12 ms·

I'd argue that Google Search is much more sophisticated than Stuxnet. Windows is much more sophisticated. Linux is more sophisticated than Stuxnet. The list goe

I'd argue that Google Search is much more sophisticated than Stuxnet. Windows is much more sophisticated. Linux is more sophisticated than Stuxnet. The list goes on. We tend to ignore the sophistication of things we are familiar with, and hype those that surprise. But that's not a fair measure of anything.

r3bl 8y ago
I agree. It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of). But calling it the most sophisticated piece of software is too big of a stretch. That said, other answers to this question include what we would traditionally consider as contestants (like Linux kernel), it just happens that the submitter decided to submit this specific answer. I don't know was this the top answer before it exploded here, but it sure is now.
- at-fates-hands 8y ago
  > It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of). Isn't Stuxnet a part of a family of similar nation state malware that would also include Flame and Duqu?
  - r3bl 8y ago
    They are a family, as in, all of them were almost certainly created by the same group. Symantec said that Duqu is "near identical" to Stuxnet. As for Flame, Kaspersky[0] initially said that it contains no resemblance to Stuxnet, and then later on discovered that they've even shared a zero day in their early versions. From my understanding, I don't necessarily consider them as different software, more as a single software + forks by the same group for different purposes and with different zero days. Stuxnet just happened to be the one that got to be the most popular one, for a number of reasons (most destructive, attacking the most sensitive targets, the one that got out of control and spread outside of Iran uncontrollably, first to be discovered...), so I refer to Stuxnet as the original one and Flame and Duqu as more of forks than completely different pieces of software. Which one is more sophisticated between the three would be the same as if we tried figuring out which Linux-based OS is the most sophisticated, except that in this scenario, we only have 3 Linux distros (maybe four with Gauss) and they've all been created by the same group. There's really no point in trying to compare their sophistication. [0] Before people bash on me for using Kaspersky as a source, Kaspersky, Iranian CERT and a university in Bucharest were the ones that initially discovered Flame, and Kaspersky's the group that published the first detailed analysis on Flame.
    - AYBABTME 8y ago
      Out of topic but your defense for referencing Kaspersky makes me wonder why people would see a problem with it? I'm not familiar with the field and don't know who's who.
      - elago 8y ago
        They're a Russian company and semi-recently Trump banned their software from government agencies. People theorize they're controlled by the Russian government but I've never come across any evidence that they're anything other than a top tier security company though. They have done some fairly bold moves in the past though, like cleverly calling out other AV companies that were copying their detections [0] and kind of embarrassing the NSA [1] when a NSA employee took their malware/cyber weapons home to their PC running Kaspersky AV, which detected the malware and sent it back to Kaspersky server for analysis. [0]https://www.theregister.co.uk/2010/02/10/kaspersky_malware_detection_experiment/ https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d... [1] https://www.bleepingcomputer.com/news/security/nsa-employee-at-the-middle-of-the-kaspersky-saga-admits-taking-files-home/ https://www.bleepingcomputer.com/news/security/nsa-employee-...
        hutzlibu 8y ago
        From: "[0]https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d..." https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d... "I've received feedback from people who were just focusing on the question why other anti-virus companies would detect a clean file we uploaded. And I can only repeat as I did in the blog: This could have happened to us as well," Kalkuhl explained." Well, he clearly says, the test was to expose the "negative effect of cheap static on-demand tests" and not that others copied from them, because this seems to be routine and they do the same.
        johnwbyrd 8y ago
        In Kaspersky's defense, they have started making their source code auditable for certain customers. Kaspersky is well aware of how they are perceived as a company, and they are aware that if anyone ever traces any of their activities back to the KGB, it's game over for them. I can't pretend I trust Kaspersky 100%, but I can see why others might.
yummybear 8y ago
Without any kind of metric for “sophisticated” it’s all subjective anyhow. I like Stuxnet as an example - it’s devious and a true hacker approach, albeit as blackhat as they come.
- donald_fump 8y ago
  i think for something to be sophisticated we are looking at how complex it is. this worm does nothing new in that regard (taking advantage of 0days, hiding, covering tracks etc.) it is no more sophisticated than a regular worm. quora is a fucking joke.
  - yummybear 8y ago
    Personally, I think the Stuxnet work is comparable to a Rube Goldberg contraption. So you could ask, is a RG machine more sophisticated than say a computer - maybe not on a strictly technical level, but again without a metric, it's all about how we feel about it. Anyways, I thought it was a great writeup that explains at least one aspect of what sophisticated software is, in a language most anyone could understand.
  - Lambdanaut 8y ago
    I think for something to be sophisticated we are looking at the metric that differentiates fine wines and cheeses from plebeian non-fine wine and cheeses. If we can just capture that essence, we will wield the power of sophistication in our hands.
    - marnett 8y ago
      Oh, in that case it's just placebo, price, and primed expectations.
    - jcoffland 8y ago
      You mean how much money is charged?
doppel 8y ago
I think Windows and Stuxnet are sophisticated in different ways. Windows has to cover a huge area and a lot of "known" unknowns and be able to recover (somewhat) reliably. Stuff breaks, you get weird error messages, that driver for your Wi-Fi never really worked right, but at the end of the day you have a computer that works pretty well, and that's quite remarkable. The same is of course true of Linux and other operating systems. Stuxnet is a hyper-specialized piece of software (malware) that cannot fail or it loses it's purpose. The authors clearly knew they had to have multiple fallbacks for every step of the process, but I find it very impressive that it reached it's end goal successfully and without being discovered. A lot of software (including malware) break because of regular software bugs, environments that differ from the expected, interference by the user, the list goes on. For Stuxnet to have avoided all of those, that is quite sophisticated.
11thEarlOfMar 8y ago
In my view, the sophistication is implied by the breadth of expertise required to put the whole thing together. Google Search and the OS landscape are for sure broad and sophisticated. However, their development was accomplished by computer scientists. In order for stuxnet to be effective, it was necessary to employ expertise in: - Uranium enrichment methods and processes - Capital equipment control systems and their development environments - Theory of operation of centrifuge machines - Corporate espionage of some sort - Organizational management skills that can pull all that together - and deep understanding of the operating systems referenced above
- eberkund 8y ago
  But do those things really contribute to the sophistication of the software? For example imagine some code written with no understanding of uranium enrichment: const int CENTRIFUGE_RPM = 500; And then some other code written with a deep understanding of uranium enrichment: const int CENTRIFUGE_RPM = 1203; Can you really say that the second bit of code is more "complex"? Same goes for stolen driver signing keys and some of the other things mentioned in the post. Other large software projects like operating systems or Google search involve much more complex software concepts which I think is the primary thing that should be measured when discussing the sophistication of software.
  - ktpsns 8y ago
    The complexity or quality of a software code does not neccessarily say anything about the complexity of the problem it solves.
    - donald_fump 8y ago
      so true. upvoted
      - coldtea 8y ago
        The sophistication of a piece of code is not merely an attribute of its complexity. Else a program with tons of accidental complexity (a badly written program by an intern) would be equally good with a program with huge essential complexity (a 10 line program that takes tons of domain and/or programming knowledge to write)...
deleted 8y ago
[deleted]
ivanhoe 8y ago
Lets not forget software used for extremely complicated and risky operations like Mars Rover or Rosetta mission, developers did some quite amazing things there with very limited hardware resources...
fredley 8y ago
Windows certainly has more undiscovered Windows/Driver exploits in it than Stuxnet ever had!
mathnode 8y ago
MariaDB and PostgreSQL. Amazing software that is open source for us to dive in and play with. FoundationDB was a recent treat.
300bps 8y ago
To me the primary difference is the software you mention performs their tasks in the open with cooperative users. Stuxnet installed itself without cooperation, hid itself perfectly and still completed its objective flawlessly against a hostile user base.
markbnj 8y ago
You could debate this all day long for various values of "sophisticated." I think the author just meant some variation on "amazingly devious."
ajuc 8y ago
There's sophistication of the domain, and of the code. They are independent. For example - it might take years of research to develop a formula for calculating something, but the final code can be very simple one-liner.
chadash 8y ago
I say this without having seen the code base for either, but I'd be surprised if Stuxnet's code base was anywhere near as large or with as many moving pieces. Still, it's incredible to imagine the knowledge base that needed to go into Stuxnet to get things off the ground. Google Search was originally written by two guys in graduate school and has been refined and rewritten many times since then. I'm sure the code base is complicated and undoubtedly some of the greatest minds in software engineering and computer science have used it. The same goes for Linux, which was written by one guy and grew from there. On the other hand, Stuxnet isn't something that a few brilliant graduate students could have put together. To even get this thing off the ground, you need people with backgrounds in nuclear physics and/or chemistry, operating systems specialists, people with knowledge of industrial equipment, networking experts, an espionage network and competent management to pull it all together. Plus, you need to keep the whole project secret. Oh, and funding. Lot's of funding. I'd call that sophistication in that you can't even think about starting to tackle this problem if you're just two guys in a garage.
- steve19 8y ago
  I think of it like if everyone who read these comments on HN got together we could engineer a very good OS. I doubt we could come close to solving the problem of "stopping Iran nuke production without killing anyone or starting a war"
Zarathust 8y ago
The code base for the International Space Station is probably also VERY complex
- ddalex 8y ago
  Probably not. Complex things break a lot. You want the life-critical code to be as simple as possible, with proven correctness if possible. I bet you'll not find 1 recursion in ISS flight code, and you'll not find anything that's not having an known-upper-bound on time run.
  - Zarathust 8y ago
    https://www.nasa.gov/feature/facts-and-figures https://www.nasa.gov/feature/facts-and-figures It is possible that code itself is not that complex, but the interaction between all modules certainly has a high level of complexity. "In the International Space Station’s U.S. segment alone, more than 1.5 million lines of flight software code run on 44 computers communicating via 100 data networks transferring 400,000 signals (e.g. pressure or temperature measurements, valve positions, etc.)."
deleted 8y ago
[deleted]
deleted 8y ago
[deleted]
somerando 8y ago
This comparison is ridiculous. Searching the internet can be imperfect, it can be lossy, and there aren't any real consequences. We are talking about an ad platform after all. If you search for kittens and you get back 345 results or 101 results or 2345 results, does it really matter? No, it has no consequence to anyone.
reaperducer 8y ago
>I'd argue that Google Search is much more sophisticated than Stuxnet. Windows is much more sophisticated. Not to be rude, but it really doesn't sound like you read the article. Especially when you claim that Windows is more sophisticated. Stuxnet had to get past all of Windows security, and did so by using not just one or two or three never-before-known flaws, but a bunch of them.
0xb8000 8y ago
I agree on the sophistication part but I think you are missing out on resources used on development of this. the responsible party(ies) did not access to resources , man power or infra at google or even at an enterprise scale.
johnwbyrd 8y ago
That is an utterly braindead assertion. I wrote the quoted article about Stuxnet. And I've helped write multiple operating systems. Your argument not an argument. It's just a random assertion with no technical knowledge of either Stuxnet or how to write an operating system. Stuxnet specifically took advantage of Windows's lack of sophistication in order to replicate.
- deleted 8y ago
  [deleted]
spunker540 8y ago
Big != sophisticated. I’m not denying that there’s a ton of effort and features that go into windows, but operating systems are well known, and I’m sure most of the code powering windows is not all that sophisticated outside of some core components. It’s sort of like comparing a skyscraper to an iPhone. Sure the skyscraper requires a lot more manual labor, but the iPhone is more sophisticated. It took ~80 years from when the Empire State Building was built to when the iPhone was built. The iPhone is more sophisticated but it’d still take more time and resources to make another Empire State Building. Sorry if that’s a poor analogy- it’s the best I got right now.
qop 8y ago
Several years later, and even with the code, researchers are not able to summarize a complete list of what stuxnet definitely does. What I see here is that the word "sophistication" is misunderstood by a lot of people. Stuxnet took control of multiple layers of complex production environments. There are numerous "0day" kits in the code. It's not like an effort like a search engine or most other organized software projects, because there are logistical dependencies of the worm itself in those exploits. If it was a US-israel effort (I think it almost definitely was, but who cares) then consider how much discipline and effort it takes to keep TWO govt groups of hackers coordinated enough to keep those exploits fresh, whilst simultaneously building a dependable worm. Another thing, a lot of the actual machinery and shit isn't very well known, and this is worth mentioning because it's not like you can go spin up an emulator for this shit to test out your massively devastating two-country worm on. Stuxnet of course made the best of this by using lots of different exploits in different situations, giving it the biggest attack surface it could, that's low hanging fruit anyways. I think stuxnet doesn't impress people because maybe they think it's just a bunch of bugs in old shitty software, but it's so much more than that. It's bugs in software that only a few hundred or maybe a few thousand people have ever seen, much less pentested, on machinery that's rare and sometimes even unique to the location, the infrastructure of the place is based on rough intel at best, and oh by the way, your spy hackers need to coordinate with this other group on the other side of the planet. Start brainstorming how you'd pull it off, and I think it'll become more imrpressive as you do. Personally, I think it's the most incredible display of skill and prowess in malware thus far. The years I've spent disassembling, reversing, tracing, filtering, researching... A lifetime of hacking doesn't even knock the dust off of a project like that.

r3bl 8y ago

I agree. It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of). But calling it the most sophisticated piece of software is too big of a stretch. That said, other answers to this question include what we would traditionally consider as contestants (like Linux kernel), it just happens that the submitter decided to submit this specific answer. I don't know was this the top answer before it exploded here, but it sure is now.

at-fates-hands 8y ago
> It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of). Isn't Stuxnet a part of a family of similar nation state malware that would also include Flame and Duqu?
- r3bl 8y ago
  They are a family, as in, all of them were almost certainly created by the same group. Symantec said that Duqu is "near identical" to Stuxnet. As for Flame, Kaspersky[0] initially said that it contains no resemblance to Stuxnet, and then later on discovered that they've even shared a zero day in their early versions. From my understanding, I don't necessarily consider them as different software, more as a single software + forks by the same group for different purposes and with different zero days. Stuxnet just happened to be the one that got to be the most popular one, for a number of reasons (most destructive, attacking the most sensitive targets, the one that got out of control and spread outside of Iran uncontrollably, first to be discovered...), so I refer to Stuxnet as the original one and Flame and Duqu as more of forks than completely different pieces of software. Which one is more sophisticated between the three would be the same as if we tried figuring out which Linux-based OS is the most sophisticated, except that in this scenario, we only have 3 Linux distros (maybe four with Gauss) and they've all been created by the same group. There's really no point in trying to compare their sophistication. [0] Before people bash on me for using Kaspersky as a source, Kaspersky, Iranian CERT and a university in Bucharest were the ones that initially discovered Flame, and Kaspersky's the group that published the first detailed analysis on Flame.
  - AYBABTME 8y ago
    Out of topic but your defense for referencing Kaspersky makes me wonder why people would see a problem with it? I'm not familiar with the field and don't know who's who.
    - elago 8y ago
      They're a Russian company and semi-recently Trump banned their software from government agencies. People theorize they're controlled by the Russian government but I've never come across any evidence that they're anything other than a top tier security company though. They have done some fairly bold moves in the past though, like cleverly calling out other AV companies that were copying their detections [0] and kind of embarrassing the NSA [1] when a NSA employee took their malware/cyber weapons home to their PC running Kaspersky AV, which detected the malware and sent it back to Kaspersky server for analysis. [0]https://www.theregister.co.uk/2010/02/10/kaspersky_malware_detection_experiment/ https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d... [1] https://www.bleepingcomputer.com/news/security/nsa-employee-at-the-middle-of-the-kaspersky-saga-admits-taking-files-home/ https://www.bleepingcomputer.com/news/security/nsa-employee-...
      - hutzlibu 8y ago
        From: "[0]https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d..." https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d... "I've received feedback from people who were just focusing on the question why other anti-virus companies would detect a clean file we uploaded. And I can only repeat as I did in the blog: This could have happened to us as well," Kalkuhl explained." Well, he clearly says, the test was to expose the "negative effect of cheap static on-demand tests" and not that others copied from them, because this seems to be routine and they do the same.
      - johnwbyrd 8y ago
        In Kaspersky's defense, they have started making their source code auditable for certain customers. Kaspersky is well aware of how they are perceived as a company, and they are aware that if anyone ever traces any of their activities back to the KGB, it's game over for them. I can't pretend I trust Kaspersky 100%, but I can see why others might.

yummybear 8y ago

Without any kind of metric for “sophisticated” it’s all subjective anyhow. I like Stuxnet as an example - it’s devious and a true hacker approach, albeit as blackhat as they come.

donald_fump 8y ago
i think for something to be sophisticated we are looking at how complex it is. this worm does nothing new in that regard (taking advantage of 0days, hiding, covering tracks etc.) it is no more sophisticated than a regular worm. quora is a fucking joke.
- yummybear 8y ago
  Personally, I think the Stuxnet work is comparable to a Rube Goldberg contraption. So you could ask, is a RG machine more sophisticated than say a computer - maybe not on a strictly technical level, but again without a metric, it's all about how we feel about it. Anyways, I thought it was a great writeup that explains at least one aspect of what sophisticated software is, in a language most anyone could understand.
- Lambdanaut 8y ago
  I think for something to be sophisticated we are looking at the metric that differentiates fine wines and cheeses from plebeian non-fine wine and cheeses. If we can just capture that essence, we will wield the power of sophistication in our hands.
  - marnett 8y ago
    Oh, in that case it's just placebo, price, and primed expectations.
  - jcoffland 8y ago
    You mean how much money is charged?

doppel 8y ago

I think Windows and Stuxnet are sophisticated in different ways. Windows has to cover a huge area and a lot of "known" unknowns and be able to recover (somewhat) reliably. Stuff breaks, you get weird error messages, that driver for your Wi-Fi never really worked right, but at the end of the day you have a computer that works pretty well, and that's quite remarkable. The same is of course true of Linux and other operating systems. Stuxnet is a hyper-specialized piece of software (malware) that cannot fail or it loses it's purpose. The authors clearly knew they had to have multiple fallbacks for every step of the process, but I find it very impressive that it reached it's end goal successfully and without being discovered. A lot of software (including malware) break because of regular software bugs, environments that differ from the expected, interference by the user, the list goes on. For Stuxnet to have avoided all of those, that is quite sophisticated.

11thEarlOfMar 8y ago

In my view, the sophistication is implied by the breadth of expertise required to put the whole thing together. Google Search and the OS landscape are for sure broad and sophisticated. However, their development was accomplished by computer scientists. In order for stuxnet to be effective, it was necessary to employ expertise in: - Uranium enrichment methods and processes - Capital equipment control systems and their development environments - Theory of operation of centrifuge machines - Corporate espionage of some sort - Organizational management skills that can pull all that together - and deep understanding of the operating systems referenced above

eberkund 8y ago
But do those things really contribute to the sophistication of the software? For example imagine some code written with no understanding of uranium enrichment: const int CENTRIFUGE_RPM = 500; And then some other code written with a deep understanding of uranium enrichment: const int CENTRIFUGE_RPM = 1203; Can you really say that the second bit of code is more "complex"? Same goes for stolen driver signing keys and some of the other things mentioned in the post. Other large software projects like operating systems or Google search involve much more complex software concepts which I think is the primary thing that should be measured when discussing the sophistication of software.
- ktpsns 8y ago
  The complexity or quality of a software code does not neccessarily say anything about the complexity of the problem it solves.
  - donald_fump 8y ago
    so true. upvoted
    - coldtea 8y ago
      The sophistication of a piece of code is not merely an attribute of its complexity. Else a program with tons of accidental complexity (a badly written program by an intern) would be equally good with a program with huge essential complexity (a 10 line program that takes tons of domain and/or programming knowledge to write)...

deleted 8y ago

[deleted]

ivanhoe 8y ago

Lets not forget software used for extremely complicated and risky operations like Mars Rover or Rosetta mission, developers did some quite amazing things there with very limited hardware resources...

fredley 8y ago

Windows certainly has more undiscovered Windows/Driver exploits in it than Stuxnet ever had!

mathnode 8y ago

MariaDB and PostgreSQL. Amazing software that is open source for us to dive in and play with. FoundationDB was a recent treat.

300bps 8y ago

To me the primary difference is the software you mention performs their tasks in the open with cooperative users. Stuxnet installed itself without cooperation, hid itself perfectly and still completed its objective flawlessly against a hostile user base.

markbnj 8y ago

You could debate this all day long for various values of "sophisticated." I think the author just meant some variation on "amazingly devious."

ajuc 8y ago

There's sophistication of the domain, and of the code. They are independent. For example - it might take years of research to develop a formula for calculating something, but the final code can be very simple one-liner.

chadash 8y ago

I say this without having seen the code base for either, but I'd be surprised if Stuxnet's code base was anywhere near as large or with as many moving pieces. Still, it's incredible to imagine the knowledge base that needed to go into Stuxnet to get things off the ground. Google Search was originally written by two guys in graduate school and has been refined and rewritten many times since then. I'm sure the code base is complicated and undoubtedly some of the greatest minds in software engineering and computer science have used it. The same goes for Linux, which was written by one guy and grew from there. On the other hand, Stuxnet isn't something that a few brilliant graduate students could have put together. To even get this thing off the ground, you need people with backgrounds in nuclear physics and/or chemistry, operating systems specialists, people with knowledge of industrial equipment, networking experts, an espionage network and competent management to pull it all together. Plus, you need to keep the whole project secret. Oh, and funding. Lot's of funding. I'd call that sophistication in that you can't even think about starting to tackle this problem if you're just two guys in a garage.

steve19 8y ago
I think of it like if everyone who read these comments on HN got together we could engineer a very good OS. I doubt we could come close to solving the problem of "stopping Iran nuke production without killing anyone or starting a war"

Zarathust 8y ago

The code base for the International Space Station is probably also VERY complex

ddalex 8y ago
Probably not. Complex things break a lot. You want the life-critical code to be as simple as possible, with proven correctness if possible. I bet you'll not find 1 recursion in ISS flight code, and you'll not find anything that's not having an known-upper-bound on time run.
- Zarathust 8y ago
  https://www.nasa.gov/feature/facts-and-figures https://www.nasa.gov/feature/facts-and-figures It is possible that code itself is not that complex, but the interaction between all modules certainly has a high level of complexity. "In the International Space Station’s U.S. segment alone, more than 1.5 million lines of flight software code run on 44 computers communicating via 100 data networks transferring 400,000 signals (e.g. pressure or temperature measurements, valve positions, etc.)."

deleted 8y ago

[deleted]

deleted 8y ago

[deleted]

somerando 8y ago

This comparison is ridiculous. Searching the internet can be imperfect, it can be lossy, and there aren't any real consequences. We are talking about an ad platform after all. If you search for kittens and you get back 345 results or 101 results or 2345 results, does it really matter? No, it has no consequence to anyone.

reaperducer 8y ago

>I'd argue that Google Search is much more sophisticated than Stuxnet. Windows is much more sophisticated. Not to be rude, but it really doesn't sound like you read the article. Especially when you claim that Windows is more sophisticated. Stuxnet had to get past all of Windows security, and did so by using not just one or two or three never-before-known flaws, but a bunch of them.

0xb8000 8y ago

I agree on the sophistication part but I think you are missing out on resources used on development of this. the responsible party(ies) did not access to resources , man power or infra at google or even at an enterprise scale.

johnwbyrd 8y ago

That is an utterly braindead assertion. I wrote the quoted article about Stuxnet. And I've helped write multiple operating systems. Your argument not an argument. It's just a random assertion with no technical knowledge of either Stuxnet or how to write an operating system. Stuxnet specifically took advantage of Windows's lack of sophistication in order to replicate.

deleted 8y ago
[deleted]

spunker540 8y ago

Big != sophisticated. I’m not denying that there’s a ton of effort and features that go into windows, but operating systems are well known, and I’m sure most of the code powering windows is not all that sophisticated outside of some core components. It’s sort of like comparing a skyscraper to an iPhone. Sure the skyscraper requires a lot more manual labor, but the iPhone is more sophisticated. It took ~80 years from when the Empire State Building was built to when the iPhone was built. The iPhone is more sophisticated but it’d still take more time and resources to make another Empire State Building. Sorry if that’s a poor analogy- it’s the best I got right now.

qop 8y ago

Several years later, and even with the code, researchers are not able to summarize a complete list of what stuxnet definitely does. What I see here is that the word "sophistication" is misunderstood by a lot of people. Stuxnet took control of multiple layers of complex production environments. There are numerous "0day" kits in the code. It's not like an effort like a search engine or most other organized software projects, because there are logistical dependencies of the worm itself in those exploits. If it was a US-israel effort (I think it almost definitely was, but who cares) then consider how much discipline and effort it takes to keep TWO govt groups of hackers coordinated enough to keep those exploits fresh, whilst simultaneously building a dependable worm. Another thing, a lot of the actual machinery and shit isn't very well known, and this is worth mentioning because it's not like you can go spin up an emulator for this shit to test out your massively devastating two-country worm on. Stuxnet of course made the best of this by using lots of different exploits in different situations, giving it the biggest attack surface it could, that's low hanging fruit anyways. I think stuxnet doesn't impress people because maybe they think it's just a bunch of bugs in old shitty software, but it's so much more than that. It's bugs in software that only a few hundred or maybe a few thousand people have ever seen, much less pentested, on machinery that's rare and sometimes even unique to the location, the infrastructure of the place is based on rough intel at best, and oh by the way, your spy hackers need to coordinate with this other group on the other side of the planet. Start brainstorming how you'd pull it off, and I think it'll become more imrpressive as you do. Personally, I think it's the most incredible display of skill and prowess in malware thus far. The years I've spent disassembling, reversing, tracing, filtering, researching... A lifetime of hacking doesn't even knock the dust off of a project like that.