Ralph Langner: Cracking Stuxnet, a 21st-century cyber weapon

Prevoditelj: Eva Juretic Recezent: Zlatko Smetisko

The idea behind the Stuxnet computer worm

Ideja koja stoji iza Stuxnet računalnog crva

is actually quite simple.

zapravo je prilično jednostavna.

We don't want Iran to get the bomb.

Ne želimo da Iran proizvede atomsku bombu.

Their major asset for developing nuclear weapons

Njihovo je glavno sredstvo za razvijanje nuklearnog oružja

is the Natanz uranium enrichment facility.

Natanz postrojenje za obogaćivanje urana.

The gray boxes that you see,

Sive kutije, koje vidite,

these are real-time control systems.

jesu kontrolni sistemi.

Now if we manage to compromise these systems

Ako uspijemo onesposobiti te sustave

that control drive speeds and valves,

koji kontroliraju brzinu i ventile,

we can actually cause a lot of problems

možemo stvoriti puno problema

with the centrifuge.

s centrifugom.

The gray boxes don't run Windows software;

Sive kutije ne podržavaju Windows software;

they are a completely different technology.

one koriste posve drugačiju tehnologiju.

But if we manage

Ali ako uspijemo

to place a good Windows virus

staviti dobar Windows virus

on a notebook

na laptop

that is used by a maintenance engineer

koji koristi inženjer za održavanje sustava

to configure this gray box,

prilikom konfiguriranja sustava,

then we are in business.

na konju smo.

And this is the plot behind Stuxnet.

I to je pozadina Stuxneta.

So we start with a Windows dropper.

Započinjemo Windows "dropper" virusom.

The payload goes onto the gray box,

Virus uđe u sivu kutiju,

damages the centrifuge,

ošteti centrifugu

and the Iranian nuclear program is delayed --

i time odgodi iranski nuklearni program --

mission accomplished.

misija završena.

That's easy, huh?

Jednostavno, zar ne?

I want to tell you how we found that out.

Želim vam objasniti kako smo to otkrili.

When we started our research on Stuxnet six months ago,

Kada smo prije šest mjeseci započeli istraživati Stuxneta,

it was completely unknown what the purpose of this thing was.

svrha mu je bila potpuno nepoznata.

The only thing that was known

Jedino što se znalo

is it's very, very complex on the Windows part, the dropper part,

je njegov iznimno složen softverski dio, složen "dropper" dio

used multiple zero-day vulnerabilities.

te da koristi mnoge neotkrivene slabosti Windowsa.

And it seemed to want to do something

Činilo se kako želi nešto

with these gray boxes, these real-time control systems.

s tim sivim kutijama, odnosno s kontrolnim sustavom.

So that got our attention,

To je privuklo našu pozornost,

and we started a lab project

pa smo počeli s laboratorijskim projektom

where we infected our environment with Stuxnet

u kojem smo zarazili našu okolinu sa Stuxnetom

and checked this thing out.

i promatrali što se događa.

And then some very funny things happened.

Počele su se događati čudne stvari.

Stuxnet behaved like a lab rat

Stuxnet se ponašao poput laboratorijskog štakora

that didn't like our cheese --

koji nije želio naš sir --

sniffed, but didn't want to eat.

pomirišao ga je, ali ga nije htio jesti.

Didn't make sense to me.

To nije imalo smisla.

And after we experimented with different flavors of cheese,

Nakon što smo eksperimentirali sa sirevima različitih okusa,

I realized, well, this is a directed attack.

shvatio sam kako se radi o direktnom napadu.

It's completely directed.

Potpuno je režiran.

The dropper is prowling actively

"Dropper" se aktivno prikrada

on the gray box

sivoj kutiji,

if a specific configuration is found,

ako pronađe određenu konfiguraciju

and even if the actual program code that it's trying to infect

i ako se program kojeg pokušava "zaraziti"

is actually running on that target.

odvija na željenoj meti.

And if not, Stuxnet does nothing.

Ako ne, Stuxnet ne čini ništa.

So that really got my attention,

To je zaokupilo moju pažnju,

and we started to work on this

i počeli smo neprestano

nearly around the clock,

raditi na tome

because I thought, "Well, we don't know what the target is.

jer sam mislio "Dobro, ne znamo što je meta.

It could be, let's say for example,

Mogla bi to biti, primjerice,

a U.S. power plant,

američka nuklearna elektrana

or a chemical plant in Germany.

ili kemijsko postrojenje u Njemačkoj.

So we better find out what the target is soon."

Bolje nam je da što prije otkrijemo metu.

So we extracted and decompiled

Izdvojili smo i rastavili

the attack code,

šifru napada

and we discovered that it's structured in two digital bombs --

te smo otkrili da je sastavljena u dvije digitalne bombe --

a smaller one and a bigger one.

manje i veće.

And we also saw that they are very professionally engineered

Isto tako, shvatili smo da su ih vrlo profesionalno sastavili

by people who obviously had all insider information.

ljudi koji su očito imali informacije iznutra.

They knew all the bits and bites

Znali su sve sitnice

that they had to attack.

koje su morali napasti.

They probably even know the shoe size of the operator.

Vjerojatno su znali i veličinu cipela rukovaoca.

So they know everything.

Znali su sve.

And if you have heard that the dropper of Stuxnet

Ako ste čuli da je Stuxnetov program za instaliranje virusa

is complex and high-tech,

kompeksan i visoko tehnološki razvijen,

let me tell you this:

reći ću vam sljedeće:

the payload is rocket science.

on je zapravo "kvantna fizika".

It's way above everything

Daleko je iznad svega

that we have ever seen before.

što smo do sada vidjeli.

Here you see a sample of this actual attack code.

Ovdje vidite uzorak stvarne šifre napada.

We are talking about --

Govorimo o

around about 15,000 lines of code.

otprilikie 15 tisuća redaka programskog koda.

Looks pretty much like old-style assembly language.

Izgleda kao stari asemblerski jezik.

And I want to tell you how we were able

I želim vam reći kako smo uspjeli

to make sense out of this code.

shvatiti smisao tog programskog koda.

So what we were looking for is, first of all, system function calls,

Prvo smo tražili pozive funkcija sistema

because we know what they do.

jer smo znali što one rade.

And then we were looking for timers and data structures

Onda smo tražili vremenske zapise i strukture podataka

and trying to relate them to the real world --

i pokušali ih povezati sa stvarnim svijetom --

to potential real world targets.

s potencijalnim metama iz stvarnog svijeta.

So we do need target theories

Znači, ipak trebamo teorije o ciljevima

that we can prove or disprove.

kako bismo ih mogli dokazati ili opovrgnuti.

In order to get target theories,

Kako bi došli do teorija o ciljevima,

we remember

trebamo imati na umu

that it's definitely hardcore sabotage,

kako se sigurno radi o ozbiljnoj sabotaži,

it must be a high-value target

visoko vrijednom cilju

and it is most likely located in Iran,

koji se najvjerojatnije nalazi u Iranu

because that's where most of the infections had been reported.

jer je tamo prijavljen najveći broj zaraza ovim crvom.

Now you don't find several thousand targets in that area.

Nećete naći nekoliko tisuća meta u tom području.

It basically boils down

Načelno se to svodi

to the Bushehr nuclear power plant

na nuklearnu elektranu Bushehr

and to the Natanz fuel enrichment plant.

i na pogon za obogaćivanje goriva Natanz.

So I told my assistant,

Rekao sam svom pomoćniku,

"Get me a list of all centrifuge and power plant experts from our client base."

"Nabavi mi popis svih stručnjaka za centrifuge i elektrane iz naše baze klijenata."

And I phoned them up and picked their brain

Ja sam ih tada nazvao,

in an effort to match their expertise

te sam se potrudio ukopiti njihove spoznaje

with what we found in code and data.

s onim što smo našli u programskom kodu i podacima.

And that worked pretty well.

I to je funkcioniralo prilično dobro.

So we were able to associate

Uspjeli smo povezati

the small digital warhead

malu digitalnu bojnu glavu

with the rotor control.

s kontrolom rotora.

The rotor is that moving part within the centrifuge,

Rotor je ovaj pokretni dio unutar centrifuge,

that black object that you see.

crni objekt koji vidite.

And if you manipulate the speed of this rotor,

Ako manipulirate brzinom tog rotora,

you are actually able to crack the rotor

u mogućnosti ste slomiti rotor

and eventually even have the centrifuge explode.

i u konačnici postići eksploziju centrifuge.

What we also saw

Također smo vidjeli

is that the goal of the attack

da je cij napada

was really to do it slowly and creepy --

učiniti to sporo i jezivo --

obviously in an effort

očito u nadi

to drive maintenance engineers crazy,

da izludite inžinjere održavanja,

that they would not be able to figure this out quickly.

kako ne bi bili u mogućnosti naći rješenje u kratkom roku.

The big digital warhead -- we had a shot at this

Veliku digitalnu bojnu glavu -- imali smo priliku

by looking very closely

pomno promatriti

at data and data structures.

podatke i strukture podataka.

So for example, the number 164

Tako naprimjer, broj 164

really stands out in that code;

se zbilja ističe u tom kodu;

you can't overlook it.

ne možete ga previdjeti.

I started to research scientific literature

Počeo sam istraživati znanstvenu literaturu

on how these centrifuges

i otkrio kako su centrifuge

are actually built in Natanz

zapravo napravljene u Natanzu

and found they are structured

i saznao sam da su strukturirane

in what is called a cascade,

u tzv. kaskadu,

and each cascade holds 164 centrifuges.

od kojih svaka sadrži 164 centrifuge.

So that made sense, that was a match.

To je imalo smisla te se podudaralo.

And it even got better.

Čak je postalo bolje.

These centrifuges in Iran

Te su centrifuge u Iranu

are subdivided into 15, what is called, stages.

podijeljene u 15 tzv. faza.

And guess what we found in the attack code?

Pogodite što smo našli u kodu napada?

An almost identical structure.

Gotovo identičnu strukturu.

So again, that was a real good match.

Dakle, to je bila odlična podudarnost.

And this gave us very high confidence for what we were looking at.

To nam je dalo veliko samopouzdanje u ono što smo proučavali.

Now don't get me wrong here, it didn't go like this.

Nemojte me pogrešno shvatiti, nije išlo lako.

These results have been obtained

Ovi rezultati dobiveni su

over several weeks of really hard labor.

tijekom nekoliko tjedana zaista teškog rada.

And we often went into just a dead end

I često bi došli do mrtve točke i

and had to recover.

trebali smo se vratiti natrag.

Anyway, so we figured out

Tako smo shvatili

that both digital warheads

kako su obje digitalne bojne glave

were actually aiming at one and the same target,

zapravo usmjerene na jedan cilj,

but from different angles.

ali iz različitih kutova.

The small warhead is taking one cascade,

Mala bojna glava zauzima jednu kaskadu,

and spinning up the rotors and slowing them down,

okreće rotore te ih usporava,

and the big warhead

a velika bojna glava

is talking to six cascades

komunicira sa šest kaskada

and manipulating valves.

i manipulira ventilima.

So in all, we are very confident

Dakle jedino u što smo sigurni

that we have actually determined what the target is.

je da smo zapravo odredili što je cilj.

It is Natanz, and it is only Natanz.

To je Natanz, i to samo Natanz.

So we don't have to worry

Ne moramo se brinuti

that other targets

oko drugih meta

might be hit by Stuxnet.

koje bi mogle biti pogođene Stuxnetom.

Here's some very cool stuff that we saw --

Evo neke zgodne stvari koju smo uočili --

really knocked my socks off.

koja me zaista iznenadila.

Down there is the gray box,

Tu dolje je siva kutija,

and on the top you see the centrifuges.

a na vrhu vidite centrifuge.

Now what this thing does

E sad, ono što ta stvar radi

is it intercepts the input values from sensors --

je hvatanje ulaznih vrijednosti sa senzora --

so for example, from pressure sensors

tako da se na primjer, sa senzora za pritisak

and vibration sensors --

i senzora za vibraciju

and it provides legitimate program code,

stvara pravi programski kod

which is still running during the attack,

koji još uvijek radi za vrijeme napada

with fake input data.

s lažnim ulaznim podacima.

And as a matter of fact, this fake input data

Zapravo su ovi lažni ulazni podaci

is actually prerecorded by Stuxnet.

unaprijed snimljni od strane Stuxneta.

So it's just like from the Hollywood movies

To je baš kao u Hollywoodskim filmovima

where during the heist,

gdje za vrijeme pljačke

the observation camera is fed with prerecorded video.

sigurnosna kamera prikazuje prethodno snimljeni video.

That's cool, huh?

To je cool, zar ne?

The idea here is obviously

Ovdje očito ideja nije

not only to fool the operators in the control room.

samo zavarati operatere u kontrolnoj sobi.

It actually is much more dangerous and aggressive.

Zapravo je mnogo opasnija i agresivnija.

The idea

Ideja je

is to circumvent a digital safety system.

nadmudriti digitalni sigurnosni sustav.

We need digital safety systems

Trebamo digitalne sigurnosne sustave

where a human operator could not act quick enough.

tamo gdje ljudi ne mogu djelovati dovoljno brzo.

So for example, in a power plant,

Na primjer, u elektrani,

when your big steam turbine gets too over speed,

gdje velika parna turbina dobiva veliko ubrzanje,

you must open relief valves within a millisecond.

morate otvoriti ventile unutar milisekunde.

Obviously, this cannot be done by a human operator.

Očito da to ne može obaviti čovjek.

So this is where we need digital safety systems.

Stoga su tu digitalni sigurnosni sistemi zaista potrebni.

And when they are compromised,

A kada su kompromitirani,

then real bad things can happen.

mogu se dogoditi stvarno loše stvari.

Your plant can blow up.

Vaša elektrana može eksplodirati.

And neither your operators nor your safety system will notice it.

A ni vaši operateri niti vaš sigurnosni sistem neće to uočiti.

That's scary.

To je strašno.

But it gets worse.

I postaje još gore.

And this is very important, what I'm going to say.

Ovo što ću sada reći jako je bitno.

Think about this:

Razmislite o ovome:

this attack is generic.

ovaj napad je opći.

It doesn't have anything to do, in specifics,

Nema neke konkretne veze

with centrifuges,

sa centrifugama

with uranium enrichment.

niti s obogaćivanjem urana.

So it would work as well, for example,

Tako da bi mogao funkcionirao, na primjer,

in a power plant

u elektrani

or in an automobile factory.

ili u automobilskoj tvornici.

It is generic.

On je opći.

And you don't have -- as an attacker --

Ne morate -- kao napadač --

you don't have to deliver this payload

dostaviti virus

by a USB stick,

preko USB stick-a

as we saw it in the case of Stuxnet.

kao u slučaju Stuxneta.

You could also use conventional worm technology for spreading.

Možete koristiti i uobičajenu metodu zaraze računala putem crva.

Just spread it as wide as possible.

Samo ga proširite što je više moguće.

And if you do that,

Ako to učinite,

what you end up with

kao rezultat dobit ćete

is a cyber weapon of mass destruction.

virtualno oružje za masovno uništenje.

That's the consequence

To je posljedica

that we have to face.

s kojom se moramo suočiti.

So unfortunately,

Tako da nažalost,

the biggest number of targets for such attacks

najveći broj meta za takve napade

are not in the Middle East.

nije na Bliskom Istoku.

They're in the United States and Europe and in Japan.

One su u Sjedinjenim Američkim Državama, Europi i Japanu.

So all of the green areas,

Sva zelena područja,

these are your target-rich environments.

to su vaše mete.

We have to face the consequences,

Moramo se součiti s posljedicama,

and we better start to prepare right now.

i bolje nam je da se odmah pripremimo na njih.

Thanks.

Hvala.

(Applause)

(Pljesak)

Chris Anderson: I've got a question.

Chris Anderson: Imam pitanje.

Ralph, it's been quite widely reported

Ralph, poprilično je zastupljeno mišljenje,

that people assume that Mossad

ljudi pretpostavljaju da se Mossad

is the main entity behind this.

krije iza svega.

Is that your opinion?

Dijelite li i Vi to mišljenje?

Ralph Langner: Okay, you really want to hear that?

Ralph Langner: U redu, stvarno želite čuti?

Yeah. Okay.

Da, onda uredu.

My opinion is that the Mossad is involved,

Moje mišljenje je da Mossad je umiješan,

but that the leading force is not Israel.

ali Izrael nije vodeća sila.

So the leading force behind that

Vodeća sila koja stoji iza svega

is the cyber superpower.

je virtualna supersila.

There is only one,

Samo je jedna takva,

and that's the United States --

Sjedinjene Američke Države --

fortunately, fortunately.

na sreću.

Because otherwise,

U protivnom

our problems would even be bigger.

naši bi problemi bili još veći.

CA: Thank you for scaring the living daylights out of us. Thank you, Ralph.

CA: Hvala vam što ste nas tako isprepadali. Hvala, Ralph.

(Applause)

(Pljesak)