45 ms·

I am just your average software dev with zero knowledge of malware creation, speculating here, and might come across as a fool. The author sensationalizes the

I am just your average software dev with zero knowledge of malware creation, speculating here, and might come across as a fool. The author sensationalizes the effort of the creators, painting a Holywoodesque scenario where they break into every possible software company to steal keys to misrepresent the software, going undetected by every possible security company etc. Since this is a Quora post, I can live with him playing to the gallery. Given the amount of speculation of involvement of US and Israeli intelligence agencies, and the task this worm was assigned, the real effort might have been just about writing a USB worm that identifies specific machines and handing the USB-0 to a double agent (I stopped watching Homeland after season 5 and am rusty with the jargon). The rest of it would have been simply asking all the associated software and hardware companies, politely, to cooperate. If any of this is true, stuxnet is anything but sophisticated. Its just lots and lots of specific API calls. That brings up the question: what is sophistication as applied to software?

iand 8y ago
The sophistication is to do all this while remaining completelt undetected in a highly secure environment. Iran didn't find Stuxnet, it was stumbled over by Kaspersky Lab.
0x00000000 8y ago
That is a huge oversimplification. Do yourself a favor and read this http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf http://www.symantec.com/content/en/us/enterprise/media/secur... or just the 'Executive Summary' if you don't want to read the whole thing
xmodem 8y ago
You should read "Countdown to zero day"[0]. Some of the measures that were taken exceeded what anyone in Hollywood could ever imagine. [0]: https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196 https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp...
mykull 8y ago
Just addressing the last thing you said, I think sophistication has to do with the level of knowledge required to implement. Whether that means knowledge politely asked for or through other means has implications for the difficulty of implementation but perhaps not sophistication of the software.
Xophmeister 8y ago
> The rest of it is all about asking the associated companies, politely, to cooperate. What keeps this cooperation secret? It would only take one weak link at any one of those companies to reveal -- accidentally or otherwise -- that they were coerced into providing their signing keys. As soon as that got out, speculation runs amok: Are all products from said company compromised? This would be ruinous to a company, so no one in charge would agree to that without something significant -- which would be even harder to hide from the public -- in return. Then, who asked for the key and why? Could that be traced back to the (presumably) agency in question? That weak link was weak once, there's nothing to assume that he/she won't be weak again, etc., etc.
- mykull 8y ago
  I'm not sure that it would be ruinous. Isn't RSA still trusted? People have a tendency to overlook or even defend broken protocol when it's "the good guys"
  - Xophmeister 8y ago
    “Compromised” in the sense of that company’s trustworthiness, not in the cryptographic sense.
- vinayms 8y ago
  All this speculation is wilder than what I am willing to get into. But I think the fact that the 'leader of the free world' and his buddy will wreck you beyond your worst nightmare if you go rogue should be enough motivation to not to.
acutesoftware 8y ago
They certainly wouldn't be calling lots and lots of API's, as that would likely trigger some antivirus software or at least leave traces in system logs. The sophistication of this software is that it did all this undetected.
- exikyut 8y ago
  "x86 is a high-level language": https://blog.erratasec.com/2015/03/x86-is-high-level-language.html https://blog.erratasec.com/2015/03/x86-is-high-level-languag... / https://news.ycombinator.com/item?id=9264195 https://news.ycombinator.com/item?id=9264195 Everything's an API at the end of the day. There was an article on here recently about the practical effects of the TLS 1.3 drafts, and how they broke proxies. I can't find it. It was talking about how the proxies choked because so many variable wire bits in TLS 1.2 stayed static for so long they rusted in place in proprietary implementations, and the proxies crashed once the values changed (despite this being a concrete protocol violation). This situation reminds me of that.
  - sgtmas2006 8y ago
    I would love to read this if you come across it.

iand 8y ago

The sophistication is to do all this while remaining completelt undetected in a highly secure environment. Iran didn't find Stuxnet, it was stumbled over by Kaspersky Lab.

0x00000000 8y ago

That is a huge oversimplification. Do yourself a favor and read this http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf http://www.symantec.com/content/en/us/enterprise/media/secur... or just the 'Executive Summary' if you don't want to read the whole thing

xmodem 8y ago

You should read "Countdown to zero day"[0]. Some of the measures that were taken exceeded what anyone in Hollywood could ever imagine. [0]: https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196 https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp...

mykull 8y ago

Just addressing the last thing you said, I think sophistication has to do with the level of knowledge required to implement. Whether that means knowledge politely asked for or through other means has implications for the difficulty of implementation but perhaps not sophistication of the software.

Xophmeister 8y ago

> The rest of it is all about asking the associated companies, politely, to cooperate. What keeps this cooperation secret? It would only take one weak link at any one of those companies to reveal -- accidentally or otherwise -- that they were coerced into providing their signing keys. As soon as that got out, speculation runs amok: Are all products from said company compromised? This would be ruinous to a company, so no one in charge would agree to that without something significant -- which would be even harder to hide from the public -- in return. Then, who asked for the key and why? Could that be traced back to the (presumably) agency in question? That weak link was weak once, there's nothing to assume that he/she won't be weak again, etc., etc.

mykull 8y ago
I'm not sure that it would be ruinous. Isn't RSA still trusted? People have a tendency to overlook or even defend broken protocol when it's "the good guys"
- Xophmeister 8y ago
  “Compromised” in the sense of that company’s trustworthiness, not in the cryptographic sense.
vinayms 8y ago
All this speculation is wilder than what I am willing to get into. But I think the fact that the 'leader of the free world' and his buddy will wreck you beyond your worst nightmare if you go rogue should be enough motivation to not to.

acutesoftware 8y ago

They certainly wouldn't be calling lots and lots of API's, as that would likely trigger some antivirus software or at least leave traces in system logs. The sophistication of this software is that it did all this undetected.

exikyut 8y ago
"x86 is a high-level language": https://blog.erratasec.com/2015/03/x86-is-high-level-language.html https://blog.erratasec.com/2015/03/x86-is-high-level-languag... / https://news.ycombinator.com/item?id=9264195 https://news.ycombinator.com/item?id=9264195 Everything's an API at the end of the day. There was an article on here recently about the practical effects of the TLS 1.3 drafts, and how they broke proxies. I can't find it. It was talking about how the proxies choked because so many variable wire bits in TLS 1.2 stayed static for so long they rusted in place in proprietary implementations, and the proxies crashed once the values changed (despite this being a concrete protocol violation). This situation reminds me of that.
- sgtmas2006 8y ago
  I would love to read this if you come across it.