29 ms·
The Stuxnet worm may be the most sophisticated software ever written
- stochastic_monk 8y agoAnd to think that a combination of decades of diplomatic work and years of one of the most sophisticated cyberattacks were entirely thrown away by capricious, corrupt politicians.
- gadders 8y agoThe JCPOA?
- stochastic_monk 8y agoExactly.
- swarnie_ 8y agoSo.... For people who have followed this story more closely then i have, did the hostile actor ever get identified? Last i checked it was a toss up between USA, Israel and France, was a conclusion ever drawn?
- stochastic_monk 8y agoThe current belief is that it was a joint effort between at least Israel and the USA.
- cerebrum 8y agoConsidering that Israel is the nation always mongering war against Iran I second you.
- aplummer 8y agoReally? You mean Iran doesn’t mind the odd chlorine attack on civilians in Syria Iran? There are definitely two sides to this but yours isn’t one.
- gadders 8y agoWell, to be fair, Iran is trying to build a nuclear weapon and wants to wipe out Israel.
- jjoonathan 8y agoIsrael has nukes and is trying to build an excuse to wipe out Iran (without incurring internal or international wrath).
- placebo 8y agosource/citation (not so much for the nukes, but for wanting to wipe out Iran)?
- Udik 8y agoIsraelis don't want to wipe out Iran (as much as Iran doesn't want to wipe out Israel- I think they have a more generic aspiration to the end of what they call Israeli regime)- but they surely want a weak, divided, impoverished Iran, and they have been lobbying the US for a long time to wage war against it. The US unilateral withdrawal from the nuclear agreement has been in Israel's wishlist for years. Not because it improves the chances of peace or because it makes Iran less of a threat- quite the opposite. But because it weakens it and improves the chances of a war.
- stef25 8y agoWithout wanting to get in to Middle East political discussions, I don't think anyone there wants to sincerely "wipe out" another nation. The consequences would just be brutal and wouldn't be worth it. I think Israel is much more in the business of targeted strikes on personnel and infrastructure to keep their enemies in check, something they're very capable of.
- stirlo 8y agoIt was leaked to the New York Times (sanctioned leak?) that it was a collaboration of USA and Israel. Not sure where France comes into it...
- zxcmx 8y agoThe film “zero days” is an entertaining take on exactly this subject.
- TelAvivHacker 8y agoIf anything, France would be helping Iran. I don't think they had anything to do with this.
- omribahumi 8y agoI wonder how many people worked on this, and for how long
- sametmax 8y agoIt's probably not a single project, but the insights of many projects for years, finally merged on one that took a long time as well.
- omribahumi 8y agoFor the 0days, probably. But even the integration is impressive.
- kchr 8y agoI think devising this plan altogether was a huge investment in time and patience. Consider the social engineering feats needed to get your hands on the driver signature cerificates, for example. And that's just one step in the entire sequence of lateral movement.
- fapjacks 8y agoI've been arguing about this for the last three days. Mostly around the reason that "complexity" is not strictly the same thing as "sophistication" when it comes to software. Noobs will conflate the two, but experienced programmers will agree that -- just to illustrate my point -- some code which solves a complex problem in a very clever way while also being very clean and easy to maintain will be considered strictly more sophisticated than some other code solving a similar problem which simply has a higher degree of complexity than the former. There is a subtle difference when it comes to software, and this subtlety needs to be considered in this question. Now, I think Stuxnet is a fantastic suggestion to this question, for a number of reasons: 1) The legal, ethical, technical challenges of creating the software. 2) The ability of the software to remain hidden in (sophisticated) environments rich with (sophisticated) organizations looking for exactly this kind of thing. 3) The stealth of the entire research, design, development, and deployment phases of the project. 4) The highly specialized nature of the target. 5) The scale of the entities involved. 6) All of this sophistication and we can't even see the source code (decompilation doesn't count). This is frankly some impressively sophisticated software. Also, incidentally, the Quora poster's company looks like a fun place to work (with good programmers on the team). Some of his other answers are thoughtful and interesting to read, too, if you get the chance.
- omribahumi 8y agoI want to second this. The things I wrote throughout my career that I'm most proud of aren't very complex. I find it very satisfying to understand a problem so well, up to the point you can find a simple and elegant solution to it. It makes the solution easier to reason about with other team members, and easier for the team to maintain it later. I see this as making your domain expertise available as a framework for the other team members. This is my idea of sophistication in the software development world.
- AmericanChopper 8y agoSimplicity is always a sign of a quality solution. I’m not sure why anybody would ever conflate complexity with quality or sophistication. I wrote some very complex code in college, but it wasn’t very high quality.
- danielh 8y agoIf this short read piked your interest in Stuxnet, I can recommend the book "Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon". It explains in great detail how Stuxnet worked and, which I found the most exciting, how it was discovered and reverse engineered.
- kikowi 8y agoIf you are not a book type of person, I recommend watching the movie Zero Days :)
- Fifer82 8y agoThanks, I always enjoy HN recommendations for books. Even better there is an Audio Book version!
- purrcat259 8y agoI read this book a while ago. Whilst I enjoyed the multiple viewpoints it provides (some claim that Stuxnet was actually quite sloppily written, depending on numerous factors), it happened to be one of those books which wrote 100 pages worth of information in 400 pages instead and dragged every little point on. YMMV.
- danielh 8y agoIf you read this book purely for its informational value, I agree with your assessment. That being said, I read it mostly for entertainment and I think the author did a good job of packaging a lot of factual information into a captivating story. That being said, not all parts are created equal. There are quite a few pages dedicated to looking at the number of centrifuges Iran was installing and amount of gas they enriched, as this were the metrics Stuxnet was affecting. To me, that was as exciting as reading a company's monthly inventory report. But I guess that's to be expected in a book that tells a true story instead of just being based on true story.
- saagarjha 8y ago> This driver was digitally signed by Realtek > that driver started signing it with secret keys from JMicron I think this is the scariest part of the worm. Not only do the people writing it have access to zero-days, they also somehow have (possibly physical) access to the private keys of two large corporations.
- sneak 8y agoTry not to think about how many SREs in the big five are likely receiving a second secret paycheck from Langley and/or Fort Meade.
- dboreham 8y agoInteresting. This is the first time I've seen a public comment anywhere about a strong suspicion I've held for more than 20 years.
- sneak 8y agoIt seems obvious to me. Want to illegally snoop on someone’s iMessages? Don’t compromise Tim Cook’s plausible deniability, just get an asset to climb the ladder until they can touch the systems that send the list of keys to the target device. Same goes for signing malware binaries for evil maid against iOS devices, chromebooks, et c. There are controls you can put in place as an organization to make this harder, but not impossible; eventually human beings are going to be handling keys and senior management isn’t always going to be in the room to make sure NSLs aren’t being handed out. “Keep this quiet or go to the same jail in which Manning was tortured basically to death” is a pretty persuasive argument. The fact that Google was asleep at the wheel so long wrt encryption of internal network WAN links (I mean, wikipedia has an article about the double-hull sub that the navy uses to tap intercontinental fibers) suggests to me that most Googlers (and despite organizational differences, also most Apple and FB and Amazon staff (outside of govcloud)) simply aren’t thinking about the illegal lengths to which the military will go to obtain huge amounts of information about possible threats to their safety, security, or persistence methods (e.g. whistleblowers). It’s like the industrial rank and file never read the military-industrial complex speech, even while hearing their bosses take off from Moffet using taxpayer jet fuel. [1] [1] https://www.wsj.com/articles/google-jet-fleet-loses-a-nasa-fuel-perk-1379018371 https://www.wsj.com/articles/google-jet-fleet-loses-a-nasa-f...
- sneak 8y agoStuxnet was able to be reverse engineered successfully so that we can know these things. IIRC, its sequel actually used certain directory listings (registry keys or filesystem) of a target system as input to a KDF that is used to generate an AES key that is used to decrypt the next stage payload. That is, if you don’t have the exact specific system configuration that is being targeted (program names, versions, et c) then the primary function of the worm remains entirely opaque.
- bflesch 8y agoWould it have been easier or harder to implement Stuxnet if the target networks were running some sort of linux? Or if it would've been a mac-only facility? I'm curious.
- Tepix 8y agoShort version: Some things would be easier, others harder.
- Piskvorrr 8y agoSmaller platforms (which Linux and Mac OS are, compared to Windows) draw less interest (both in exploits and scrutiny against exploits), and fragmented platforms (Linux) are harder to code for (SystemV? systemd? something else entirely?). I guess that it would have required more effort - but at this level of involvement, I would say that the result would have been achieved regardless.
- wepple 8y agoThe stuxnet dev team managed to get their hands on the exact same centrifuges as used in Natanz, so getting replica Linux control systems would’ve been a walk in the park. Also, “less interest” is irrelevant when we are talking about nation states picking a specific target and throwing considerable engineering resource at exploitation.
- chatmasta 8y agoLinux and Mac have bugs just like Windows. The only reason they have a reputation of being safer is because windows dominates marketshare, so any "spray and pray" type virus will naturally target windows over mac/linux. On the other hand, if you or your organization is the victim of a targeted hack, it makes no difference what OS you're running. Any sufficiently motivated and skilled attacker will eventually find a way to exploit it. As long as new software continues to be released, there will always be bugs. There is no security panacea.
- diffeomorphism 8y ago
- diminish 8y agoTLDR; a team of state-sponsored developers & engineers with access to a huge list of vulnerabilities across windows, drivers and industrial equipment designed a worm to malfunction centrifuges used in uranium enriching with multiple hops of infection and stealth mode of operation. Don't get me wrong, but "sophisticated" doesn't exactly mean obscure and stealth which is what stuxnet worm is all about. With access to all those vulnerabilities, i would call the worm implementation straighforward & stealth rather than sophisticated. Most likely the engineers didn't have much choice than to proceed in one possible way to be able to make it work. If one of the vulnerabilities didn't then stux.net wouldn't exist.
- deleted 8y ago[deleted]
- thedancollins 8y agoThe respect comes with the single-mindedness of this code's approach. You would think the people doing this would have at least a little bit of The Joker in them - if they saw an opportunity to cause chaos for chaos' sake they tend to take it. Whoever did this - didn't. That is impressive focus.
- sneak 8y agohttps://en.wikipedia.org/wiki/Operation_Olympic_Games https://en.wikipedia.org/wiki/Operation_Olympic_Games It’s not really a secret anymore.
- lol-lol 8y agoI would argue that this one was more sophisticated: http://pferrie.tripod.com/papers/zmist.pdf http://pferrie.tripod.com/papers/zmist.pdf What I am seeing lately with malware is increasing decline in sophistication, today malware is lame compared to the malware created around 2000. I would think that level of low level knowledge is rapidly dropping. When there were still real file infectors, there were some serious nasty technologies involved (btw, todays ransomware is a very old concept (http://virus.wikidot.com/onehalf http://virus.wikidot.com/onehalf) but it was used to prevent virus removal instead of making money).
- ktpsns 8y agoMaybe it is the other way around: Todays malware (or a portion of it) is written so good that you don't know about it. Maybe someday another whistleblower will let us know.
- rollulus 8y agoI agree. Mistfall (and z0mbie himself) was years ahead of its time. For those not aware of Mistfall: typical viruses simply append their code to the target. To avoid detection, polymorphism was introduced: viruses generate permutations of decryption logic for the actual static but encrypted virus body. The next step was metamorphism: the virus body itself got permuted. Mistfall was one step further: it disassembled the host, merged in its own permuted body and rebuilt the host. Here is an article by the author himself [1]. This was in 2000. In general, before hacking and cybercrime became a commercial activity, there was a lively virus writing scene, where highly skilled people played the cat and mouse game with anti virus producers, created magazines with the sources of their creations and wrote articles. Too bad that z0mbie disappeared. Sometimes when news about elite Russian hackers hits the news I wonder if it's him. [1]: http://z0mbie.daemonlab.org/autorev.txt http://z0mbie.daemonlab.org/autorev.txt
- lol-lol 8y agoPeople are still keeping mirrors of 29a :) http://dsr.segfault.es/stuff/website-mirrors/29A/ http://dsr.segfault.es/stuff/website-mirrors/29A/ And mirror of z0mbie (mistfall author) site http://z0mbie.daemonlab.org/ http://z0mbie.daemonlab.org/ I am really interested what happened with z0mbie... he just vanished at some point...
- vbsteven 8y agoThe scary thing about this is: Stuxnet is one of the "most sophisticated" pieces of malware we have discovered up until now. Who knows what kinds of software are still out there quietly doing their thing in the shadows.
- nathanm412 8y agoWe're quickly heading toward the age of the first Virtual WMD. The implications can be as wide as your imagination, but possibly worse than existing WMDs.
- Harvey-Specter 8y agoI'm having a hard time imagining a virtual WMD that is worse than the instant obliteration of millions of people.
- Omnus 8y agoPresumably the person you replied to is including the potential takeover of nuclear weapons by terrorist hackers, etc.
- Harvey-Specter 8y agoI would consider that to be an 'existing WMD' rather than some new 'virtual WMD'
- Clubber 8y agoThink of controllers for say a dam, or an autopilot system in a jet.
- Harvey-Specter 8y agoHow would either of these be worse than a nuke going off in Hong Kong or NYC?
- andrelaszlo 8y agoWhat do you think, are the authors of Stuxnet reading Hacker News? I wonder how tempting it is to comment, and what the repercussions would be.
- askmike 8y ago"throwaway account for obvious reasons - I'm a devops for the C&C servers. Our process is actually quite similar to most other tech companies. We spend half our time arguing over what programming language to use (node/go/rust) and the other half arguing over whether we should use microservices."
- Clubber 8y agoI assume you spend a lot of time getting the SME to clarify what the hell they mean by "such and such," as well. :)
- bhouston 8y agoOf course at least a few of them are reading Hacker News. I understand from the Snowden files that the teams are moderately large and then run for years. So there were likely many dozens of software developers who contributed to Stuxnet.
- titzer 8y agoMy guess is no, for maximal compartmentalization. They have a treasure trove of exploits and they grab one off the shelf and might need to burn it after they use it. I bet the people finding vulnerabilities have no clue how they end up getting used. Stuxnet probably got the top shelf attack vectors, and they were burned.
- LargeWu 8y agoI wonder how many people have Stuxnet on their devices to this day and have no idea. It would be interesting to see how this spread, from an epidemiological standpoint.
- veddox 8y agoA very nice writeup of Stuxnet, although plainly intended for a lay audience... Shame the author didn't mention Flame (or any of the other since-discovered super-viruses) at the end.
- ssijak 8y agoAnd then people make a fuss about Russia "hacking" the election with some dumb Facebook ads which cost less than maxed out Ford Mustang. When on the other hand we have the state-sponsored military grade/purpose viruses used to attack other nations/regions (Flume attacked a large number of targets and countries) and nobody blinks an eye.
- beager 8y agoThose are indicative of the public’s enduring lack of technology literacy, and the media’s desire to have facts and eyeballs meet halfway. Media reports Russian election interference via digital ad spend, astroturfing, and infiltration attempts on state voting systems accurately, but the views to that reporting probably pale in comparison to the oversimplified, tweet-size “Russia hacked the 2016 US election” reporting that gets around more quickly and sticks in the public conversation. Stuxnet is considerably more sophisticated and technologically more brazen, but won’t get the same reporting. But it’s also worth it to consider whether the lack of awareness/awe over Stuxnet vis a vis Russian election tampering is simply due to technology illiteracy, or whether media is not considering the notability of the means, just the effect of the ends.
- titzer 8y agoTo me the astro-turfing--which is still going on btw--is the most impressive/scariest part of the whole thing. It basically means there is a constant undercurrent of motivated Russian trolls tipping the scales of perception on every single news story, online poll, comments section, social platform, clickbait site, etc. It basically means that the internet is even more a reality distortion field than we imagined, and there is no real bottom. Imagine hooking up decent conversational AIs to do this, and scaling this all the way up to drown out the real conversation.
- baursak 8y ago> But it’s also worth it to consider whether the lack of awareness/awe over Stuxnet vis a vis Russian election tampering is simply due to technology illiteracy, or whether media is not considering the notability of the means, just the effect of the ends. No, it's because the media is ultimately subservient to power regardless of what they might think of themselves. US attacks on countries designated by power as enemies -- Iran, Venezuela, Russia, etc., are only to be discussed in clinical terms, marveling at their technological sophistication, for example, never in moral terms. Bringing up any introspection of what American reaction would be if Iran did the same thing to us is virtually career suicide for a mainstream media professional. Trying to draw parallels between Russia meddling and Stuxnet, noting that Stuxnet was an attack many times worse, is cutting it dangerously close.
- Yajirobe 8y agoI have a question. Since the worm travels from USB to USB, does that mean that it infected thousands (or more) of regular people USBs but did nothing, until it found itself in a purity facility? Or was the worm somehow directly sent (physically or digitally) to the facility?
- syeaj 8y agoIIRC, there was an agent who brought the stick into the facility. Also, read this: https://www.theguardian.com/world/2012/jan/11/iran-nuclear-chemist-killed https://www.theguardian.com/world/2012/jan/11/iran-nuclear-c...
- stef25 8y agoA usb drive discreetly dropped in the parking lot, labelled cat memes would probably do the trick
- baud147258 8y agoAre cat memes popular in Iran too?
- cptskippy 8y agoCat memes transcend cultural boundaries.
- baud147258 8y agoThank you, I didn't know, I haven't crossed a lot of boundaries.
- ralphhughes 8y agoYes. At the time I was a contractor in southern Azerbaijan (borders Iran) and our pendrives were infected.
- wepple 8y agoYeah, most worms like this have detective capability to work out whether they’re on the systems that they’re wanting to be on. If not, they’ll either try to clean up and vanish or just serve for further propagation. Stuxnet was discovered because it accidentally spread too far, and ended up on a malware analysts desk. There was a targeted supplier, an upstream vendor as the insertion point, but it spread outside of that chain.
- jquinby 8y agoI thoroughly enjoyed this writeup as well: https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf https://www.langner.com/wp-content/uploads/2017/03/to-kill-a... Appendix C is my favorite part: a look at all the things that can be gleaned from television footage of the facilities, brief glances at control screens, etc.
- realworldview 8y ago_When that USB drive is inserted into a Windows PC, without the user knowing it, that worm will quietly run itself, and copy itself to that PC._ Truly magical. Anthropomorphism and personification help continue the myth of sentient, usually evil, software. Whilst scaring the heebie jeebies out of everyone.
- Y_Y 8y ago>"run itself" I find that misconception worse!
- mjw1007 8y agoIs it still believed that Stuxnet was never intended to escape and infect machines worldwide? If so, I think that blunder deserves to be a more prominent part of the story.
- jacksmith21006 8y agoMore sophisticated than self driving car software?
- olfactory 8y agoConsidering that we have known about Stuxnet for nearly a decade, why are we still using OS technology that makes such changes/intrusions/phoning-home so easy to conceal?
- kchr 8y agoBecause people keep requiring an interface to the machine...
- nihil75 8y agowriter has no idea how worms, exploits & antivirus programs work.
- vazamb 8y agoI highly recommend "Avogadro Corp: The Singularity Is Closer Than It Appears" by William Hertling to anyone interested in some good AI scifi around computer worms/virus.
- dandare 8y agoThe other day I had an argument with a proponent of online voting. As a non-techie, he could not understand my security concerns. In his laic view, we all use internet banking every day and nobody stole all the money yet, right?
- mportela 8y agoJust show him or her this video https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI
- stordoff 8y agoFor me, there is a fairly clear argument that works - online banking, you will know if there is a problem (the money is gone), online voting, you might not even _know_ it was compromised (in a close election, skewing a few percent of the votes could change the results without it being significantly different to the polls).
- Dolores12 8y agoSo stuxworm is more sophisticated than an OS its written for? Sounds ridiculous.
- trumped 8y agoMaybe because sometimes it can be relatively easy to to write some software, but much harder to find its bugs and write exploits for them? otherwise, why would bugs even exist?
- Dolores12 8y ago>why would bugs even exist people make mistakes, it is innate feature of human being. Bugs exist because it is not economically effective to find them. Bugs, given unlimited amount of resources, is possible easy to find whenever they are. Google how one guy hacked infamous HackingTeam alone. He provided some estimates how long it took him. Does it make his software the most sophisticated one on the planet? If his software is the most sophisticated, can he develop Windows alone?
- vinayms 8y agoI am just your average software dev with zero knowledge of malware creation, speculating here, and might come across as a fool. The author sensationalizes the effort of the creators, painting a Holywoodesque scenario where they break into every possible software company to steal keys to misrepresent the software, going undetected by every possible security company etc. Since this is a Quora post, I can live with him playing to the gallery. Given the amount of speculation of involvement of US and Israeli intelligence agencies, and the task this worm was assigned, the real effort might have been just about writing a USB worm that identifies specific machines and handing the USB-0 to a double agent (I stopped watching Homeland after season 5 and am rusty with the jargon). The rest of it would have been simply asking all the associated software and hardware companies, politely, to cooperate. If any of this is true, stuxnet is anything but sophisticated. Its just lots and lots of specific API calls. That brings up the question: what is sophistication as applied to software?
- iand 8y agoThe sophistication is to do all this while remaining completelt undetected in a highly secure environment. Iran didn't find Stuxnet, it was stumbled over by Kaspersky Lab.
- 0x00000000 8y agoThat is a huge oversimplification. Do yourself a favor and read this http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf http://www.symantec.com/content/en/us/enterprise/media/secur... or just the 'Executive Summary' if you don't want to read the whole thing
- xmodem 8y agoYou should read "Countdown to zero day"[0]. Some of the measures that were taken exceeded what anyone in Hollywood could ever imagine. [0]: https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196 https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp...
- mykull 8y agoJust addressing the last thing you said, I think sophistication has to do with the level of knowledge required to implement. Whether that means knowledge politely asked for or through other means has implications for the difficulty of implementation but perhaps not sophistication of the software.
- 4llan 8y ago"Zero Days" documentary is focused on Stuxnet. https://www.imdb.com/title/tt5446858/ https://www.imdb.com/title/tt5446858/
- lossolo 8y agoI highly recommend this documentary, it explains step by step how stuxnet was found, how it was debugged (by people that debugged it) and how it was used.
- indescions_2018 8y agoStuxnet changed history. Any "game of chicken" style equilibria is broken if the probability a nuclear actor's command and control drops below 100%. If there is even a 1% chance that when a Big Red Button is pushed the missiles fail to launch the game becomes unwinnable. Simulations of imperfect information in dynamic brinkmanship where both players are known to have advanced cyber capabilities results in a single dreaded endgame: general nuclear exchange. Thermonuclear Cyberwar https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2836208 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2836208 We have moved into uncharted domains. And herein lie demons. Past Rules of Engagement universally agreed upon regarding the use of kinetic weapons no longer apply. For wiser heads to prevail in the current global climate, the voice for peace must become the loudest one. Rules of engagement for cyberspace operations: a view from the USA https://academic.oup.com/cybersecurity/article/doi/10.1093/cybsec/tyx003/3058505 https://academic.oup.com/cybersecurity/article/doi/10.1093/c...
- organicmultiloc 8y agoThe problem is not everyone on the world stage is a rational game theory nerd that links to papers like we want them to be. Also 60 years of treating every other country as a box in a threat model to be manipulated against other boxes has been a completely unmitigated disaster, so maybe we should stop that.
- ams6110 8y ago> 60 years of treating every other country as a box in a threat model to be manipulated against other boxes has been a completely unmitigated disaster Has it? The last 60 years have been relatively peaceful, by historical standards.
- Cthulhu_ 8y agoThe world also became a lot more connected, so we're exposed a lot more to wars and such abroad, and we've matured morally speaking and can see that all wars are unnecessary.
- hsnewman 8y agoThis is pure opinion. I've heard that the code for bitcoin is pretty complex too. But since this opinion, it's all a debate. I kind think the linux kernel or Windows OS might be in the running too.
- cptskippy 8y ago> This driver was digitally signed by Realtek, which means that the authors of the worm were somehow able to break into the most secure location in a huge Taiwanese company, and steal the most secret key that this company owns, without Realtek finding out about it. > Later, whoever wrote that driver started signing it with secret keys from JMicron, another big Taiwanese company. Yet again, the authors had to figure out how to break into the most secure location in that company and steal the most secure key that that company owns, without JMicron finding out about it. Oh come on... "most secure location"? I'd wager it would be harder to break into the janitor's closet and steal his toilet paper supply than it would be to get those signing certs. If this was most companies it was stored on a public file share used by software engineers or in an open source control repository. They either got someone hired as a contractor or bribed an engineer they found on LinkedIn a couple thousand dollars.
- LeonM 8y agoThat's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet that they somehow had access to the HSM, to have it sign the driver for them. Companies of this size are audited regularly, so access to the HSM is expected to be strictly controlled. So yes, it is a pretty secure location, and a highly guarded secret. The fact that they pulled it of to break into not one, but two of those secrets is extremely impressive on it's own.
- tscherno 8y agoThat`s how it should work in theory, in practice it was most likely how the parent has described it.
- titzer 8y ago> I'd bet that they somehow had access to the HSM, to have it sign the driver for them. Or were able to duplicate the HSM before it was delivered. You know, like how the NSA intercepted shipments of internet routers in transit and inserted backdoors.
- zer0gravity 8y agoIf you come to think at it, this "worm" is really a form of life, with a certain degree of intelligence, I might add. Just like a biological virus, it replicates itself, it hijacks a pretty secure environment, like a cell, and uses it, first to replicate even more, and second, to alter its behaviour in order to accomplish its "goals", meaning deeply hidden instructions that only activate, and this is amazing, only in certain conditions, just how a certain piece of DNA is only activated in certain conditions in the cell. The intelligent part, in a more humane uderstanding of the term, comes when it is able to act and update in a distributed fashion orchestrated by a central command and control. This is not just a sophisticated form of software. This is a sophisticated form of life, albeit a distructive one.
- ankurdhama 8y agoSo sophistication == Exploiting dozens of Windows zero day exploits.
- mariusmg 8y agoI bet it was a bitch to debug and test it :)
- daenz 8y agoI want to do this.
- agumonkey 8y ago- windows security is not Uranium HD Ready /s - remember systems evolve, these failures aren't hard to harden, both at the electromechanical and human level. - raw network and electronic activity can be monitored - is there a way to render MITM UI (the fake display loop) impossible ? a feedback loop pc -> devices, and if deltas are too high ALERT ? ps: is IBM refining radioactive material ? ;)
- ufmace 8y agoIMO, the sophistication of the final worm that made it out to security researchers doesn't have anything on the process that must have been used to develop it. Take the normal iterative development process, except that: You don't know anything at all about the design of your targeted system and networks. Even getting a little information about it requires writing sophisticated malware, using various spy capers to get the malware near the target systems, and somehow exfiltrating data from airgapped systems over the internet, where the whole mission is blown if anyone detects your data movement. You may need dozens of iterations of adjusting the software to try and dive a little bit deeper, getting it snuck into the target systems (hopefully by a built-in update over the net), gathering information on the network architecture, then exfiltrating that data back out. Always a tough balance of spread-happy enough to infect highly protected airgapped systems in a top-secret facility, but not so spread-happy to get out on the open net and infect half of the world, where it will inevitably be discovered eventually. This is probably where they eventually screwed up. How long to detect that they're using this particular model of PLC with this particular centrifuge, buy your own copy of them, dig up someone who actually knows about these things, collaborate with them to figure out a sneaky way to screw things up just a little bit, build ways to get your virus onto the target system to do its damage, etc. I'd assume that there was a team somewhere with a big library of zero-day exploits and a bunch of ace developers, but no starting knowledge of the target. Someone gave them the order to figure out a way to hack and screw up the Iranian nuclear program, maybe with the helper that some other org has a guy that can deliver any product near the program. They must have spent years devising ways to get in, slowly gathering info about their target, figuring out a way to achieve the assigned goal of screwing things up without getting detected. Now that would be a hell of a project to work on.
- hunterjrj 8y ago>You don't know anything at all about the design of your targeted system and networks. >They must have spent years devising ways to get in, slowly gathering info about their target, figuring out a way to achieve the assigned goal of screwing things up without getting detected. I'd speculate that given who the intended targets were (Iran, North Korea) and who would have an interest in disrupting their enrichment operations (Israel, US), and given the level of intelligence gathering activity that both of these nation can (and ostensibly do) engage in, that the team tasked with creating this virus had plenty of information to go on from the start. Centrifuge models with firmware revision, network topologies, deployed server configuration, etc were likely known in advance.
- srcmap 8y agoIf someone adds a layer to OS's file system such as only the know good white list app, exe, .so, .dll, .sys files with complete crypto-hash signatures are allowed to run in "lockdown" mode. Everything else are reported and blocked. Would it be enough to prevent such worm? It would be interesting exercise to take an old exploitable OS (Win XP, or 10 years old Linux with known issue) add such layer to it. Put it on internet as honeypot and see what other kind of inflections it might get.
- TACIXAT 8y agoDepending on the hash, an attacker would look for collisions to get something running that could then change settings or launch other things. Failing that, you would look for flaws in the system or vulnerabilities in the OS in order to bypass it. Going deeper you run into trusted computing issues, of how do you know the verification firmware hasn't been tampered with? The simplest approach though is if you're running Chrome, and I exploit Chrome, I'm now running as Chrome and could persist in memory at least until you shut down.
- gayfakenews 8y agofuck off
- gayfakenews 8y agoinfecting only targeted plants was half of its goal you dumb ass.Your infomation is shit. Where did you get your info from it is written like 99% of bs click bait papers. Look at securelist instead of this shit
- gayfakenews 8y agoYou didnt even dive into the varients which had different uses and exploits. Fucking hell. Harvard my asshole. Where did you get your fakes from? спп?
- gayfakenews 8y agoalso if you think this is sophisticated i feel sorry for you. Obviously have a lack of knowledge of how these things work. It was heavy state malware, yeah. Other state spons. malware does the same. Example, some in ukraine target power grids. Anyways big words for little things. Only real fame is massive left tard media coverage
- gigatexal 8y agoI don’t have the expertise to understand if this article is hyperobolic but it was the first article I have read in a while start to finish. The author should try his hand at fiction.
- igravious 8y ago1: What is sophisticated for a non-state actor may be semi-trivial for a state actor. Why? State actors demand access to the source code of proprietary software; state actors circumvent laws that bind mere mortals like ourselves. If you own the playing field that which is sophisticated for even the most competent and knowledgeable coders may be semi-trivial for the spooks. 2: In my opinion Stuxnet is an act of war. If Iran doesn't consider itself to be at war with Israel and the US (even though there has been no formal declaration of war) then they are not thinking straight. If I were to enrich uranium I wouldn't let a Windows PC within a mile of the centrifuges, I'd only use locked down versions of Linux.
- wepple 8y ago> State actors demand access to the source code of proprietary software So, when China or Russia are building windows exploits, they just demand Microsoft hand over source? Also, the idea that “locked down” Linux would do any better than windows is ridiculous. The Linux codebase is enormous and complex and full of bugs. At least if you’d said some type of high security microkernel, you could put forward forward some logical arguments.
- igravious 8y ago> So, when China or Russia are building windows exploits, they just demand Microsoft hand over source? Yes in fact they do. https://download.microsoft.com/download/B/C/A/BCAFF3F5-5DB5-4AB4-9AAB-5CF0814E0948/GovernmentSecurityProgram.pdf https://download.microsoft.com/download/B/C/A/BCAFF3F5-5DB5-... “Throughout the history of the company, Microsoft has worked with national governments around the world to help them build and deploy more secure IT infrastructure and services to protect their citizens and national economies. In 2003, Microsoft built on these efforts to create the Government Security Program (GSP). The scope of the program has grown over time, and continues as a cornerstone of Microsoft’s efforts to help address the unique security requirements of more than 30 national governments around the world.” (Russia and China included) https://www.zdnet.com/article/does-microsofts-sharing-of-source-code-with-china-and-russia-pose-a-security-risk/ https://www.zdnet.com/article/does-microsofts-sharing-of-sou... > Also, the idea that “locked down” Linux would do any better than windows is ridiculous. The Linux codebase is enormous and complex and full of bugs. At least if you’d said some type of high security microkernel, you could put forward forward some logical arguments. It's not a `logical' argument, it's a pragmatic argument. A sufficiently tech-savvy admin can dictate the hardware on the network, roll their own kernel so that USB drivers cannot be loaded, have that image as the boot image, and use TPM if totally necessary. The reason you wouldn't want to run a high security microkernel is because those can't run regular desktop software like LibreOffice and what have you.
- deleted 8y ago[deleted]
- Wheaties466 8y agoim surprised that everyone keeps referencing the book and not the Documentary/Movie Zero days https://www.imdb.com/title/tt5446858/ https://www.imdb.com/title/tt5446858/
- trisimix 8y agoSo what if I run my top secret weapons grade uranium producing plant on a sanely secure operating system, like linux.
- wepple 8y agoI can’t tell if you’re being sarcastic or not, but if not: the idea that Linux is any more secure against a nation state than windows is ridiculous. There are no shortage of regular vulns discovered in each part of the Linux OS as used by stuxnet.
- ishaanbahal 8y agoYeah, I never understood why people think like this. I often read people saying Linux is most secure or some Unix or Mac, Any operating system can be equally vulnerable, humans are writing code for it after all. And blaming Microsoft for the insecure OS seems even worse. Their OS runs on way too many machines, making it the first target. I love linux, not for the security, but just for the utilities on the command line I can use. I'd feel equally unsafe on either OS!
- bleke 8y agoYou can run whatever system (L4 with formal verification and written in super secure language...) as long as there no redundant checks you are already doomed from start. Stuxnet is nice example why critical system must have at least: * Somebody periodically in person checking what happening and cross-checking results with operator * Have alternative monitoring system, even amateur arduino system with rs-422/485 network and independent sensors, can become impenetrable wall for Stuxnet type worms.
- bitL 8y ago* the most sophisticated software reviewers have seen so far
- rbosinger 8y agoA somewhat crazy guy once told me that he worked on Stuxnet. Obviously I didn't believe him. But he did seem to know quite a bit about it. How weird would it be if he wasn't lying. I mean, somebody had to work on this somewhere.
- the_grue 8y agoDo you happen to remember what was the crazy guy's nationality?
- autokad 8y ago"Realtek, which means that the authors of the worm were somehow able to break into the most secure location in a huge Taiwanese company" err, no. The companies gave the US access. as for all the 'unknown windows vulnerabilities' it exploited, I wouldn't be 100% surprised if Microsoft left the vulnerabilities for what ever security agency that made it.
- gibbsnich 8y agoSee "Zero Day: Stuxnet and the Launch of the World's first Digital Weapon" by Kim Zetter for many more details about Stuxnet.
- perlgeek 8y agoI'd argue that Google Search is much more sophisticated than Stuxnet. Windows is much more sophisticated. Linux is more sophisticated than Stuxnet. The list goes on. We tend to ignore the sophistication of things we are familiar with, and hype those that surprise. But that's not a fair measure of anything.
- r3bl 8y agoI agree. It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of). But calling it the most sophisticated piece of software is too big of a stretch. That said, other answers to this question include what we would traditionally consider as contestants (like Linux kernel), it just happens that the submitter decided to submit this specific answer. I don't know was this the top answer before it exploded here, but it sure is now.
- at-fates-hands 8y ago> It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of). Isn't Stuxnet a part of a family of similar nation state malware that would also include Flame and Duqu?
- r3bl 8y agoThey are a family, as in, all of them were almost certainly created by the same group. Symantec said that Duqu is "near identical" to Stuxnet. As for Flame, Kaspersky[0] initially said that it contains no resemblance to Stuxnet, and then later on discovered that they've even shared a zero day in their early versions. From my understanding, I don't necessarily consider them as different software, more as a single software + forks by the same group for different purposes and with different zero days. Stuxnet just happened to be the one that got to be the most popular one, for a number of reasons (most destructive, attacking the most sensitive targets, the one that got out of control and spread outside of Iran uncontrollably, first to be discovered...), so I refer to Stuxnet as the original one and Flame and Duqu as more of forks than completely different pieces of software. Which one is more sophisticated between the three would be the same as if we tried figuring out which Linux-based OS is the most sophisticated, except that in this scenario, we only have 3 Linux distros (maybe four with Gauss) and they've all been created by the same group. There's really no point in trying to compare their sophistication. [0] Before people bash on me for using Kaspersky as a source, Kaspersky, Iranian CERT and a university in Bucharest were the ones that initially discovered Flame, and Kaspersky's the group that published the first detailed analysis on Flame.
- INTPenis 8y agoHow do you define sophisticated? Complex or elegant? Because if it's more towards the latter then I'd suggest the software that took humans to the moon and back, several times, is much more sophisticated. But from reading the article it seems the author is aiming more for complex than elegant.
- 0xTJ 8y agoI'd say it's got both. It's extremely complex, but it does what it needs so cleanly. I'd argue that it's extraordinarily elegant.
- INTPenis 8y agoAnything complex that also does what it's supposed to does of course have some inherent elegance but that doesn't mean I'd call stuxnet elegant. It would be elegant if they could accomplish what they did with less code, relying on fewer exploits and perhaps even without the reliance on stolen private keys from other corporations. Having stolen private keys from hardware vendors is pretty brute force to me.
- jaclaz 8y agoIMHO monitoring/controlling a high-speed centrifuge with Windows (or with any non-real-time-OS for that mattters) is actually a huge design flaw, there is even a warning somewhere in MS documentation about Windows not being suited to Real Time operation, and RTOS are specifically used/needed for closed-loop applications (such as monitoring and controlling motors). References (National Instruments): http://www.ni.com/white-paper/3938/en/ http://www.ni.com/white-paper/3938/en/ http://www.ni.com/white-paper/14238/en/ http://www.ni.com/white-paper/14238/en/
- lima 8y agoThe actual monitoring is done by the embedded controller, Windows is just there for displaying fancy panels and programming the devices.
- jaclaz 8y agoOk, still seemingly the trick Stuxnet used was looping a good copy of those fancy panels and (still through windows) changing (slightly) the operating parameters of the machine, so in this case Windows (directly or indirectly) was capable of monitoring the device and change its operating status.
- kchr 8y agoAre you saying that there are no zero-days for platforms other than Windows? There could just as well have been a Linux computer used as interface to the embedded system that runs the centrifuges, that could be owned.
- jaclaz 8y agoNot really saying that, of course any OS is hackable, Linux also is not normally a RTOS with the exception of RT Linux, and possibly some other specific distro's. What I was trying to say is that something that has a more direct connection to the device is less likely to be prone on this specific kind of attack, which is AFAICU a sort of MITM (displaying a loop of the recorded display), and of course with a very "vertical" and "dedicated" operating system there should be less chances of the "casual" insertion of a USB stick in it (and possibly even no USB port at all on the actual hardware used).
- Lionsion 8y ago> The most sophisticated software in history was written by a team of people whose names we do not know. Isn't this hyperbole? I'd grant that Stuxnet is probably the most sophisticated malware ever written, but calling it the most sophisticated software is a big stretch. Stuxnet seems to be the product of a competent, professional, and well-funded software engineering organization that writes malware and understands the domain of computer espionage. That was unprecedented in the malware space, but it's not if you include other domains.
- phendrenad2 8y agoWe have much work to do on https://github.com/EnterpriseQualityCoding/FizzBuzzEnterpriseEdition https://github.com/EnterpriseQualityCoding/FizzBuzzEnterpris... if we want to catch up.
- chvid 8y agoGood that the Americans and or Israelis got what they wanted without bombing away ...
- rjplatte 8y agoThis confuses cleverness for sophistication. Yes, Stuxnet is ingenious, but mostly in concept/access to secret Windows bugs, not execution. Something like Pagerank or modern video encoders easily beats Stuxnet in terms of sophistication/complexity.
- jerkstate 8y agoWeird how the US IC developed and deployed such advanced software while agreeing that Iran was not developing nuclear weapons.
- tripplethrendo 8y agoDo we know it was the US IC? I think its likely that it was Mossad.
- jerkstate 8y agoby most accounts, it was a joint effort. https://arstechnica.com/tech-policy/2012/06/confirmed-us-israel-created-stuxnet-lost-control-of-it/ https://arstechnica.com/tech-policy/2012/06/confirmed-us-isr... and https://www.washingtonpost.com/world/national-security/stuxnet-was-work-of-us-and-israeli-experts-officials-say/2012/06/01/gJQAlnEy6U_story.html https://www.washingtonpost.com/world/national-security/stuxn...
- eddywebs 8y agoIt is worth noting the stuxnet worm version that effected Iranian nuclear facilities only attacked certain industrial controlled system built by Siemens systems otherwise the worm stays dormant. The wormed allegedly had signed drivers which could be state sponsored inside job to get signing facilitated.
- yoyar 8y agoWithout a doubt the article is fascinating but without defining what we mean by sophisticated how can we debate this?
- tdullien 8y agosorry, but this article is breathless crazy hyperbole. I am a cybersecurity expert that actually reverse engineered a nontrivial part of Stuxnet at one point, and I have reverse engineered other government-built worms and persistence mechanisms. Driver signing keys are not nearly as difficult to steal as the answer implies; not only are they shoddily managed in most hardware vendors, they could also be purchased on the black market for about 50k$ at the time. They are still not very difficult to come by. Zero-days (e.g. security vulnerabilities and their corresponding exploits) can be purchased on the grey market, and some are developed by government-internal teams. These are little marvels of strange engineering, but they are also a relatively common occurrence. The total market prices of the exploits in Stuxnet will have amounted to perhaps a few million $ at the time. The Stuxnet worm’s code showed all the artifacts you would have in a large software project - including but not limited to “handwriting” where you could see that a small team of engineers and architects were excellent developers who delegated the implementation of less-important parts to engineers of lesser ability. There have been leaner, more elegant, and similarly powerful / crazy pieces of malware. In general, though, these things are not made of magic, and they are not the most brilliant software ever made. They are usually well-engineered by decent engineers, built by a motivated team with decent funding. Even then, mistakes creep in (Stuxnet had an infamously broken mechanism to limit propagation), multiple versions need to be rolled out, and problems & bugs plague any software system. Now, comparing something like Stuxnet — a relatively small, well-engineered but ultimatively not terribly innovative assembly of known methods — to something like Google’s data center infrastructure (Borg/Flume/Mapreduce/Bigtable/Spanner), the Windows or Linux Kernel etc. and concluding Stuxnet is somehow superior or more sophisticated is simply false. Stuxnet was cool etc., but I can assure you the level of sophistication is less than the Windows Kernel, the Linux Kernel, or Google’s data processing infrastructure, by far. This is unsurprising: Stuxnet is a much smaller operation. Building Windows has probably cost many billion dollars by now. Stuxnet, on the other hand, was likely running on a shoestring budget in comparison. Assembling a highly impactful worm is much cheaper and simpler than people think; most of our IT infrastructure is not very robust.
- _bxg1 8y ago"most sophisticated software ever written" is a bit of a hyperbole. "most sophisticated computer worm ever discovered" seems more accurate.
- mkagenius 8y agoIts amazing to see people go crazy about this worm -- I mean how can someone think that that's the "most" sophisticated software. Come on, people.
- _bxg1 8y agoIt's very cool in a hacker-movie kind of way, and carries a certain mystique because of the fact that nobody's ever claimed responsibility for it. I think those facts amplify its media presence.
- KasianFranks 8y agoWrong. Ask the NGA.
- ghrifter 8y agorandom _italics_ to really _emphasis_ a point _like this one_
- hfdgiutdryg 8y agoI recall an early analyst of Stuxnet writing that it was so complex that it was almost as if it had been written by an alien intelligence. That really captured the imagination of Slashdot for awhile.
- mrep 8y agoDamn that guy can write! I've read this story 4 times now since it was posted and it still gives me goose bumps to read it.
- j45 8y agoStuxnet might be the most sophisticated worm ever written with the number and types of layers it drills through. There is likely far more complex and sophisticated software elsewhere.
- jokoon 8y agoI wonder towards what kind of landscapes the cyber arms race will lead us. The problem is how civilians will end up being the victims of it. What can be scary is how data can mess around the links of trust that is making society work. I hope there are people who are able to think about the problem of preventing online psy ops and other nasty things that can not cause threat, but do damage on the "data" of how society operates. As long as this problem is not fixed and the public is not educated about how computers work, I'm for limiting the use of computers in sensitive areas of society, would it be money, finance, the military, electricity and water networks, infrastructure, computers as a work tool, etc. Funny that a couple of months a ago I received a paper mail written in russian. There are no way in hell this was not related to my address getting leaked online, this must have been related to the internet somehow.
- 0xb8000 8y agoI was waiting for someone to point out IDF (Unit 8200?) and NSA collaboration being responsible for this to come up. The only proof we have is a smile by a an Israeli Defense leader in response to a question asked on 60 minutes (or a similarly named show) Also the author leave a few details out such as the intermitted activation ,for example it was only activated on day 7 and day 21. and other stuff like size of this.
- howox 8y agoThere is no conclusive evidence that stuxnet was successful at all. This article https://nypost.com/2013/05/16/stuxnet-virus-might-have-improved-irans-nuclear-capabilities-report/ https://nypost.com/2013/05/16/stuxnet-virus-might-have-impro... actually claims opposite. With cyberwarfare and espionage everything is possible so let's not guess too much as we have really limited information.
- chiefalchemist 8y ago...ever written...that we, the general public, are aware of. If Stuxnet's discovery was a "bug" and that hole has since been plugged, then there's likely plenty we aren't aware of. Minor, but still important to note (for context).
- ixtli 8y agoOut of curiosity, do we know that the state actors that built stuxnet didn't simply pay or force those taiwanese companies to turn over the keys?
- santoshalper 8y agoWhether he is right or wrong, that was a fantastic writeup.
- crunchlibrarian 8y agoThe only really interesting part is finding and keeping OS bugs secret. I wonder how many more the NSA is sitting on?
- calabin 8y agoI'd recommend Kim Zetter's book on this subject: https://amzn.to/2rQUGnq https://amzn.to/2rQUGnq
- bichiliad 8y agoThe title of this post is a bit misleading (and a bit click-bait-y) — this is one person's response to a quora question, and it seems like the point of his answer was more "the Stuxnet worm is a seriously complex piece of history if you don't know about it" and less "this is the definitive most sophisticated piece of software ever." I feel like we can agree that the definition of sophisticated[0] is fairly hard to quantify and rank software objectively against. [0]: "(of a machine, system, or technique) developed to a high degree of complexity", according to google: https://www.google.com/search?q=define+sophisticated https://www.google.com/search?q=define+sophisticated
- EdSharkey 8y agoIf elaborate/sneaky/surprising real world modeling is the quora answer's mark of sophistication, (which I agree with personally), then I have another "most sophisticated in 2018" nominee. And the nominee is ... Facebook's graph database! Consider, Facebook has modeled: * All our PII (face scans, key dates and times in our lives (birth to death), employment history, and on and on) * All our activities (web, real-world) * All our relationships/interactions (facebook, web, person-to-person, person-to-business, business-to-business, face recognition over practically all digital photos, chat, audio capture from mobile? what else?) * Data appropriately tagged and categorized: Geo-location and a million other things * Place information * And then, the coup de gracie ... how all that data changes over the time dimension And it's all searchable! A search of that database must be thrilling. You can know what's going on at every level of society at any point in time. You could quantify moods, trends, money, stars and governments currently rising and falling, etc. Consider the unholy power of that graph database, nothing else must come close! Sometimes, I want to get a job there as a data researcher just so I could query it.
- nodesocket 8y agoThere is a good documentary on STUXnet on Youtube https://www.youtube.com/watch?v=TGGxqjpka-U https://www.youtube.com/watch?v=TGGxqjpka-U.
- deleted 8y ago[deleted]
- synfin80 8y agoOne thing that was somewhat glossed over in the article is that stuxnet used 4 zero-days... That is it exploited 4 different software vulnerabilities that were unknown. This is a completely unprecedented level of sophistication in malware. https://www.symantec.com/connect/blogs/stuxnet-using-three-additional-zero-day-vulnerabilities https://www.symantec.com/connect/blogs/stuxnet-using-three-a...
- drumttocs8 8y agoWhy so many upvotes for a pretty typical Quora answer? Stuxnet certainly made a big impact, but do we really think it's that sophisticated?
- deleted 8y ago[deleted]
- tony2016 8y agoAny links to any of its source code?