4 ms·

I agree. It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of). But calling it the most sophisticated piece of

by r3bl 8y ago

I agree. It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of). But calling it the most sophisticated piece of software is too big of a stretch. That said, other answers to this question include what we would traditionally consider as contestants (like Linux kernel), it just happens that the submitter decided to submit this specific answer. I don't know was this the top answer before it exploded here, but it sure is now.

at-fates-hands 8y ago
> It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of). Isn't Stuxnet a part of a family of similar nation state malware that would also include Flame and Duqu?
- r3bl 8y ago
  They are a family, as in, all of them were almost certainly created by the same group. Symantec said that Duqu is "near identical" to Stuxnet. As for Flame, Kaspersky[0] initially said that it contains no resemblance to Stuxnet, and then later on discovered that they've even shared a zero day in their early versions. From my understanding, I don't necessarily consider them as different software, more as a single software + forks by the same group for different purposes and with different zero days. Stuxnet just happened to be the one that got to be the most popular one, for a number of reasons (most destructive, attacking the most sensitive targets, the one that got out of control and spread outside of Iran uncontrollably, first to be discovered...), so I refer to Stuxnet as the original one and Flame and Duqu as more of forks than completely different pieces of software. Which one is more sophisticated between the three would be the same as if we tried figuring out which Linux-based OS is the most sophisticated, except that in this scenario, we only have 3 Linux distros (maybe four with Gauss) and they've all been created by the same group. There's really no point in trying to compare their sophistication. [0] Before people bash on me for using Kaspersky as a source, Kaspersky, Iranian CERT and a university in Bucharest were the ones that initially discovered Flame, and Kaspersky's the group that published the first detailed analysis on Flame.
  - AYBABTME 8y ago
    Out of topic but your defense for referencing Kaspersky makes me wonder why people would see a problem with it? I'm not familiar with the field and don't know who's who.
    - elago 8y ago
      They're a Russian company and semi-recently Trump banned their software from government agencies. People theorize they're controlled by the Russian government but I've never come across any evidence that they're anything other than a top tier security company though. They have done some fairly bold moves in the past though, like cleverly calling out other AV companies that were copying their detections [0] and kind of embarrassing the NSA [1] when a NSA employee took their malware/cyber weapons home to their PC running Kaspersky AV, which detected the malware and sent it back to Kaspersky server for analysis. [0]https://www.theregister.co.uk/2010/02/10/kaspersky_malware_detection_experiment/ https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d... [1] https://www.bleepingcomputer.com/news/security/nsa-employee-at-the-middle-of-the-kaspersky-saga-admits-taking-files-home/ https://www.bleepingcomputer.com/news/security/nsa-employee-...
      - hutzlibu 8y ago
        From: "[0]https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d..." https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d... "I've received feedback from people who were just focusing on the question why other anti-virus companies would detect a clean file we uploaded. And I can only repeat as I did in the blog: This could have happened to us as well," Kalkuhl explained." Well, he clearly says, the test was to expose the "negative effect of cheap static on-demand tests" and not that others copied from them, because this seems to be routine and they do the same.
      - johnwbyrd 8y ago
        In Kaspersky's defense, they have started making their source code auditable for certain customers. Kaspersky is well aware of how they are perceived as a company, and they are aware that if anyone ever traces any of their activities back to the KGB, it's game over for them. I can't pretend I trust Kaspersky 100%, but I can see why others might.

by r3bl 8y ago

at-fates-hands 8y ago

> It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of). Isn't Stuxnet a part of a family of similar nation state malware that would also include Flame and Duqu?

r3bl 8y ago
They are a family, as in, all of them were almost certainly created by the same group. Symantec said that Duqu is "near identical" to Stuxnet. As for Flame, Kaspersky[0] initially said that it contains no resemblance to Stuxnet, and then later on discovered that they've even shared a zero day in their early versions. From my understanding, I don't necessarily consider them as different software, more as a single software + forks by the same group for different purposes and with different zero days. Stuxnet just happened to be the one that got to be the most popular one, for a number of reasons (most destructive, attacking the most sensitive targets, the one that got out of control and spread outside of Iran uncontrollably, first to be discovered...), so I refer to Stuxnet as the original one and Flame and Duqu as more of forks than completely different pieces of software. Which one is more sophisticated between the three would be the same as if we tried figuring out which Linux-based OS is the most sophisticated, except that in this scenario, we only have 3 Linux distros (maybe four with Gauss) and they've all been created by the same group. There's really no point in trying to compare their sophistication. [0] Before people bash on me for using Kaspersky as a source, Kaspersky, Iranian CERT and a university in Bucharest were the ones that initially discovered Flame, and Kaspersky's the group that published the first detailed analysis on Flame.
- AYBABTME 8y ago
  Out of topic but your defense for referencing Kaspersky makes me wonder why people would see a problem with it? I'm not familiar with the field and don't know who's who.
  - elago 8y ago
    They're a Russian company and semi-recently Trump banned their software from government agencies. People theorize they're controlled by the Russian government but I've never come across any evidence that they're anything other than a top tier security company though. They have done some fairly bold moves in the past though, like cleverly calling out other AV companies that were copying their detections [0] and kind of embarrassing the NSA [1] when a NSA employee took their malware/cyber weapons home to their PC running Kaspersky AV, which detected the malware and sent it back to Kaspersky server for analysis. [0]https://www.theregister.co.uk/2010/02/10/kaspersky_malware_detection_experiment/ https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d... [1] https://www.bleepingcomputer.com/news/security/nsa-employee-at-the-middle-of-the-kaspersky-saga-admits-taking-files-home/ https://www.bleepingcomputer.com/news/security/nsa-employee-...
    - hutzlibu 8y ago
      From: "[0]https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d..." https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d... "I've received feedback from people who were just focusing on the question why other anti-virus companies would detect a clean file we uploaded. And I can only repeat as I did in the blog: This could have happened to us as well," Kalkuhl explained." Well, he clearly says, the test was to expose the "negative effect of cheap static on-demand tests" and not that others copied from them, because this seems to be routine and they do the same.
    - johnwbyrd 8y ago
      In Kaspersky's defense, they have started making their source code auditable for certain customers. Kaspersky is well aware of how they are perceived as a company, and they are aware that if anyone ever traces any of their activities back to the KGB, it's game over for them. I can't pretend I trust Kaspersky 100%, but I can see why others might.