4 ms·

The virus had been in place a relatively long time before it's public disclosure in June. Also the way the virus was designed it wasn't going to damage all of t

by Swannie 16y ago

The virus had been in place a relatively long time before it's public disclosure in June. Also the way the virus was designed it wasn't going to damage all of the rotors anyway.

acqq 16y ago
> the way the virus was designed it wasn't going to damage all of the rotors anyway Why not? Why shouldn't it make as much damage as possible, as it attracted too much attention anyway? > had been in place a relatively long time I think the version that became analyzed all over the world (with the last certificate) was discovered very soon after it was introduced. It still sounds to me more like something for what somebody got some promotion than something that did the damage appropriate to the money/time invested.
- Swannie 16y ago
  I'd suggest anyone who has a real interest in this checks out the Symantec dossier: http://www.symantec.com/connect/blogs/w32stuxnet-dossier http://www.symantec.com/connect/blogs/w32stuxnet-dossier The virus was first identified in late 2008, and was in the wild, in various forms until June 2010 when it was identified and advertised to the world. Let's assume it went 2 years from release to June. That's a relatively long time, even if half of that was reconnaissance. To quote the Symantec document: "Thus, the targeted system is using Profibus to communicate with at least 33 frequency converter drives from one or both of the two manufacturers, where sequence A is chosen if more Vacon devices are present and sequence B is chosen if more Fararo Paya devices are present." The upshot (to my understanding) is that only one type of frequency converter drive can be targeted per bus. If the buses are mixed, e.g. 50/50, only half the drives on that bus will be targeted. Additionally, if the bus has less than 31 devices on it, then it is not targeted. We can assume that at least a few of these buses were not hooked up to a full compliment of converter drivers.
  - acqq 16y ago
    > The virus was first identified in late 2008 No. According to the document you link, the first known exploit of the vuln used later by Stuxnet was in Nov 2008, but by some other trojan. The oldest known Stuxnet is from June 2009, one year later it was already prominent. It had just a little over one year to "quietly do its magic." Results? Already one month ago: http://www.iranlivenews.com/2010/11/20/stuxnet-worm-was-perfect-for-sabotaging-bushehr-centrifuges/ http://www.iranlivenews.com/2010/11/20/stuxnet-worm-was-perf... "Iran has experienced many problems keeping its centrifuges running, with hundreds removed from active service since summer 2009." And that, compared to what? How often do you have to remove the centrifuges during the normal operation if you have 10 thousands of them on one location and you are just developing the process? Couldn't it be the normal rate of failure for that situation? Note also that the latest brand new certificate used in the latest Stuxnet variant was from July 2010 (at the time it was already known by antivirus companies) which means that the authors still failed to have it at the target, otherwise they wouldn't need to make the new variant with the new certs! Doesn't it seem like they panicked because the goal was not reached at the time the antivirus companies started to actively detect it?
    - jeffreyg 16y ago
      You've made an important distinction here - variations of the LNK zero-day exploit used by stuxnet to propagate were first identified in late 2008. This should not be confused with the idea that Stuxnet has been around for that long.
    - Swannie 16y ago
      I stand corrected as to the date. I should have fact checked against the dossier :-( Well if you've been successfully exploiting a broken certificate, and it gets busted, and you have another spare one, are you going to use it or leave it? Probably use it. Ahmadinejad is quoted by Reuters as saying "They succeeded in creating problems for a limited number of our centrifuges with the software they had installed in electronic parts". Sounds like it got in to me.
      - acqq 16y ago
        > Well if you've been successfully exploiting a broken certificate, and it gets busted, and you have another spare one, are you going to use it or leave it? Probably use it. No: if you reached the target with your trojan and if your trojan is made to quietly disrupt then the last thing you want is to raise the awareness of your target by making a newer version with a newer certificate, which is then immediately recognized by all antivirus vendors, and which induces your target to recheck all their configurations and add the protections.

by Swannie 16y ago

The virus had been in place a relatively long time before it's public disclosure in June. Also the way the virus was designed it wasn't going to damage all of the rotors anyway.

acqq 16y ago

> the way the virus was designed it wasn't going to damage all of the rotors anyway Why not? Why shouldn't it make as much damage as possible, as it attracted too much attention anyway? > had been in place a relatively long time I think the version that became analyzed all over the world (with the last certificate) was discovered very soon after it was introduced. It still sounds to me more like something for what somebody got some promotion than something that did the damage appropriate to the money/time invested.

Swannie 16y ago
I'd suggest anyone who has a real interest in this checks out the Symantec dossier: http://www.symantec.com/connect/blogs/w32stuxnet-dossier http://www.symantec.com/connect/blogs/w32stuxnet-dossier The virus was first identified in late 2008, and was in the wild, in various forms until June 2010 when it was identified and advertised to the world. Let's assume it went 2 years from release to June. That's a relatively long time, even if half of that was reconnaissance. To quote the Symantec document: "Thus, the targeted system is using Profibus to communicate with at least 33 frequency converter drives from one or both of the two manufacturers, where sequence A is chosen if more Vacon devices are present and sequence B is chosen if more Fararo Paya devices are present." The upshot (to my understanding) is that only one type of frequency converter drive can be targeted per bus. If the buses are mixed, e.g. 50/50, only half the drives on that bus will be targeted. Additionally, if the bus has less than 31 devices on it, then it is not targeted. We can assume that at least a few of these buses were not hooked up to a full compliment of converter drivers.
- acqq 16y ago
  > The virus was first identified in late 2008 No. According to the document you link, the first known exploit of the vuln used later by Stuxnet was in Nov 2008, but by some other trojan. The oldest known Stuxnet is from June 2009, one year later it was already prominent. It had just a little over one year to "quietly do its magic." Results? Already one month ago: http://www.iranlivenews.com/2010/11/20/stuxnet-worm-was-perfect-for-sabotaging-bushehr-centrifuges/ http://www.iranlivenews.com/2010/11/20/stuxnet-worm-was-perf... "Iran has experienced many problems keeping its centrifuges running, with hundreds removed from active service since summer 2009." And that, compared to what? How often do you have to remove the centrifuges during the normal operation if you have 10 thousands of them on one location and you are just developing the process? Couldn't it be the normal rate of failure for that situation? Note also that the latest brand new certificate used in the latest Stuxnet variant was from July 2010 (at the time it was already known by antivirus companies) which means that the authors still failed to have it at the target, otherwise they wouldn't need to make the new variant with the new certs! Doesn't it seem like they panicked because the goal was not reached at the time the antivirus companies started to actively detect it?
  - jeffreyg 16y ago
    You've made an important distinction here - variations of the LNK zero-day exploit used by stuxnet to propagate were first identified in late 2008. This should not be confused with the idea that Stuxnet has been around for that long.
  - Swannie 16y ago
    I stand corrected as to the date. I should have fact checked against the dossier :-( Well if you've been successfully exploiting a broken certificate, and it gets busted, and you have another spare one, are you going to use it or leave it? Probably use it. Ahmadinejad is quoted by Reuters as saying "They succeeded in creating problems for a limited number of our centrifuges with the software they had installed in electronic parts". Sounds like it got in to me.
    - acqq 16y ago
      > Well if you've been successfully exploiting a broken certificate, and it gets busted, and you have another spare one, are you going to use it or leave it? Probably use it. No: if you reached the target with your trojan and if your trojan is made to quietly disrupt then the last thing you want is to raise the awareness of your target by making a newer version with a newer certificate, which is then immediately recognized by all antivirus vendors, and which induces your target to recheck all their configurations and add the protections.