Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon QUOTES

1 " The nations, of course, that are most at risk of a destructive digital attack are the ones with the greatest connectivity. Marcus Ranum, one of the early innovators of the computer firewall, called Stuxnet 'a stone thrown by people who live in a glass house'. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

2 " As Mike McConnell, the former director of national intelligence, told a US Senate committee in 2011, “If the nation went to war today, in a cyberwar, we would lose. We’re the most vulnerable. We’re the most connected. We have the most to lose. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

3 " But withholding information about vulnerabilities in US systems so that they can be exploited in foreign ones creates a schism in the government that pits agencies that hoard and exploit zero days against those, like the Department of Homeland Security, that are supposed to help secure and protect US critical infrastructure and government systems. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

4 " The horrors and costs of war encourage countries to choose diplomacy over battle, but when cyberattacks eliminate many of these costs and consequences, and the perpetrators can remain anonymous, it becomes much more tempting to launch a digital attack than engage in rounds of diplomacy that might never procedure results "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

5 " Richard Clarke, former cybersecurity czar under the Bush administration and a member of the panel, later explained the rationale for highlighting the use of zero days in their report. “If the US government finds a zero-day vulnerability, its first obligation is to tell the American people so that they can patch it, not to run off [and use it] to break into the Beijing telephone system,” he said at a security conference. “The first obligation of government is to defend.”40 "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

6 " There was nothing like staring down the barrel of a suspected cyberweapon to clear the fog in your mind. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

7 " Under a $652-million clandestine program code named GENIE, the NSA, CIA, and special military operatives have planted covert digital bugs in tens of thousands of computers, routers, and firewalls around the world to conduct computer network exploitation, or CNE. Some are planted remotely, but others require physical access to install through so-called interdiction—the CIA or FBI intercepts shipments of hardware from manufacturers and retailers in order to plant malware in them or install doctored chips before they reach the customer. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

8 " This wasn’t the only mistake they made. They also botched the cleanup operation on the servers they could access. They had created a script called LogWiper.sh to erase activity logs on the servers to prevent anyone from seeing the actions they had taken on the systems. Once the script finished its job, it was also supposed to erase itself, like an Ouroboros serpent consuming its own tail. But the attackers bungled the delete command inside the script by identifying the script file by the wrong name. Instead of commanding the script to delete LogWiper.sh, they commanded it to delete logging.sh. As a result, the LogWiper script couldn’t find itself and got left behind on servers for Kaspersky to find. Also left behind by the attackers were the names or nicknames of the programmers who had written the scripts and developed the encryption algorithms and other infrastructure used by Flame. The names appeared in the source code for some of the tools they developed. It was the kind of mistake inexperienced hackers would make, so the researchers were surprised to see it in a nation-state operation. One, named Hikaru, appeared to be the team leader who created a lot of the server code, "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

9 " But he insisted his reasons for supplying to governments went deeper than money: “We mainly work with governments who are facing national security issues … we help them in protecting their democracies and protecting lives.… It’s like any surveillance method. The government needs to know if something bad is being prepared and to know what people are doing, to protect national security. So "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

10 " Under the new policy, any time the NSA discovers a major flaw in software, it must disclose the vulnerability to vendors and others so the flaw can be patched. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

11 " Civil War general Robert E. Lee said famously that it was a good thing war was so terrible, “otherwise we should grow too fond of it. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

12 " Germany, a Wassenaar member, already has a law that effectively prohibits the sale of exploits as well as the practice of giving them away for free, something that security researchers do regularly among themselves to test systems and improve security. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

13 " One such middleman is a South African security researcher based in Thailand who is known in the security community by his hacker handle “The Grugq.” The Grugq brokers exploit sales between his hacker friends and government contacts, pocketing a 15 percent commission per transaction. He only launched his business in 2011, but by 2012 sales were so good, he told a reporter he expected to make $1 million in commissions. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

14 " Like conventional weapons, most digital weapons have two parts—the missile, or delivery system, responsible for spreading the malicious payload and installing it onto machines, and the payload itself, which performs the actual attack, such as stealing data or doing other things to infected machines. In this case, the payload was the malicious code that targeted the Siemens software and PLCs. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

15 " The main Stuxnet file was incredibly large—500 kilobytes, as opposed to the 10 to 15 KB they usually saw. Even Conficker, the monster worm that infected more than 6 million machines the previous two years, was only 35 kilobytes in size. Any malware larger than this usually just contained a space-hogging image file that accounted for its bloat—such as a fake online banking page that popped up in the browser of infected machines to trick victims into relinquishing their banking credentials. But there was no image file in Stuxnet, and no extraneous fat, either. And, as O’Murchu began to take the files apart, he realized the code was also much more complex than he or anyone else had previously believed. When "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

16 " After two months passed and they were still finding holes, the company canceled the testing and just shipped the kiosks out. O "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

17 " Each time Stuxnet infected a system, it “phoned home” to one of two internet domains masquerading as soccer fan sites—mypremierfutbol.com and todaysfutbol.com. The domain names, registered by someone who used fake names and fraudulent credit cards, pointed to servers in Denmark and Malaysia "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

18 " In amassing zero-day exploits for the government to use in attacks, instead of passing the information about holes to vendors to be fixed, the government has put critical-infrastructure owners and computer users in the United States at risk of attack from criminal hackers, corporate spies, and foreign intelligence agencies who no doubt will discover and use the same vulnerabilities for their own operations. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

19 " These incidents were all accidental, but in Poland in 2008 a fourteen-year-old boy in Lódz caused several trains to derail when he used the infrared port of a modified TV remote control to hijack the railway’s signaling system and switch the tram tracks. Four trams derailed, and twelve people were injured. "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

20 " You couldn't bomb a plant you didn't know about, but you could possibly cyberbomb it "

― , Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon