The Cybersecurity Canon: Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

The Cybersecurity Canon is official, and you can now see our website here. We modeled it after the Baseball or Rock & Roll Hall-of-Fame, except for cybersecurity books. We have 20 books on the initial candidate list but we are soliciting help from the cybersecurity community to increase the number to be much more than that. Please write a review and nominate your favorite. 

The Cybersecurity Canon is a real thing for our community. We have designed it so that you can directly participate in the process. Please do so!

Remember: public Internet voting begins on February 1, and your vote counts!

Book Review: Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon by Kim Zetter

Executive Summary

Operation Olympic Games is the US military code name that refers to the first ever act of real cyber warfare. Many journalists have told bits and pieces of the story since the attacks became public back in 2010, but none have come close to telling the complete story. In Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon, Kim Zetter changes that situation. She takes an extremely complicated subject in terms of technical detail, political fallout and philosophical conundrums and makes it easy for the security practitioner to   understand. It is a masterful bit of juggling and storytelling. It is Cybersecurity Canon-worthy and you should have read it by now.

Introduction

Kim Zetter has been at Wired Magazine since 2003 and has become one of the cybersecurity community’s go-to journalists to explain what is really happening within the space. When I heard that she was writing a book about the Stuxnet attacks, I was thrilled. I knew if anybody could take on this complicated subject, Zetter could.

One of the annoying truisms of keeping up with cybersecurity events in the news is that journalists rarely go back and attempt to tell a complete story. When cybersecurity events occur – like the Target breach, the Sony breach, and the Home Depot breach to name three -- news organization print the big headlines initially and then trickle out new information over the next days and weeks as it becomes available. For cybersecurity professionals trying to remain current, we rarely get the opportunity to see the big picture in one lump sum. We are not going to get that kind of story in a news article. You need a book to cover the detail and there have been some good ones in the past. Mark Bowden’s Worm -- about the Conficker Worm and the cabal that tried to stop it --  is one good example. Cuckoo’s Egg – about the first publically documented cyber espionage attack back in the late 1980s – is another one. Zetter’s book, Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon, is the latest in this line and it is really good.

The Story

Operation Olympic Games is the US military code name that refers to the first ever act of real cyber warfare. Many journalists have told bits and pieces of the story since the attacks became public back in 2010, but none have come close to telling the complete story.

In June 2012, David Sanger published an article in The New York Times proclaiming for the first time that the United States, in conjunction with Israel, was indeed behind the infamous Stuxnet malware attacks that targeted the Iranian nuclear enrichment plant at Natanz. Sanger followed that article, along with others, with his book, Confront and Conceal: Obama’s Secret Wars and the Surprising Use of American Power.

In both the articles and the book, he gave details about the cyber operation called Operation Olympic Games that I consider to be the first act of cyber warfare in the world. But because the story was so new and so complicated, many of the technical details surrounding the attacks did not fully emerge until well after Sanger published his book. I have tried to keep up with the story myself over the years and even presented versions of it at DEFCON and RSA, based on the information available. But I do not have the journalistic chops to tell the complete story and this is where Zetter’s book shines.

Where Sanger’s book focused on the US foreign policy implications of offensive cyber warfare using government insiders as the main source, Zetter’s book fills in the technical story behind the attacks by interviewing everybody in the public space that was involved in unraveling the Stuxnet mystery. Zetter writes clearly and succinctly about the timing of key researchers discovering new facts, describes how the researchers determined when the attackers first used key pieces of the attack code and then feathered those technical events with what was happening in the political arena at the same time. It is a masterful bit of juggling and storytelling.

The Code

Because of Countdown to Zero, we now have a complete picture of how the attack code worked. Zetter goes into great detail about how the malware proliferated within the Iranian power plant at Natanz and after it escaped into the wild. She puts to bed the question of how may zero day exploits the attackers used in the complete code set, what they were and how effective they all were. She covers all of the versions of the malware from Stuxnet, to DuQu, to Flame and to Wiper. She even covers some of the researcher’s Tools-of-the-Trade that they used to decipher the code base.

SCADA

In Countdown to Zero, Zetter explains the significance of the critical and mostly unsecured SCADA (Supervisory Control and Data Acquisition) environments deployed in the US today. These systems automatically control the flow of all power, water, and gas systems used within the US and throughout most of the world. According to Zetter,

“There are 2,800 power plants in the United States and 300,000 sites producing oil and natural gas. Another 170,000 Bottom of Form facilities form the public water system in the United States, which includes reservoirs, dams, wells, treatment facilities, pumping stations, and pipelines. But 85 percent of these and other critical infrastructure facilities are in the hands of the private sector, which means that aside from a few government-regulated industries—such as the nuclear power industry—the government can do little to force companies to secure their systems.”

In my experience, the SCADA industry has always been at least 10 to 15 years behind the rest of the commercial sector in adopting modern defensive techniques. From Zetter,

“Why spend money on security, they argued, when none of their competitors were doing it and no one was attacking them?”

The significance of that statement becomes obvious when you realize that the same kinds of Programmable Logic Controllers or PLCs that the US exploited to attack Iran are deployed in droves to support the world’s own SCADA environments.  The point is that if the US can leverage the security weaknesses of these systems, then it is only a matter of time before other organizations do the same thing and the rest of the world is no better defended against them than the Iranians were.

(And by the way, Palo Alto Networks expert Del Rodillas has done plenty of strong analysis into securing ICS and SCADA networks and what it’s going to take to protect these specialized networks going forward. Go here to read some of Del’s thoughts.)

The Philosophical Conundrum

In a broader context, Countdown to Zero highlights some philosophical conundrums that our community is just now starting to wrestle with. We have known about these issues for years but Zetter’s telling of the story makes us reconsider them. Operation Olympic Games proved to the world that cyber warfare is no longer just a theoretical construct. It is a living and breathing option in the utility belt for nation states to use to exercise political power. With Operation Olympic Games, the US proved to the world that it is possible to cause physical destruction of another nation state’s critical infrastructure using nothing but a cyber weapon alone. With that comes a lot of baggage.

The first conundrum is the intelligence dilemma. At what point do network defenders stop watching adversaries misbehave within their networks before they act to stop them?  By acting, we tip our hand that we know what they are about. This will most likely cause the adversary team to change their tactics. Intelligence organizations want to watch adversaries as long as possible. Network defenders only want to stop the pain. This is an example of classic Information Theory. I first learned about Information Theory when I read about the code breakers at Bletchley Park during WWII. Because the allies had broken the Enigma cipher, the Bletchley Park code breakers collected German war plans before the German commanders in the field received them. But the Allies couldn’t act on all of the information because the Germans would become suspicious about the broken cipher. The Allies had to pick and choose what to act on. This is similar to what the Stuxnet researchers were wrestling with too. Many of them had discovered this amazing and dangerous new piece of malware. When do they tell the world about it?

The next conundrum involves the national government and vulnerability discovery. Zetter discusses the six zero-day exploits used by Operation Olympic Games in the attacks against Iran. That means that the US government knew about at least six high-impact vulnerabilities within common software that the entire nation depends upon and did nothing to warn the nation about them. If another attacker decided to leverage those vulnerabilities against the US critical infrastructure in the same way that the US leveraged them against Iran, the results could have been devastating. The nation’s ethical position here is murky at best, and added to that is the well-known practice of the private sector selling zero-day exploits to the government. Should the government even be in the business of buying weapons grade software from private parties? Zetter offers no solutions here but she definitely gives us something to think about.

Conclusion

Zetter fills in a lot of holes in the Stuxnet story. In a way, it is a shame that it has taken five years to get to a point where the security community can feel like we understand what actually happened. On the other hand, without Zetter putting the pieces together for us, we might never have gotten there. I have said for years that the Stuxnet story marked the beginning of a new era for the cybersecurity community. In the coming years, when it is common practice for nation-states to lob cyber-attacks across borders with the intent to destroy other nation’s critical infrastructure, we will remember fondly how simple defending the Internet was before Stuxnet. Zetter’s book helps us understand why that is possible. She takes a complicated subject and makes it easy to understand. It is Cybersecurity Canon-worthy and you should have read it by now.