3 ms·
I am completely aware of how it worked and you seem to have ignored what I said. The organizational effort to collect the 0 days, target the right centrifuges,
by hueving 8y ago
I am completely aware of how it worked and you seem to have ignored what I said. The organizational effort to collect the 0 days, target the right centrifuges, etc is what was impressive but there was nothing new technological there. Putting together multiple 0 days is how hackers win sandbox busting competitions for browsers.
Stuxnet has been analyzed in detail and there were no new special hacking techniques like unknown ASLR vulnerabilities or arbitrary unprivileged memory reads like spectre. It was just some 0-days wrapped up with a laser focused task that took years of effort to research.
It's shockingly impressive how much effort went into researching what needed to be done, not the actual mechanism thag was used to do it.
If someone plans out a super elaborate assassination of the hardest target in the world and completes it with a homemade shiv, you don't comment on how impressive the shiv itself was. It was the ability to know when/where/how that was impressive.
- snovv_crash 8y agoYeah, if Stuxnet had been using something like Spectre or Meltdown the world really would have exploded. And without the source/whitepaper I'm not sure people would have even figured out what it was doing for quite a while.
- deleted 8y ago[deleted]
- jradd 8y agoThey say Stuxnet featured nothing very new or technological but I don’t recall anything else infecting PLC’s and using ambient temperature sensors to define behavior. That is just one techno. aspect I found original. The fact that this wasn’t anything new to Symantec researchers is kinda frightening of itself.
- hueving 8y ago>but I don’t recall anything else infecting PLC’s and using ambient temperature sensors to define behavior. That is just one techno. aspect I found original. The target was interesting and the attack subtle, but attacks on industrial control systems had been the target of research even in the public in the same time frame: http://edition.cnn.com/2007/US/09/26/power.at.risk/ http://edition.cnn.com/2007/US/09/26/power.at.risk/