Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon (33 page)

This expansion in government bug-hunting operations highlights an important issue that got little consideration when the DoD task force was first developing its offensive doctrine a decade ago, and that even today has received little public attention and no debate at all in Congress—that is, the ethical and security issues around stockpiling zero-day vulnerabilities and exploits in the service of offensive operations. In amassing zero-day exploits for the government to use in attacks, instead of passing the information about holes to vendors to be fixed, the government has put critical-infrastructure owners and computer users in the United States at risk of attack from criminal hackers, corporate spies, and foreign intelligence agencies who no doubt will discover and use the same vulnerabilities for their own operations.

As noted previously, when researchers uncover vulnerabilities, they generally disclose them to the public or privately to the vendor in question so that patches can be distributed to computer users. But when military and intelligence agencies need a zero-day vulnerability for offensive operations, the last thing they want to do is have it patched. Instead, they keep fingers crossed that no one else will discover and disclose it before they’ve finished exploiting it. “If you’ve built a whole operational capability based on the existence of that vulnerability, man, you’ve just lost a system that you may have invested millions of dollars and thousands of man hours in creating,” Andy Pennington, a cybersecurity consultant for K2Share said at a conference in 2011. Pennington is a former weapons-systems officer in the Air Force whose job before retiring in 1999 was to review new
cyberspace technologies and engineer next-generation weapons for the Air Force.
³⁸
“You are not going to hire teams of researchers to go out and find a vulnerability and then put it on the web for everybody to see if you’re trying to develop [an attack for it],” he later said in an interview.
³⁹
“We’re putting millions of dollars into identifying vulnerabilities so that we can use them and keep our tactical advantage.”

But it’s a government model that relies on keeping everyone vulnerable so that a targeted few can be attacked—the equivalent of withholding a vaccination from an entire population so that a select few can be infected with a virus.

Odds are that while Stuxnet was exploiting four zero-day vulnerabilities to attack systems in Iran, a hacker or nation-state cyberwarrior from another country was exploiting them too. “It’s pretty naïve to believe that with a newly discovered zero-day, you are the only one in the world that’s discovered it,” Howard Schmidt, former cybersecurity coordinator for the White House and former executive with Microsoft, has said. “Whether it’s another government, a researcher or someone else who sells exploits, you may have it by yourself for a few hours or for a few days, but you sure are not going to have it alone for long.”
⁴⁰

Certainly the .LNK vulnerability that Stuxnet used was already known by the Zlob banking gang in 2008, two years before Stuxnet used it. Information about the print-spooler vulnerability was also in the public domain for others to discover and use.
⁴¹
Who knows how long the other zero days Stuxnet used might have been known and used by others in different attacks? In 2007, Immunity, a security firm in Florida, determined that the average zero-day exploit survived in the wild 348 days before being discovered on systems. The ones with the longest life-span could
live in hiding for nearly three years.
⁴²
Today the situation isn’t much different, with the average life-span of a zero day now ten months, and others lurking in systems undiscovered for as long as two and a half years.
⁴³

Shortly after he took office in 2009, President Obama announced that cybersecurity in general and securing the nation’s critical infrastructure in particular were top priorities for his administration. But withholding information about vulnerabilities in US systems so that they can be exploited in foreign ones creates a schism in the government that pits agencies that hoard and exploit zero days against those, like the Department of Homeland Security, that are supposed to help secure and protect US critical infrastructure and government systems.

In his remarks at the 2011 conference, Andy Pennington acknowledged that there were “competing interests” in government when it came to the vulnerability issue, but he said when the government found vulnerabilities it wanted to exploit, it used “coordinated vulnerability disclosure”—a kind of limited disclosure—to “facilitate the defense of the United States” in a way that still allowed the government to retain the ability to attack. He said the DoD worked “very closely with Microsoft on the enterprise side,” as well as with the makers of control systems, to let them know about vulnerabilities found in their systems. “But I would like to stress again that the objective is to handle this … so that we can sustain operations,” he said. To that end, you would want to be “very deliberate [in] how you disclose it and how it’s fixed.”
⁴⁴
Though he didn’t elaborate on what limited disclosure involved, others have suggested it’s about providing information about vulnerabilities to DoD administrators—so they can take steps to protect military systems from being attacked—while still withholding it from the vendor and the public, to prevent adversaries from learning
about them. Microsoft also reportedly gives the government and private companies advance notice when it learns of new security holes found in its software, to help the government take steps to protect its systems before a patch is available. But this can equally serve as a handy tipoff to the NSA to retire any exploits already being used to attack that vulnerability—before Microsoft discloses it publicly—or, conversely, to quickly exploit machines using the vulnerability before it gets patched.
⁴⁵

Greg Schaffer, former assistant secretary of Homeland Security, told NPR that DHS, which helps protect the government’s nonmilitary systems, does occasionally get assistance “from the organizations that work on the offensive mission,” though he didn’t indicate if this meant sharing information with DHS about vulnerabilities so they could be patched.
⁴⁶
But “whether they bring their work [to us] is something they have to decide,” he said. “That is not something that we worry about.”

Another DHS official, however, says he can’t recall having “ever seen a vulnerability come to us from DoD in a disclosure.… We would like to have as many vulnerabilities disclosed and coordinated as possible to give us the best defensive posture.” But while it was frustrating not to get such disclosures, he recognized that it was “the nature of the beast” if the government was to still retain its ability to attack adversaries, and he didn’t see any way to resolve it.
⁴⁷

Though information about vulnerabilities might not get passed from the offensive side to the defensive side to be fixed, there were in fact times when vulnerabilities uncovered by the defensive side got passed to the offensive side. This might occur, for example, to make sure that a vulnerability in a control system already being exploited by the NSA or other agencies wasn’t disclosed and patched too soon. A former DHS official said that this “vulnerabilities equities process” for control systems, as it’s
called, began some time after the Aurora Generator Test was conducted in 2007. Since then, vulnerabilities that government researchers find in other control systems get vetted by an equities panel to make sure their disclosure won’t harm ongoing operations. “If someone is using it … under their authorities for a legitimate purpose … well, we’d have to balance the necessity of disclosing it based on the value of leaving it open for a while,” the former official said.

The equities process in government has a long tradition. In World War II, for example, when the British cracked Germany’s Enigma code and discovered that Allied convoys were being targeted by the Germans, they had to weigh the benefits of redirecting convoys away from attack—and thus risk tipping off the Germans that their code had been cracked—against the cost of sacrificing a convoy to continue exploiting a critical intelligence source.

The US equities process involves a central committee composed of representatives from multiple departments and agencies—DoD, Justice Department, State Department, Homeland Security, the White House, and the intelligence community—and is patterned after one developed by the Committee on Foreign Investment in the United States, known as the CFIUS process, which weighs the national security implications of foreign investments in the United States.

In the case of software vulnerabilities, if government researchers discover a security hole in a PLC that is commonly used, for example, they submit the finding to the committee to see if anyone has an equity interest in it. “Everyone has a say in the likelihood of impacts to companies or systems [from the vulnerability being disclosed or not],” the official said. “It’s all done via e-mail on a classified network, and everyone comes back and says yea or nay. And if there’s a yea, then we discuss it. If everything is nay, then we just go on our normal responsible vulnerability disclosure process.”

Asked if DHS ever passed information about vulnerabilities to the offensive side so that they could specifically be exploited, he said no. But he acknowledged that the very act of discussing vulnerabilities with the
equities committee might inadvertently provide members with ideas about new vulnerabilities to exploit. While he says he never heard anyone on the committee tell an industrial control system representative not to publicly disclose a vulnerability so they could exploit it, he acknowledged that they probably wouldn’t be so overt about it. “They would probably just silently take notes, and we may never ever know [if they developed an exploit for] it,” he said.