Report: Stuxnet Was a Joint U.S.-Israeli Operation

While Flame has been all the rage lately, huge news broke today on another piece of malware suspected to have been cooked up in a spy agency lab. Turns out all that speculation about Stuxnet having been created by either the United States or Israel to attack Iran's nuclear capabilities appears to have been on target.

In a book excerpt published today on The New York Times Web site, Times reporter David Sanger quoted several government officials in the Bush and Obama administrations on a not-for-attribution basis.

Among the biggest revelations in Sanger's piece:

• The Bush Administration started the planning and work on what would be dubbed by security researchers as Stuxnet. The official codename for the operation was "Olympic Games."
  
  
• Stuxnet was never intended to get outside the Natanz plant in Iran. A programming error caused it to spread onto an engineer's laptop and then out into the wild, where security researchers noticed it in the summer of 2010.
  
  
• The U.S. National Security Agency (NSA) worked with Israel's Unit 8200 to develop the worm, which the Americans referred to as "the bug." Two imperatives drove U.S. cooperation: Israeli's deep intelligence about operations at Natanz, and ensuring Israel's full awareness of progress to dissuade them from conducting a pre-emptive strike.
  
  
• Both presidents were closely involved in planning the development of Stuxnet (Bush) and the attacks using the code weapon (Obama).
  
  
• Before it was deployed against Iran, "the bug" was tested on a replica of Natanz using similar centrifuges the U.S. confiscated in 2003 from Libyan dictator Muammar el-Qaddafi when he gave up his nuclear weapons program.

The whole excerpt provides compelling and convincing reading. I'm looking forward to the rest of Sanger's book, "Confront and Conceal: Obama's Secret Wars and Surprising Use of American Power," when it comes out on Tuesday.

While the government hasn't officially admitted using cyberweapons, the wink-and-nod conversations with a reporter at this stage are surprising. I hadn't expected definitive answers to the question of whether the U.S. was involved in the Stuxnet attacks until files were declassified decades from now.

Having these facts in the open, introduces a whole new set of thorny questions. For example, in a comment e-mailed to reporters, Andrew Storms, director of security operations for nCircle, wrote, "This news changes everything, it opens a Pandora's box of new complications. Conspiracy theorists are going to have a field day." As one immediate implication, he suggests opponents of the U.S. Cyber Intelligence Sharing and Protection Act will have a new line of attack.

The fact that Stuxnet itself used four zero-day vulnerabilities in Windows as part of its attack package was not good news for the Microsoft ecosystem. Still, there's opportunity here for the Microsoft channel. With fairly solid confirmation now that Stuxnet was a government operation, everyone involved in IT security sales has a new bullet point for their PowerPoint deck.

Posted by Scott Bekker on June 01, 2012