8 ms·
Stuxnet Questions and Answers
- Garbage 16y agoOne interesting question is: * Q: Was Stuxnet written by a government? A: That's what it would look like, yes.
- mh_ 16y agoWhile it is pretty difficult to answer what a piece of code written by a government would look like, a useful piece of information is also that the code targeted 4 different 0-day bugs [1]. If we consider previous reports on 0-day pricing [2], this alone could put the cost fo the worm at over $200000 making it more likely to be built by a well funded adversary. [1] http://en.wikipedia.org/wiki/Zero-day_attack http://en.wikipedia.org/wiki/Zero-day_attack [2] http://weis2007.econinfosec.org/papers/29.pdf http://weis2007.econinfosec.org/papers/29.pdf
- InclinedPlane 16y agoA talented individual or small team, government funded or not, is going to be able to research vulnerabilities on their own.
- rouli 16y agoyes, but a talented individual would probably sell those vulnerabilities since they worth so much, rather then use them for some obscure, probably not money earning, goal.
- InclinedPlane 16y agoThat's just moving one layer of indirection. If vulnerabilities are worth money, presumably so they can be exploited, then why isn't it possible for someone to be motivated to use vulnerabilities and also having the talent to discover them?
- mfukar 16y agoYou're making the assumption that a government would not pay for the development and exploitation of those vulnerabilities, which is de facto false considering the current "cyberdefense" capabilities of developed countries.
- charlief 16y agoAgreed, but I think the best evidence of large sponsorship is in that factory system recognition and parameter modification code. We don't really understand the sophistication until it actually chooses to execute, but access to those kind of specifications would require some fairly extensive research resources, someone that an individual or small team would have trouble getting alone.
- caf 16y agoIt really doesn't matter if they bought the 0days or researched them themselves - either way they either spent the cash or gave up the opportunity to earn the cash from them, which is equivalent. They still put ~$200,000 worth of resources into the worm.
- ErrantX 16y agoThe danger there is the "common thinking" that this puts it squarely in the realm of governments. However, at such a price point you're still well within the remit of organised gangs; they, for example, will spend a fortune on viruses and other malware - it's big big business.
- nivertech 16y agoIf it's indeed created by Israeli Intelligence, then at least R&D costs will be close to nothing. Israeli military has mandatory service. 18-21 years old programmers/hackers work day and night almost for free.
- anonanonanon 16y agoOur defense budget is 7% of our GDP, which is the 5th highest rate in the world (according to wiki). I would hardly call that free. Also, there is a shortage of tech talent here and the salaries are quite high. So there are also hidden costs with the military getting people to work for "free".
- nivertech 16y agoFirst it's 8.5% of GDP in 2009, but in absolute numbers it's only $14.3B (including US aid, which has to be spent in US). This peanuts for being a regional superpower. About half of the budget goes to salaries of officers, permanent servicemen and civilian contractors.
- rikthevik 16y agoI think there's some very experienced, very talented people working on this. Security is one area where I believe that the older you are and the more hours you've clocked and exploits you've thoroughly understood, the better you are.
- chris_l 16y agoIsn't the question better posed as was it funded by a government? And how did they choose whom to hire? Maybe the private armies are getting into cyberwarfare...
- user24 16y agoWhat's the difference between a govt writing it and funding it. Writing is a subset of funding.
- scrrr 16y agoThis is the stuff of movies, but do you think its very wise to write this kind of software for a government? Perhaps if you can somehow stay anonymous..
- brown9-2 16y agoEh? The implication/speculation is that a government wanted to create and spread a worm.
- scrrr 16y agoYes but would you like to be the programmer that wrote it? You would also be a witness. Again, movie stuff.. :)
- uxp 16y agoYou're assuming that a bunch of suits pulled some hackers out of their parent's basement and told them to write a virus. I can only comment on the US Government's NSA, which has thousands of highly trained and highly intellectual programmers already under their employ. These are people that do their job to protect and assist in the affairs of the government. Probably already under highly classified labels. For some, it is just another job assignment. However, I am also speculating. The truth: No one capable of telling the truth knows.
- hugh3 16y agoWait, since when have governments been better at writing code than small groups of talented amateurs? Have I fallen through a portal into mirror-universe HN?
- btilly 16y agoOne of the arguments for it being a government is the unusual size and complexity of the code. A large piece of code speaks against a small group. It also speaks against a group with an ethos of producing something simple and elegant, which talented amateurs would be likely to feel.
- chris_l 16y agoThis reads like a section from a sci-fi novel. Once more reality is catching up with cyberpunk. I'd love to know what it's supposed to do when it reaches its target. Surely the creator would have had to have some sort of blueprints for the target system to successfully set it up to create more than collateral damage.
- humbledrone 16y agoI'm very curious about what it's supposed to do as well. I work with SCADA systems, and I can confirm that it would be difficult/impossible to tell without knowing exactly what system it's targeting. SCADA systems are often controlled by writing to "points," which typically have numeric addresses. So point 35 might control the valve position in one installation, but it could control something totally different in another. You'd need to know the layout of the targeted system to know what parameters are controlled by what points.
- joe_bleau 16y agoI'm under the (mistaken?) impression it uses the SCADA system to actually modify some of the low-level PLC library code. If so, I'd be looking for code likely to be used (by the actual plant PLC program) to stabilize a very high speed centrifuge (servo routines maybe), and introduce slight instabilities, or even better, excite a resonance. "Hey, the VFDs are programmed to skip through this frequency band during the accel ramp to 25k RPM, but every once in a while they hickup and then the bearings rub. What's up with that?"
- borism 16y agoBut messing with various points at different facilities in the same way can still be catastrophic.
- humbledrone 16y agoVery true. A simple "set everything to zero" approach would probably bring any facility to a halt (if not worse).
- 16y ago
- ErrantX 16y agoTake care. While this does have a lot of clear information about Stuxnet it also has lots of idle speculation and "wink wink" stuff.
- ErrantX 16y agoOk, actually I do retract that. It's an excellent overview - I just didn't like the small pieces of speculation they did drop in without marking them as such ;)
- Tycho 16y agoIt said the registry key Stuxnet plants to indicate whether a system is already infected has the value 19790509. Then it said an Iranian Jewish business man was executed on that date for spying. Also the home directory where the virus was originally compiled was called Myrtus. Which may contain another clue...
- Tichy 16y agoHm, this is no fun scavenger hunt for hackers. It's serious. On the other hand, if you solve the puzzle, maybe you can sell your story to Hollywood.
- eli 16y agoI'm not really buying this. You're making a lot of assumptions. That Iran is the target, that the number is a date, that the date refers to that particular event, etc. The link between the word "Myrtus" and the Old Testament seems really strained. It's the name of a plant. It features prominently in Greek mythology -- maybe the Greeks did it?
- esspem 16y agoI don't think the link between old testament and myrtus is strained. 1) Eshter's born name is Hadassah, which means myrtle (http://en.wikipedia.org/wiki/Esther#Origin_and_meaning http://en.wikipedia.org/wiki/Esther#Origin_and_meaning) 2) When Eshter asked the king if Jews can kill their enemies, king granted the permission (http://www.biblegateway.com/passage/?search=esther%208:11-8:11&version=KJV http://www.biblegateway.com/passage/?search=esther%208:11-8:...)
- theycallmemorty 16y agoEsther was also married to a Persian King.
- borism 16y agoHe doesn't seem to make any assumptions to me. He states the known facts about it, that's all.
- 16s 16y agoI've read that there are three stolen Microsoft Authenticode certificates being used by stuxnet authors to sign the malware. I've used these sort of certs myself to sign executables. They require passphrases to use. I could believe that they cracked one passphrase to use one cert, but three? All from different companies too.
- mfukar 16y agoIt's much more likely that the certificate used were stolen (from Realtek Semiconductor Corp.), than cracked.
- illumin8 16y agoI find it more likely that the certificates were given to them by an employee that also shared the passcode.
- mfukar 16y agoSaid employee also kept her mouth shut? I don't know, conspiracy theories are not my forte.
- 16s 16y agoYes, but the point is that in order to use a stolen cert, you need the passcode and the cert. They somehow got three certs and three passcodes from three different companies.
- mfukar 16y agoThat's right. However, I think that if I were in a position to steal a certificate, it'd be trivial to also get the pass[code|phrase|whatever], assuming there even was one to begin with. ;-)
- ralphc 16y agoRealtek and JMricron were in the same building, maybe the third company is as well?
- rm-rf 16y agoThe F-Secure Q&A is relatively free from speculation. That's unusual for this particular event.
- twymer 16y ago"Siemens announced last year that Simatic can now also control alarm systems, access controls and doors. In theory, this could be used to gain access to top secret locations. Think Tom Cruise and Mission Impossible." I've been reading pretty much everything I can find about Stuxnet so far, but haven't heard this before. If it's true Stuxnet might really be living up to the hype that it's the "first malware of it's kind."
- iuguy 16y agoThis is quite possibly the best Q&A on Stuxnet I have seen. Kudos to F-Secure for not overhyping it.
- somewhere 16y agodoes anyone know where to get stuxnet from? can't find it on the regular virii sources...
- pilate 16y agoThere's at least one sample on OffensiveComputing.
- atomical 16y agoI could see a lot of nefarious individuals learning from this and using it to cause tragedies for short-term gain (i.e. shorting a stock). It does seem quite stupid to open up the door on something that could cause so much harm.
- flipbrad 16y agothe possibility of it sinking BP's Deepwater Rig was interesting, not something I had considered before reading it in the Q&A
- njharman 16y agoStuxnet amazes me. My first tech job was (in part) installing anti-virus on every computer in the Univ KS Library system, 1989-90. MS-DOS days. I've been an avid watcher (not expert) of malware since. I've watched the Internet arrive and embedded computer/automation revolutions. This 20yr perspective brings me to the following conclusion. Other than "jacking in" and other fluff Stuxnet does pretty much exactly the kinds of things that CyberPunk Sci-fi described a decade ago. I flippin love living in the future.
- TrevorJ 16y ago"Q: How could governments get something so complex right? A: Trick question. Nice. Next question." That one caught me off guard.
- statictype 16y agoWithout Autorun enabled, how does code get executed on a usb drive?
- uxp 16y agoEven when autorun is disabled, Windows will parse through the autorun.inf file. This should have been patched with KB967715. U3 enabled devices have been known to override the default settings in order to emulate CD-ROM drives. Double clicking the flash-drive icon can also force execution of binaries, but I am unsure of how that works and if it is related to the user's autorun settings or not.
- Riesling 16y agohttp://www.microsoft.com/technet/security/bulletin/ms10-046.mspx http://www.microsoft.com/technet/security/bulletin/ms10-046.... "The vulnerability could allow remote code execution if the icon of a specially crafted shortcut is displayed."
- losethos 16y agoI don't really think you want a factory susceptable to software bugs. I would think they would design stuff with hardware saftey measures. Maybe not. On a PC, for example, it's pretty much impossible for software to damage hardware. (As far as I know. Maybe thermal stuff can be adjusted, but I doubt it.) It is no longer the case a monitor can be ruined, I'm pretty sure.