Israel Tests on Worm Called Crucial in Iran Nuclear Delay
January 15, 2011
By WILLIAM J. BROAD, JOHN MARKOFF and DAVID E. SANGER the New York Times
The Dimona complex in the Negev desert is famous as the heavily guarded
heart of Israel’s never-acknowledged nuclear arms program, where neat rows
of factories make atomic fuel for the arsenal.
Over the past two years, according to intelligence and military experts
familiar with its operations, Dimona has taken on a new, equally secret
role — as a critical testing ground in a joint American and Israeli effort
to undermine Iran’s efforts to make a bomb of its own.
Behind Dimona’s barbed wire, the experts say, Israel has spun nuclear
centrifuges virtually identical to Iran’s at Natanz, where Iranian
scientists are struggling to enrich uranium. They say Dimona tested the
effectiveness of the Stuxnet computer worm, a destructive program that
appears to have wiped out roughly a fifth of Iran’s nuclear centrifuges and
helped delay, though not destroy, Tehran’s ability to make its first nuclear
arms.
“To check out the worm, you have to know the machines,” said an American
expert on nuclear intelligence. “The reason the worm has been effective is
that the Israelis tried it out.”
Though American and Israeli officials refuse to talk publicly about what
goes on at Dimona, the operations there, as well as related efforts in the
United States, are among the newest and strongest clues suggesting that the
virus was designed as an American-Israeli project to sabotage the Iranian
program.
In recent days, the retiring chief of Israel’s Mossad intelligence agency,
Meir Dagan, and Secretary of State Hillary Rodham Clinton separately
announced that they believed Iran’s efforts had been set back by several
years. Mrs. Clinton cited American-led sanctions, which have hurt Iran’s
ability to buy components and do business around the world.
The gruff Mr. Dagan, whose organization has been accused by Iran of being
behind the deaths of several Iranian scientists, told the Israeli Knesset in
recent days that Iran had run into technological difficulties that could
delay a bomb until 2015. That represented a sharp reversal from Israel’s
long-held argument that Iran was on the cusp of success.
The biggest single factor in putting time on the nuclear clock appears to be
Stuxnet, the most sophisticated cyberweapon ever deployed.
In interviews over the past three months in the United States and Europe,
experts who have picked apart the computer worm describe it as far more
complex — and ingenious — than anything they had imagined when it began
circulating around the world, unexplained, in mid-2009.
Many mysteries remain, chief among them, exactly who constructed a computer
worm that appears to have several authors on several continents. But the
digital trail is littered with intriguing bits of evidence.
In early 2008 the German company Siemens cooperated with one of the United
States’ premier national laboratories, in Idaho, to identify the
vulnerabilities of computer controllers that the company sells to operate
industrial machinery around the world — and that American intelligence
agencies have identified as key equipment in Iran’s enrichment facilities.
Seimens says that program was part of routine efforts to secure its products
against cyberattacks. Nonetheless, it gave the Idaho National Laboratory —
which is part of the Energy Department, responsible for America’s nuclear
arms — the chance to identify well-hidden holes in the Siemens systems that
were exploited the next year by Stuxnet.
The worm itself now appears to have included two major components. One was
designed to send Iran’s nuclear centrifuges spinning wildly out of control.
Another seems right out of the movies: The computer program also secretly
recorded what normal operations at the nuclear plant looked like, then
played those readings back to plant operators, like a pre-recorded security
tape in a bank heist, so that it would appear that everything was operating
normally while the centrifuges were actually tearing themselves apart.
The attacks were not fully successful: Some parts of Iran’s operations
ground to a halt, while others survived, according to the reports of
international nuclear inspectors. Nor is it clear the attacks are over: Some
experts who have examined the code believe it contains the seeds for yet
more versions and assaults.
“It’s like a playbook,” said Ralph Langner, an independent computer security
expert in Hamburg, Germany, who was among the first to decode Stuxnet.
“Anyone who looks at it carefully can build something like it.” Mr. Langner
is among the experts who expressed fear that the attack had legitimized a
new form of industrial warfare, one to which the United States is also
highly vulnerable.
Officially, neither American nor Israeli officials will even utter the name
of the malicious computer program, much less describe any role in designing
it.
But Israeli officials grin widely when asked about its effects. Mr. Obama’s
chief strategist for combating weapons of mass destruction, Gary Samore,
sidestepped a Stuxnet question at a recent conference about Iran, but added
with a smile: “I’m glad to hear they are having troubles with their
centrifuge machines, and the U.S. and its allies are doing everything we can
to make it more complicated.”
In recent days, American officials who spoke on the condition of anonymity
have said in interviews that they believe Iran’s setbacks have been
underreported. That may explain why Mrs. Clinton provided her public
assessment while traveling in the Middle East last week.
By the accounts of a number of computer scientists, nuclear enrichment
experts and former officials, the covert race to create Stuxnet was a joint
project between the Americans and the Israelis, with some help, knowing or
unknowing, from the Germans and the British.
The project’s political origins can be found in the last months of the Bush
administration. In January 2009, The New York Times reported that Mr. Bush
authorized a covert program to undermine the electrical and computer systems
around Natanz, Iran’s major enrichment center. President Obama, first
briefed on the program even before taking office, sped it up, according to
officials familiar with the administration’s Iran strategy. So did the
Israelis, other officials said. Israel has long been seeking a way to
cripple Iran’s capability without triggering the opprobrium, or the war,
that might follow an overt military strike of the kind they conducted
against nuclear facilities in Iraq in 1981 and Syria in 2007.
Two years ago, when Israel still thought its only solution was a military
one and approached Mr. Bush for the bunker-busting bombs and other equipment
it believed it would need for an air attack, its officials told the White
House that such a strike would set back Iran’s programs by roughly three
years. Its request was turned down.
Now, Mr. Dagan’s statement suggests that Israel believes it has gained at
least that much time, without mounting an attack. So does the Obama
administration.
For years, Washington’s approach to Tehran’s program has been one of
attempting “to put time on the clock,” a senior administration official
said, even while refusing to discuss Stuxnet. “And now, we have a bit more.”
Finding Weaknesses
Paranoia helped, as it turns out.
Years before the worm hit Iran, Washington had become deeply worried about
the vulnerability of the millions of computers that run everything in the
United States from bank transactions to the power grid.
Computers known as controllers run all kinds of industrial machinery. By
early 2008, the Department of Homeland Security had teamed up with the Idaho
National Laboratory to study a widely used Siemens controller known as
P.C.S.-7, for Process Control System 7. Its complex software, called Step 7,
can run whole symphonies of industrial instruments, sensors and machines.
The vulnerability of the controller to cyberattack was an open secret. In
July 2008, the Idaho lab and Siemens teamed up on a PowerPoint presentation
on the controller’s vulnerabilities that was made to a conference in Chicago
at Navy Pier, a top tourist attraction.
“Goal is for attacker to gain control,” the July paper said in describing
the many kinds of maneuvers that could exploit system holes. The paper was
62 pages long, including pictures of the controllers as they were examined
and tested in Idaho.
In a statement on Friday, the Idaho National Laboratory confirmed that it
formed a partnership with Siemens but said it was one of many with
manufacturers to identify cybervulnerabilities. It argued that the report
did not detail specific flaws that attackers could exploit. But it also said
it could not comment on the laboratory’s classified missions, leaving
unanswered the question of whether it passed what it learned about the
Siemens systems to other parts of the nation’s intelligence apparatus.
The presentation at the Chicago conference, which recently disappeared from
a Siemens Web site, never discussed specific places where the machines were
used.
But Washington knew. The controllers were critical to operations at Natanz,
a sprawling enrichment site in the desert. “If you look for the weak links
in the system,” said one former American official, “this one jumps out.”
Controllers, and the electrical regulators they run, became a focus of
sanctions efforts. The trove of State Department cables made public by
WikiLeaks describes urgent efforts in April 2009 to stop a shipment of
Siemens controllers, contained in 111 boxes at the port of Dubai, in the
United Arab Emirates. They were headed for Iran, one cable said, and were
meant to control “uranium enrichment cascades” — the term for groups of
spinning centrifuges.
Subsequent cables showed that the United Arab Emirates blocked the transfer
of the Siemens computers across the Strait of Hormuz to Bandar Abbas, a
major Iranian port.
Only months later, in June, Stuxnet began to pop up around the globe. The
Symantec Corporation, a maker of computer security software and services
based in Silicon Valley, snared it in a global malware collection system.
The worm hit primarily inside Iran, Symantec reported, but also in time
appeared in India, Indonesia and other countries.
But unlike most malware, it seemed to be doing little harm. It did not slow
computer networks or wreak general havoc.
That deepened the mystery.
A ‘Dual Warhead’
No one was more intrigued than Mr. Langner, a former psychologist who runs a
small computer security company in a suburb of Hamburg. Eager to design
protective software for his clients, he had his five employees focus on
picking apart the code and running it on the series of Siemens controllers
neatly stacked in racks, their lights blinking.
He quickly discovered that the worm only kicked into gear when it detected
the presence of a specific configuration of controllers, running a set of
processes that appear to exist only in a centrifuge plant. “The attackers
took great care to make sure that only their designated targets were hit,”
he said. “It was a marksman’s job.”
For example, one small section of the code appears designed to send commands
to 984 machines linked together.
Curiously, when international inspectors visited Natanz in late 2009, they
found that the Iranians had taken out of service a total of exactly 984
machines that had been running the previous summer.
But as Mr. Langner kept peeling back the layers, he found more — what he
calls the “dual warhead.” One part of the program is designed to lie dormant
for long periods, then speed up the machines so that the spinning rotors in
the centrifuges wobble and then destroy themselves. Another part, called a
“man in the middle” in the computer world, sends out those false sensor
signals to make the system believe everything is running smoothly. That
prevents a safety system from kicking in, which would shut down the plant
before it could self-destruct.
“Code analysis makes it clear that Stuxnet is not about sending a message or
proving a concept,” Mr. Langner later wrote. “It is about destroying its
targets with utmost determination in military style.”
This was not the work of hackers, he quickly concluded. It had to be the
work of someone who knew his way around the specific quirks of the Siemens
controllers and had an intimate understanding of exactly how the Iranians
had designed their enrichment operations.
In fact, the Americans and the Israelis had a pretty good idea.
Testing the Worm
Perhaps the most secretive part of the Stuxnet story centers on how the
theory of cyberdestruction was tested on enrichment machines to make sure
the malicious software did its intended job.
The account starts in the Netherlands. In the 1970s, the Dutch designed a
tall, thin machine for enriching uranium. As is well known, A. Q. Khan, a
Pakistani metallurgist working for the Dutch, stole the design and in 1976
fled to Pakistan.
The resulting machine, known as the P-1, for Pakistan’s first-generation
centrifuge, helped the country get the bomb. And when Dr. Khan later founded
an atomic black market, he illegally sold P-1’s to Iran, Libya, and North
Korea.
The P-1 is more than six feet tall. Inside, a rotor of aluminum spins
uranium gas to blinding speeds, slowly concentrating the rare part of the
uranium that can fuel reactors and bombs.
How and when Israel obtained this kind of first-generation centrifuge
remains unclear, whether from Europe, or the Khan network, or by other
means. But nuclear experts agree that Dimona came to hold row upon row of
spinning centrifuges.
“They’ve long been an important part of the complex,” said Avner Cohen,
author of “The Worst-Kept Secret” (2010), a book about the Israeli bomb
program, and a senior fellow at the Monterey Institute of International
Studies. He added that Israeli intelligence had asked retired senior Dimona
personnel to help on the Iranian issue, and that some apparently came from
the enrichment program.
“I have no specific knowledge,” Dr. Cohen said of Israel and the Stuxnet
worm. “But I see a strong Israeli signature and think that the centrifuge
knowledge was critical.”
Another clue involves the United States. It obtained a cache of P-1’s after
Libya gave up its nuclear program in late 2003, and the machines were sent
to the Oak Ridge National Laboratory in Tennessee, another arm of the Energy
Department.
By early 2004, a variety of federal and private nuclear experts assembled by
the Central Intelligence Agency were calling for the United States to build
a secret plant where scientists could set up the P-1’s and study their
vulnerabilities. “The notion of a test bed was really pushed,” a participant
at the C.I.A. meeting recalled.
The resulting plant, nuclear experts said last week, may also have played a
role in Stuxnet testing.
But the United States and its allies ran into the same problem the Iranians
have grappled with: the P-1 is a balky, badly designed machine. When the
Tennessee laboratory shipped some of its P-1’s to England, in hopes of
working with the British on a program of general P-1 testing, they stumbled,
according to nuclear experts.
“They failed hopelessly,” one recalled, saying that the machines proved too
crude and temperamental to spin properly.
Dr. Cohen said his sources told him that Israel succeeded — with great
difficulty — in mastering the centrifuge technology. And the American expert
in nuclear intelligence, who spoke on the condition of anonymity, said the
Israelis used machines of the P-1 style to test the effectiveness of
Stuxnet.
The expert added that Israel worked in collaboration with the United States
in targeting Iran, but that Washington was eager for “plausible
deniability.”
In November, the Iranian president, Mahmoud Ahmadinejad, broke the country’s
silence about the worm’s impact on its enrichment program, saying a
cyberattack had caused “minor problems with some of our centrifuges.”
Fortunately, he added, “our experts discovered it.”
The most detailed portrait of the damage comes from the Institute for
Science and International Security, a private group in Washington. Last
month, it issued a lengthy Stuxnet report that said Iran’s P-1 machines at
Natanz suffered a series of failures in mid- to late 2009 that culminated in
technicians taking 984 machines out of action.
The report called the failures “a major problem” and identified Stuxnet as
the likely culprit.
Stuxnet is not the only blow to Iran. Sanctions have hurt its effort to
build more advanced (and less temperamental) centrifuges. And last January,
and again in November, two scientists who were believed to be central to the
nuclear program were killed in Tehran.
The man widely believed to be responsible for much of Iran’s program, Mohsen
Fakrizadeh, a college professor, has been hidden away by the Iranians, who
know he is high on the target list.
Publicly, Israeli officials make no explicit ties between Stuxnet and Iran’s
problems. But in recent weeks, they have given revised and surprisingly
upbeat assessments of Tehran’s nuclear status.
“A number of technological challenges and difficulties” have beset Iran’s
program, Moshe Yaalon, Israel’s minister of strategic affairs, told Israeli
public radio late last month.
The troubles, he added, “have postponed the timetable.”
Posts
