Iran's Hacking of US Navy 'Extensive,' Repairs Took $10M and 4 Months 147
cold fjord sends news that Iran's breach of a computer network belonging to the U.S. Navy was more serious than originally thought. According to a Wall Street Journal report (paywalled, but summarized at The Verge), it took the Navy four months to secure its network after the breach, and the repair cost was approximately $10 million. From the article:
"The hackers targeted the Navy Marine Corps Intranet, the unclassified network used by the Department of the Navy to host websites, store nonsensitive information and handle voice, video and data communications. The network has 800,000 users at 2,500 locations, according to the Navy. ... The intrusion into the Navy's system was the most recent in a series of Iranian cyberoffensives that have taken U.S. military and intelligence officials by surprise. In early 2012, top intelligence officials held the view that Iran wanted to execute a cyberattack but had little capability. Not long after, Iranian hackers began a series of major "denial-of-service" attacks on a growing number of U.S. bank websites, and they launched a virus on a Saudi oil company that immobilized 30,000 computers. ... Defense officials were surprised at the skills of the Iranian hackers. Previously, their tactics had been far cruder, usually involving so-called denial of service attacks that disrupt network operations but usually don't involve a penetration of network security."
Maybe they learned (Score:4, Interesting)
By studying Stuxnet.
Re:Asymetrical warfare (Score:5, Interesting)
My first question would be ... how are we sure that Iran did this?
The second question would be how did whomever do it? We've heard about how the NSA/CIA/etc are stockpiling zero-day exploits. Stockpiling them instead of helping the vendors fix them. So were our systems cracked by an enemy using an exploit that we knew of?
Re: Asymetrical warfare (Score:2, Interesting)
You're spot on! Most of these organizations blow things massively out of proportion to attain more funding for their so-called 'research'. Even a relatively harmless virus in the POS computer of a staff knick-knack shop would be reported as a 'possible avenue for compromising the high-value intelligence networks'. That goes on to trigger an agency-wide investigation, which ends up in the request for funds to conduct the said study. The studies are then sourced to organizations with ties to the IT heads of the principle agency, thus spreading the goodwill, and getting some in return.
It's also a cycle that's endorsed by all major software vendors. They always ensure that a certain amount of uncertainty goes into the security assurance of their products and services so that there's always 'room for improvement'.
Re:Asymetrical warfare - Not (Score:5, Interesting)
We're not at war with Iran, and no sane person in the U.S. or in Iran wants a shooting war. IMHO, what we have here is more of a cold-war style cat and mouse game where each side tries to provoke the other and see how far they can go. Examples being Iran supplying arms to Shiite militias in Iraq, Iran being involved in proxy wars in Syria and Lebanon, taking Americans hostage, and developing a nuclear weapons capability. The U.S. responded with Stuxnet and probably a few other things that we don't know about. In the end it's really about gaining some sort of political bargaining advantage and to have a stronger bargaining position when the time for deal making comes.
Iran is also the regional heavy weight, and they're not a bunch of modern-day spearchuckers as the parent somehow implies. They do have a professional conventional military with semi-modern weapons systems. They also have the ability to maintain, develop and upgrade their weapons systems. The main difference between Iran and the U.S. is that Iran lacks the global logistical capabilities that America brings to the battle field, and the depth that the U.S. has in any fight. The Iranians would lose a conventional battle with the U.S. and both sides know this. Defeating the U.S. in a conventional battle probably isn't a factor in Iran's military planning. They're more focused on regional domination, especially if and when the U.S. pulls out of the middle east. Without the U.S. backing of the Gulf states, Iran would probably be able to defeat any of their neighbors in a conventional war, at least in theory. Without the U.S., the only country in the region that might defeat Iran would be India.
If somehow forced into a conventional fight with the U.S., Iran could, with the right leadership, inflict heavy damage before being defeated. But Iran is a very old country. IMHO, they're playing for time and will poke us at any chance they get. As Sun Tzu once said, "If you wait by the river long enough, the bodies of your enemies will float by." In more modern terms that is called, "strategic patience."
Re:Asymetrical warfare (Score:4, Interesting)
Most of what you say I agree with but:
> A good bit of the code is actually somewhat amateurish
Citation needed. Or, to put it less politely, are you out of your fucking mind ? Stuxnet is the most advanced piece of malware ever discovered, and it worked. I don't believe you have access to the original source code so, can you justify this comment in any way ?