in June 2011 the alleged personal details of various LulzSec members alongside information on the AnonOps IRC server, including IP addresses and passwords.

For further news on Teampoison’s recent activities, check out the IBTimes UK Cyber Warfare section.

via ibtimes.co.uk

morons.

Stuxnet thwarted by control code update

Iran’s nuclear enrichment efforts have been targeted by sophisticated cyber attacks

Continue reading the main story

Related Stories

• ‘Wage war on cyber enemies’ – MPs

• Paper ties US and Israel to Flame

• Iran says Duqu hack ‘controlled’

German engineering giant Siemens has issued a fix for the software loopholes used by the notorious Stuxnet worm.

Stuxnet was discovered in 2010 after investigations into malfunctions at many industrial plants and factories.

Iran’s nuclear enrichment efforts were hit hard by Stuxnet which targeted the devices that control delicate industrial processes.

The fix comes as reports circulate of a fresh cyber attack on Iranian nuclear enrichment project.

Burn out

Stuxnet exploited loopholes in the software Siemens wrote to oversee the running of its programmable logic controllers – devices used in many industrial facilities to automate a production process.

When a controller was infected with Stuxnet it made the motors it was typically connected to run out of control and burn out. This is believed to have been behind Iran’s need to replace many of the centrifuges it was using in its Natanz uranium enrichment plant.

Siemens has issued advisories saying it has updated the Simatic code in the controllers to remove the loopholes.

It is not yet clear who created Stuxnet, but security researchers say it is so complex and tightly targeted that only a nation would be able to marshal the resources to put it together.

Stuxnet is just one of several similar malicious programs created to attack industrial control systems.

Experts speculate that many were made to slow down and disrupt Iran’s nuclear production processes.

Iran has regularly denied that the viruses have hit its nuclear programme.

The Siemens update comes as security firm F-Secure received an email believed to have been sent by a scientist working at Iran’s Atomic Energy Organization.

In the message, the scientist said its plants at Natanz and Qom have been hit again by a worm.

Top F Secure security researcher Mikko Hypponen said it had not been able to confirm any of the details in the message. However, digital detective work did reveal that the message had come from within the Atomic Energy agency.

On 23 July, Iran issued a statement saying it had successfully “confronted” sophisticated malware and thwarted all the cyber attacks against the nation’s infrastructure.

Reza Taqipur, Iran’s minister of communication and information technology, said it was sometimes hit by as many as two million cyber attacks a day, but its ability to deal with them was growing daily.

via bbc.co.uk

Stuxnet thwarted by control code update

Iran’s nuclear enrichment efforts have been targeted by sophisticated cyber attacks

Continue reading the main story

Related Stories

• ‘Wage war on cyber enemies’ – MPs

• Paper ties US and Israel to Flame

• Iran says Duqu hack ‘controlled’

German engineering giant Siemens has issued a fix for the software loopholes used by the notorious Stuxnet worm.

Stuxnet was discovered in 2010 after investigations into malfunctions at many industrial plants and factories.

Iran’s nuclear enrichment efforts were hit hard by Stuxnet which targeted the devices that control delicate industrial processes.

The fix comes as reports circulate of a fresh cyber attack on Iranian nuclear enrichment project.

Burn out

Stuxnet exploited loopholes in the software Siemens wrote to oversee the running of its programmable logic controllers – devices used in many industrial facilities to automate a production process.

When a controller was infected with Stuxnet it made the motors it was typically connected to run out of control and burn out. This is believed to have been behind Iran’s need to replace many of the centrifuges it was using in its Natanz uranium enrichment plant.

Siemens has issued advisories saying it has updated the Simatic code in the controllers to remove the loopholes.

It is not yet clear who created Stuxnet, but security researchers say it is so complex and tightly targeted that only a nation would be able to marshal the resources to put it together.

Stuxnet is just one of several similar malicious programs created to attack industrial control systems.

Experts speculate that many were made to slow down and disrupt Iran’s nuclear production processes.

Iran has regularly denied that the viruses have hit its nuclear programme.

The Siemens update comes as security firm F-Secure received an email believed to have been sent by a scientist working at Iran’s Atomic Energy Organization.

In the message, the scientist said its plants at Natanz and Qom have been hit again by a worm.

Top F Secure security researcher Mikko Hypponen said it had not been able to confirm any of the details in the message. However, digital detective work did reveal that the message had come from within the Atomic Energy agency.

On 23 July, Iran issued a statement saying it had successfully “confronted” sophisticated malware and thwarted all the cyber attacks against the nation’s infrastructure.

Reza Taqipur, Iran’s minister of communication and information technology, said it was sometimes hit by as many as two million cyber attacks a day, but its ability to deal with them was growing daily.

via bbc.co.uk

@longhawl, 12/25/10 8:52 PM

longhawl (@longhawl) 12/25/10 8:52 PM @ElyssaD Again? LOL, why did you unblock after blocking the other night? Stop running away from reality. And J ‘hacking’ is not reality.

Elyssa Durant, Ed.M. 

CyberSquatter at Large

The Corporation, LLC

United States of America

Wikileaks: Who Rules by the Code, Will Fall by the Code

Tuesday 14 December 2010

by: Luis de Miranda  |  Liberation |
Op-Ed

The human being is an animal of protocol. Our behaviors –
whether consciously or not – obey codes. Until just recently, protocol was an
instrument of hegemonic power. The more one mastered the rules and their
construction, the more one controlled the population. The writing and policing
of protocols were the privilege of the dominant elites.

Today, the Internet is the site through which humanity is in
the process of realizing that freedom occurs by the collective reclamation of
the construction and reinvention of protocols. Wikileaks’ name will remain one
of the milestones of this democratization. In the word Wikileaks,
leaks is important: it is thanks to the leaks that the
decision-making circles which once appeared solid as rock liquefy and lose their
magnificence. But wiki is just as significant: it means that everyone
and anyone may contribute to this active demystification of protocols.

What do the Internet and diplomatic circles have in common?
They are two worlds governed by very strict protocols, but in opposite ways.
Diplomatic rigor is a surface varnish which enables every sort of hypocrisy, low
blow and betrayal underneath. Protocol is a stage set, while the action remains
in the shadow. The Internet’s rigor, to the contrary, is located in all that one
does not see: in its source codes, in its universal standards for program
writing and data treatment (for example, on the Internet, RFC standards, TCP/IP
or HTML). What is immediately visible on the Net is a joyous chaos, turpitude,
freedom of expression, all the manifestations of the human kaleidoscope. We have
long been more or less familiar with the codes which govern the more or less
muted life of embassies, those more or less tacit rules of etiquette, precedence
and relations between states and their emissaries. We are less familiar with the
recent operating logic of digital technology.

Wikileaks is the product of hacker culture. A hacker
is not some pimply miscreant who provokes the Third World war by fiddling around
with computers. A hacker is an actor in the real: his practice is based on
“reverse-engineering,” or retroconception. Which is to say? It’s a
matter of deconstructing the programs, the rules or the protocols constructed by
groups with a monopolistic purpose in order to understand how they are
engineered at the source, in order to modify them and become an actor with one’s
own communication instruments, if possible, in
open-source, that is, in conformity with the spirit of free
software, modifiable by all those who take the trouble to learn the protocols’
digital logic. However, hackers don’t limit this modus operandi to digital
programs: by dint of spending most of their time on the Internet, the younger
generations have by now totally absorbed algorithm. They know the extent to
which our worldly protocols, our political and social rules, our behavior, our
tastes, our beliefs and our identities have been constructed and are instruments
of control.

The diplomatic world, the world of the rulers, is certainly not
sacred. Many people have repeated in their analyses: the Wikileaks leaks are not
very surprising in their content. But let us not forget that “the medium is the
message,” according to Marshall McLuhan’s famous and still-illuminating formula.
The power of the historic event underway, of which Wikileaks is a particularly
potent manifestation, resides in its form rather than its content. This event is
called numerism. To wit, the global codification of our representations
into binary electronic sequences is a new universal DNA. This numerism, through
a contrast effect, brings evermore to light a complementary human tendency:
crealism, that is, the will to make oneself autonomous, to freely
eschew automatisms, all the while taking in hand a democratic re-creation of
protocols. In English, that’s called empowerment; in classical French,
capacitation.

Confronted with this double logic, the old elitist analogue
worlds of doubletalk and bluff – notably, those of politics and diplomatic
institutions – cannot but be rattled. The message Wikileaks, among others, is
sending to those who rule is the following: At present, you may resort to
digital logic to organize the world and control the masses; know that, like you,
the masses shall be able to access – like you – this universal protocol to
divert or unmask its uses for hegemonic ends. This democratization seems
inevitable, unless all those who know computer programming are to be put in
jail, a temptation some leaders, including in France, seem to be itching to
succumb to.

Who rules by the code, will fall by the code. Those who mean to
control the masses through biometrics and electronic control must expect to see
these digital protocols backfire thanks to the vigilance of some – provided the
Internet and the press remain free. A freedom must not be technical only, but
critical and constructive. Let us, along with Orwell, never forget that numerism
alone, in the absence of collective crealism, will not lead to more and more
democracy, but only to the best of all worlds.

Translated by Truthout’s literary editor, French translator
and sometime book reviewer, Leslie Thatcher.

via truth-out.org

http://www.truth-out.org/wikileaks-who-rules-code-will-fall-code66157