71. Israel Attacks Iran: The Dawn of Cyber Warfare (Ep 4)

0:03Gordon Corera:For exclusive interviews, bonus episodes, ad-free listening, early access to series, first look at live show tickets, a weekly newsletter, and discounted books, join the Declassified Club at therestisclassified.com. Hey parents, how do you make smarter choices for your kids' college today? That's where Sally can help. With Sally, you can find scholarships, funding options, tools, and guidance all in one place. And if you need a loan, Sally has options for different families and different situations. College is only worth it if you do it right. So don't just help your kid go. Help them go smarter.

0:42Gordon Corera:sally.com slash go parents.

0:53Gordon Corera:It would be irresponsible for someone of my background to even speculate. But it's not speculation to know that someone just used a cyber weapon to affect damage, not in the cyber domain, but in the physical domain. That's the first significant crossover that we've seen. Now look, I tell audiences that crashing a thousand centrifuges at a time is almost an unalloyed good. But when you describe what just happened there in a slightly different way, someone just used a cyber weapon during a time of peace to affect physical destruction in what another nation would only describe as critical infrastructure, well, you've got to realize that although that was a good deal, it was also a really big deal.

1:31Gordon Corera:And it does have second and third order effects. A new class of weapons has been used. Go deeper into history and say somebody's crossed the Rubicon. We've got a legion on the different side of the river now. Well, welcome to The Rest is Classified. I am David McCloskey. And I'm Gordon Carrera. And that, Gordon, is an interview that you did. Those are not your words, but those of General Michael Hayden, former director of the NSA and the CIA, in an interview with you back in 2013, not taking responsibility for Stuxnet, but commenting on the sort of world-changing implications of this cyber weapon.

2:12Gordon Corera:And we are now, dear friends, in the final episode of our series on this really first attack on Iran's nuclear program. And the US and Israel have unleashed this code, which has come to be known as Stuxnet, which has targeted Iran's very precious centrifuges with this kind of remarkable precision and sophistication. And the Iranians, now it's been three plus years at this point of this code working its way through largely this facility, this enrichment facility at Natanz. And things have been breaking. Machinery has been slowing down. And where we left last time was that this code, this worm has broken out into the wild.

3:03Gordon Corera:And cybersecurity researchers in Europe and the States are starting to see really all over the world are starting to see this code appear on their computers. and at the same time the US and Israel allegedly are stepping up the game to try to bring even more pain to Iran's nuclear program. That's right the secret is out by the summer of 2010 and this code which was designed to be covert is now being found on machines around the world. It's not shutting them down because then it's not designed to but it is visible and people can start to look at it. I remember talking to an interesting chap called Eugene Kaspersky soon after.

3:44He's the flamboyant Russian founder of the antivirus company Kaspersky. It's named after him. And he remembers his team coming into his office and saying, we've been waiting for something like this to happen. Well, it's happened. Kaspersky says he'd been worried about an attack on physical infrastructure using code since 2002. He says he decided not to speak out in case it gave attackers the idea. That was until he realized the cat was out of the bag. when he saw the film Die Hard 4, Live Free or Die Hard, in which Bruce Willis battled cyber terrorists, which I should say is one of our producer Callum's favourite films, he was saying earlier, and suggesting that we should basically have just kind of talked about that film for the whole of this series.

4:26Could be a bonus episode. Could be a bonus episode. Thank you, Hollywood, Kaspersky says, when that film comes out in 2007. Because, you know, it's not entirely realistic, but it is the idea. Oh, it's not? Yeah, I think the cybersecurity aspects of it may not be perfect. But there's a concept. It's a good example where Hollywood does get things right. Because as a concept that hackers could take down physical infrastructure, it is right. But now it's for real. You know, now in 2010, it's for real. Because Kaspersky, other cybersecurity researchers have basically got a cyber missile in their hands.

5:04and they have never seen anything so sophisticated. And it's so interesting what happens in the next few months because you see this kind of hive mind of cybersecurity researchers go into action. And I've watched it lots of times since then where it's often done on social media platforms. It used to be mainly on Twitter and X where people are saying, I found this, I found that. And they're starting to publish, talk about what they're finding. Often, you know, one person's an expert on one bit of code, one's on another, but they're starting to piece it together collectively this group of cyber security researchers sometimes just work for tiny companies sometimes they work for the big big companies best book on this mentioned it before kim zetta's countdown to zero day because that goes through the process of discovery as people are trying to look at the delivery system the missile as well as the payload of the code that was in it.

6:00And they can see that this is completely different from anything they've seen before in sophistication. Normally, attackers build on existing tools and code, but this is different. It's completely original. Two particular individuals, Liam Amurcu and Eric Chen of Sementech, see a kind of series of really unusual elements to this. I mean, one of them is that it's going to use this attack for what are called zero days, bit of jargon, but a zero day gets its name because it's an undiscovered vulnerability in a piece of code. So normally you say it's four days since this has been patched. A zero day, there's zero days since it's been patched because it's not been patched.

6:40There's not a solution to the vulnerability. And therefore it's incredibly valuable, a zero day, because it is a way that's not yet been discovered to get into a system.

6:49Gordon Corera:Well, and it's actually a product, right? I mean, And it's something that, if discovered, can be sold effectively. Yeah, a zero day is really valuable. There's a market for zero days where people who find them, who look for vulnerabilities, then sell them. You can sell them back to the company, to Apple or Google or whoever, and they'll pay for them. Or you could sell it on the black-gray market to people who want to use the vulnerability maliciously. And the fact that they've got four zero days in this, that is unprecedented. Because why would you need four in one system? It's because this virus is getting into different systems.

7:26And someone could have sold those for money. So immediately you're like, this is not criminals. No criminal hacker would be investing this much time and using this much code. It's stolen legitimate digital security certificates from a company, I think, in Taiwan. It wasn't faked. It was real. Again, that is high end. But they can also see these researchers from Symantec. When they map the location of where the infections have happened, of the 38 ,000 machines they tracked, more than 22 ,000 were in Iran. So you can already see, like, this is a very sophisticated code, and it's really interested in Iran.

8:05It loves Iran. It loves Iran. And then, you know, they're not experts on industrial control systems, but you get experts like Ralph Langer, who is an expert, who suddenly goes, okay, this could be used to attack centrifuges. Centrifuges are in Iran. People start publishing online in research papers. Some of the details of this takes a while because people can't quite grasp what it is. So it's taking months really for people to piece it together. And this is, by the way, where it gets the name Stuxnet. What is that a reference to? I think it's just a tiny reference in some of the drivers and the code to Stuxnet.

8:42And that often happens. People just will pick out something and they'll just call it that because it looks like a unique name. I always find it interesting with these cyber researchers because they are, at this point, exposing what they must realize is a nation-state espionage program. And you're a private cybersecurity researcher and you are making public or publishing details of a covert action program. And I think you can sense some of them are, it's not that they're nervous about doing it because they think they have a duty to do it because there's a risk to systems from this and from all these vulnerabilities which have been found.

9:21But they're worried, you know, are they going to get spied on? Is this going to have some implications for them? It's kind of interesting. And they get a bit paranoid. You know, they're starting to check under their cars for bombs. You know, they're worried about being tailed. I mean, they really are. They're hearing clicks on phones. All that kind of stuff is happening to these cybersecurity researchers as they're publishing it. They think the CIA are onto them. They're in a Jason Bourne film, basically.

9:43Gordon Corera:I understand why you would be paranoid, but I find it highly implausible that cars were beaconed or that anyone was followed or anything like that. I just don't. I don't see it. If you were a cybersecurity researcher, you probably would get a lot of other international spy agencies hacking into your systems to see what you're discovering and what you know, though. So I could imagine Cybris being... Oh, yeah, that would be fair game of like, Like if you're running a cybersecurity firm somewhere in Europe or in Russia or something, yeah, I mean, there could be an interest in learning what you know about it.

10:18Gordon Corera:Although the reality is, from an American standpoint, hypothetically, you already know what this thing is. So you have to assume, I think, once it's out in the wild. I mean, this is why we set up that wonderful cliffhanger, Gordon, at the end of the last episode, where, I mean, once it's out, you have to assume, I think, that you're running on sort of borrowed time and that you just have to use this thing inside Iran as much as possible before it comes out. Collecting on the cybersecurity research actually doesn't seem particularly valuable to me, to be honest, because you're like, well, it's out.

10:50Gordon Corera:We know what this is. They'll piece it together. They'll discover eventually that the target is the Iranian nuclear program. So we just got to work with the time we've got and do as much damage as possible before this thing comes to light. And it's starting to become obvious who was behind it. And there are interesting clues in the code. One has a string of numbers that look like a date. I think it's 1979-0509. And it was the day the researchers realised that a prominent Iranian Jewish businessman was executed by firing squad in Tehran shortly after the Islamic Revolution for allegedly being a spy.

11:25Now, it's interesting, isn't it? Because you find a date like that in the code and you go, well, that's an interesting date. Is it a clue that the Israelis are behind it? Is it a false trail someone else has left? I always find it interesting because people do leave these Easter eggs and these little clues in code and code writers love doing that. I always find it interesting. It's like a game that they're just showing off or leaving a trail for people to follow. There's another word, Murtas, appears in a file name, which in Hebrew was a link to the name Hadassah, which was the name of a biblical figure, Esther, who married a Persian king and saved the lives of Jews when she pleaded for their lives after learning of a plot to kill them all.

12:02Again, you know, all of that is starting to point perhaps towards Israel, as well as perhaps towards the US. And in the US, meanwhile, there is a blame game, unsurprisingly, about the fact that it's getting exposed. I find that maybe unsurprising in Washington. That seems unsurprising, yeah. But yeah, the briefing afterwards will all be, it was the Israelis' fault. It's kind of interesting.

12:26Gordon Corera:What's the logic there, that it was the Israelis' fault? The logic is that they had rushed and that the code was somehow sloppy, and that sloppy code had been put in, which had allowed it to escape and therefore get discovered, and that the Israelis had done some modification to the code, maybe to speed up the propagation of the worm or make it more likely to spread. And there's some questions about whether the US were part of that, were cognizant of it, whether the Israelis did it themselves. But of course, that's the briefing from Washington, much easier to blame someone else. But by the point of November 2010, it's out there.

13:03And a few months after its first in the wild, the finger is pointing pretty clearly because of some of the back history of some of the code and some of the things they can find in it, that it's the US and Israel.

13:15Gordon Corera:What about the Brits, Gordon? I feel like most of our series, you throw the Brits in, even when they're not invited to the party. You think about who might have been involved in pieces of this. It would seem reasonable to assume that GCHQ or SIS would have played some role somewhere, just thinking about the closeness of the relationship in particular with the Americans. How would I put it? I find it plausible. I remember talking to one very senior British intelligence official at the time, and they said they were not surprised when Stuxnet happened and was revealed. And that's a wonderfully ambiguous statement, isn't it?

13:55Because you can be not surprised because you were part of it. Or you can be not surprised. You can be not surprised because this is the kind of stuff we'd expect the Americans and the Israelis to do. I get the sense that they were at the very least aware of it. And there are some indications from some of the early espionage code, there might have been some British involvement in that. There's actually some really interesting suggestions from our friend Edward Snowden's documents that there have been perhaps some British role in the espionage bit. So what I, I don't know what you think, David. My instinct is that other countries may have been involved in this, but definitely US-Israel at the core.

14:31I think the other countries may have been involved in kind of modular bits of Stuxnet. So we talked a bit about whether the Dutch had been involved in getting an engineer to plant one of the USBs, whether he knew what he was doing, whether the Dutch knew it was sabotage rather than espionage, question mark. But I definitely feel like others might have been involved, but maybe not at the absolute core of this.

14:55Gordon Corera:It also seems plausible to me. I mean, you look at two pieces of this shadow war, right? The assassination of scientists, and then the sort of cyber program to degrade and affect Natanz. And it's very easy for me to understand why on the assassination front, the Israelis are going it alone, right? There would be a lot of other countries that would say, nope, not going to do that, not going to have any part in killing civilian scientists. But then on the other side, on the cyber piece, I can see why there'd be a whole host of countries with real interest in getting involved in that program, right?

15:37Gordon Corera:Because it's not going to kill anybody. It's going to slow Iran's progress toward a bomb. And so I can see why, as that develops, there would be logical bits for other friendly intelligence services to sort of plug into to get access to reporting that they otherwise might not have and to take part in kind of slowing this down. So I think it seems likely to me that there's probably a whole bunch of countries outside of, allegedly, the US and Israel that are involved in different pieces of this. I mean, I don't know how big the group was, but I think it's probably not just the CIA and NSA and Mossad.

16:16Yeah, there might have been a few more people playing at the Olympic Games. But by the time you get to November 2010, cybersecurity searches have published material. And at that point, November 2010, technicians at Natanz bring the spinning centrifuges basically to a halt because they're aware of something's going on. and it does look like though and we'll come back to the kind of overall damage but it does look at that point the kind of swing for the fences has hit and maybe taken down about a thousand of those centrifuges but fascinatingly you know you mentioned assassinations there so november 2010 Stuxnet now exposed so it looks like that covert action is over that same month Israel assassinates a nuclear scientist in Tehran using a bomb planted by a motorcyclist to me that that confluence of timing is fascinating, isn't it?

17:06Because it does suggest that Israel, perhaps, assuming it's Israel, we all think it is, Mossad doing the assassinations, has basically gone, okay, that covert action is done. We may now need to up our game with going back to the assassinations and push that to kind of degrade the nuclear program. Because there had been a bit of a pause, hadn't there, in the assassinations. And that pause kind of tracks when Stuxnet is doing the most damage. To me, that feels a plausible argument. It's hard to know for sure.

17:37Gordon Corera:I think that would be just more evidence for the kind of hypothesis I laid out where the Israelis are doing the assassination stuff alone. There's a broader group that's doing Stuxnet. If Stuxnet is basically rolled up, the Israelis figure, well, okay, back to this blunter instrument, right, of trying to degrade the program. And it's really interesting because some of those cybersecurity researchers, you know, out in the private sector who'd been exposing Stuxnet actually say they feel physically sick when they hear about the assassination, because they are wondering, did their exposure of the computer code lead Israel to switch from using code to killing people?

18:15And I guess they, for them, suddenly realize, you know, they're computer researchers, cyber researchers, and they're dealing in matters of life and death, effectively.

18:24Gordon Corera:Sure. I mean, they can't possibly be held responsible for that. I think it is true, right? I mean, there's pretty solid arguments we've made based on the timing that the Israelis, precisely because the code got out, decided to go back to killing. And I guess maybe there, Gordon, let's take a break. And when we come back, we'll look at all of this and what it means for the Iranian nuclear program, what it means for cyber war, and I think what it tells us about the most recent batch of strikes. See you after the break.

19:04Gordon Corera:Well, welcome back. The Stuxnet worm is out in the wild. The Iranians know about it. And I guess the question now, Gordon, is what in the world are the Iranians going to do about all this? Yeah. So part of it is they start to clean their centrifuge program of the virus. unsurprisingly. Wipe it down. Get out the wipes and protect it even more, which is going to make it harder. But it's also Iran's going to hit back in cyberspace. They'd already built some cyber capacity, particularly actually to target that green movement, the protest movement around 2009, 2010. They built up cyber militias to do surveillance on their own population, because they were worried that social media was being used to organise them.

19:49But now they start to use some of their cyber capacity to go on the attack. Very interesting, 2012, so still a couple of years later, that summer, there's an attack on the Saudi oil giant Aramco, and 30 ,000 computers belonging to Aramco are crippled. They're wiped by something called a wiper. The code hadn't been executed quite properly, but a burning American flag appears as an image on some of those machines. Hmm, bit of a message. It didn't actually stop oil and gas production though i think that's one of the interesting things about it it damages the corporate network but it doesn't get to the controllers doesn't move into the physical the physical world exactly which is the key to stuxnet success and what makes stuxnet so unique is it moves from the corporate network or from a you know regular network onto the controllers so it's a show of force but it doesn't have the impact that stuxnet is going to have although it does freak out i think a lot of companies and i remember that at the time because they're all suddenly realising Iran is retaliating against companies rather than against Western states.

20:55And they then attack a whole load of banks and American banking websites. But again, it's not super sophisticated. They just take their websites offline for a couple of days by flooding them with traffic. So it's Iran hitting back. Everyone assumes it's Iran. They're not going to hit back by launching missiles. They're not going to block the Straits of Hormuz at this point, but they're going to fire a warning shot against companies, probably oil companies and financial companies, because they're imposing sanctions on Iran's financial and oil industry. So it makes sense. And it is a bit of a surprise, I think, in the West, because it shows Iran is capable of hitting back.

21:33There's going to be more of these back and forth between Israel and Iran. There's one attack on the Iranian oil and gas ministry computers, in which the song Thunderstruck by ACDC, which is a particular favorite of mine, is blared out at full volume on computers in the middle of the night, which that's a cyber attack I like. I've got sympathy with that. You know, a bit of ACDC. Maybe that could be our podcast theme song, Gordon.

21:57Gordon Corera:That could be one of our... Thunderstruck. Exactly. We'll have to see. I don't think Callum and Becky, our producers, are going to like changing the theme music. I don't think they're ACDC. It's too late. Yeah, exactly. Getting into all kinds of copyright issues. But I guess the point is that we're now moving into this era in which cyber attacks are picking up. Things are going to escalate in cyberspace. End of 2015, Russia turns off a Ukrainian power grid. So again, it's the using a cyber attack, but to turn off a power grid only for a few hours. But you're getting this movement of cyber into the real world in a limited way.

22:35And it's interesting. China, when it's accused of spying in cyberspace, they go, yeah, but you, the US, are the ones who militarized cyberspace first and introduced destructive cyber attacks. Not in one sense. They're right. You know, this idea of cyber sabotage below the threshold of war, gray zone attacks make cyber tempting. States start to move into it. And so there is this who crossed the Rubicon, who put the troops on the other side of the river first. It is the United States. Allegedly. Now, I think you can also say it would have happened anyway. Absolutely. You could see the vulnerability of these systems.

23:11And I find it hard to believe that the Russians would have gone, oh, we're not going to attack Ukraine. Exactly.