7 ms·

Stuxnet is embarrassing, not amazing

72 points by r11t 16y ago

geophile 16y ago
I know nothing about malware, but I know a lot about shipping production software. - Simpler is better than complicated. As pointed out in one of the comments on the article, increasing complexity increases risk of failure. - Proven techniques are, uhh, proven. Newer techniques are inherently riskier. - Really speculating here, but maybe impenetrable obfuscation was actually undesirable? I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it. A successful cyber-attack means that future attacks of the same sort are possible, and adds a bargaining chip to the Israeli/US side. This can lead to Iranian concessions down the road. Without a proven success, a similar negotiation tactic would have to be much more difficult.
- viraptor 16y ago
  Alternatively, maybe they just thought it is not that important? They were attacking important infrastructure. They were actually going against a country... which had access to the destination machines. As long as they go through usual AVs and don't do extensive dynamic updates of the malware, how much time would they gain? How many experienced people were really looking at that thing? Since their attack wasn't really done the day after the malware was released, even hiding the payload for a month or more wouldn't make much difference in reality, would it?
- gte910h 16y ago
  >Really speculating here, but maybe impenetrable obfuscation was actually undesirable? I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it. I think the idea (Making the red team have to put up with expensive and costly countermeasures to malware) is a good one, however I think it is unlikely the reason this was detected.
- potatolicious 16y ago
  > "I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it." Or perhaps it was engineered to be as complex as necessary to accomplish the job (sabotage), but simple enough that Israel didn't have to show all of its cyber-warfare cards. There's a good chance that any worm, no matter how engineered, will be detected and reverse engineered. It makes sense not to go all-in on any single one and reveal your techniques unless the difficulty of intrusion calls for it.
- NateLawson 16y ago
  The technique I describe is actually less-risky in terms of false positives. If you don't get the right combination of inputs right, you literally can't decrypt the payload. Even 1 bit of error gives a completely invalid key. It also isn't a new technique. I've seen it in shipping products for at least 12 years. The one valid criticism is that it is more work to implement. But it's not that hard.
raganwald 16y ago
No wireless. Less space than a nomad. Lame. Substitute any of a thousand critiques of <any language except Lisp|Haskell>, Windows, Linux, you name it that is out in the world getting its job done.
- tptacek 16y ago
  Uncharacteristically facile. The subtext of Nate's post is that while Stuxnet clearly didn't foreclose on Iran's nuclear ambitions, its careless design may have foreclosed on an otherwise viable nonviolent method of shutting down the harmful industrial processes of other rogue states. Nate is saying, take exactly one step back and look at Stuxnet and you see that it has two jobs: one†, to retard the Iranian nuclear program, and two, to do so at a minimal cost to future intelligence activities. At that second objective it seems to have demonstrably failed; there are teenagers who have done better jobs of concealing the payloads of malware. † If you believe all the Stuxnet press.
  - raganwald 16y ago
    I like your thinking, but the tone of the post doesn't communicate that point as well as your comment. Now as to point two, I read elsewhere in these comments that one possible advantage of Stuxnet's simplicity is that whomever launched this attack can launch another one with a higher level of stealth. You are the expert, not I. I only know that in Sports this is often a good strategy. Hold off on your strongest plays until the opposition has proven they can stop your average plays.
    - NateLawson 16y ago
      The problem with that approach is the game is over once your infection route is revealed. You don't get to play your stronger plays. No one will attach a USB flash drive to any Iranian or North Korean industrial computer now. Why burn a perfectly good vector when you don't have to?
gcb 16y ago
You don't want to hide your weapons in an arms race.
- deleted 16y ago
  [deleted]
- nikcub 16y ago
  My own theory is that after watching Iran kill themselves for a year trying to figure this thing out, they sent out an update of Stuxnet that made it easier to discover as a way of showing their hand. By that point, according to most reports, the program had been set back by three years (as effective as what a military strike would have been, according to the NYT article). It was hidden for almost two years, then suddenly discovered - at which point dozens of security companies around the world deconstructed the worm in a process that took weeks.
deleted 16y ago
[deleted]
fleitz 16y ago
The simplicity of the design makes it easy to point fingers at non-US / Israeli sources. Via the simplistic design the US and Israel have plausible deniability. When a piece of malware looks no different than any other released last year then it could well have been developed by bulgarian teenagers. Bulgarian teenagers will raise less international issues than using advanced techniques that only the highly trained CIA / NSA / Mossad operatives have.
- mxavier 16y ago
  Most Bulgarian teenagers don't have access to nuclear centrifuge controller units for the purpose of designing/testing their code.
jcl 16y ago
Or perhaps the software got an accidental "early release"?
redthrowaway 16y ago
As to the "in a hurry" bit, we know that to be true, or at least we do if we believe the recent NYT article. Obama was, according to that article, briefed on Stuxnet before coming into office. As soon as he was in office, he rushed the program. It may be that he simply removed some bureaucratic hurdles, or he may have told the team that said they needed 9 months to get in done in 4. I suspect we'll never know.
georgieporgie 16y ago
I do not understand this criticism at all. Stuxnet worked, right?
- MichaelSalib 16y ago
  Assuming that Stuxnet was designed to delay Iranian nuclear efforts, there are different degrees of "working". Delaying for a week is better than delaying for a day, etc. If better cloaking would have allowed Stuxnet to remain hidden for longer, than it would have delayed Iranian nuclear efforts more.
  - eli 16y ago
    Sending a clear message of, "we have the ability to launch effective cyberattacks against you" may have been a goal as well. Make it too stealthy and it might be a while before anyone realizes they were attacked.
InclinedPlane 16y ago
The current interpretation of events is that Stuxnet is a project of the Israeli government which has been at least partially successful in slowing Iran's attempts to build nuclear weapons. Considering that the alternative would be bombing of nuclear facilities involving perhaps unauthorized overflights of neighboring countries and the risk of inflaming a hot war in the middle east (through the overflights and the bombings) I don't think I can rate this operation as anything other than a huge success.
- rbanffy 16y ago
  A huge success would be if it derailed Iran's nuclear program completely and managed to contaminate the installations for the next couple thousand years, with enough warning as to avoid loss of human life, while forcing Iran to rebuild from scratch somewhere else and, at the same time, leave their authorities wondering what kind of bad luck hit them. Of course, not all Israeli military want to avoid a confrontation. Military don't usually get medals for preventing wars.
- kreneskyp 16y ago
  according to leaked cables some middle eastern countries actually encouraged us to bomb Iran. Otherwise I agree that a non-military solution is at least initially appealing. I fear whoever unleashed this has opened a pandora's box of destructive malware. We've already seen things like China hacking major corporations and manipulating it's currency. It's not hard to picture a future where malware is used to hurt the competition's production, at either a corporate or state level.
  - InclinedPlane 16y ago
    From the perspective of just about every other country in the region there is a hell of a lot of difference between Israel bombing Iran and the US bombing Iran.
- NateLawson 16y ago
  All the current interpretations of events commit the fallacy of "if A then B, B therefore A". Just because centrifuges have purportedly been taken offline recently doesn't mean Stuxnet necessarily caused it. There are other potential causes that are more mundane.
ig1 16y ago
Stuxnet is a hugely complex piece of code already, and it's something that needed to be as bug free as possible, and that means avoiding unnecessary complexity. A key part of being a software developer is knowing when to make trade-offs rather than striving for "perfection". The virus did it's complex job successfully. Building a piece of software of this complexity that has to work in an unknown environment first time is amazing.
- marcinw 16y ago
  Being a software developer and being an exploit developer are two entirely different things. Professional exploit developers DO NOT ship unless it's perfect. Malware authors will ship even if it's not perfect, because the target is not technically advanced and can get away with it. If you're targeting a nation-state, you best not compromise your intent, how you broke in, nor how long you've been there for.
  - NateLawson 16y ago
    Yes, that is the exact point of this article.
danilocampos 16y ago
Real Mossad Operatives Ship. These guys weren't making a paean to beautiful, hardened software to impress their hacker friends. They needed to get the simplest, most reliable and effective code possible out the door in as short a time as possible. Israel bought itself a few more years of a nuke-free Iran. This is a successful, amazing, even miraculous outcome. Outside of nerd circles, software is measured by results, not architecture or complexity. Beautiful systems that never ship are fine for weekend projects but, uh, we're talking about stopping a nuclear weapons program here. It's a bit like saying that Apollo 11 was bullshit because the accommodations weren't anywhere near as nice as flying on Pan Am. Stuxnet is the Jack Bauer of software. Rough edges but badass and gets the job done under impossible circumstances.
- MichaelSalib 16y ago
  Israel bought itself a few more years of a nuke-free Iran. Do we actually know that? Is there any evidence that this delayed the program by "years" rather than a few months?
  - tkahn6 16y ago
    Seems like they really messed them up. According to Western intelligence reports, Russian scientists warned the Kremlin that they could be facing "another Chernobyl" if they were forced to comply with Iran's tight deadline to activate the complex this summer. http://www.telegraph.co.uk/news/worldnews/europe/russia/8262853/Stuxnet-virus-attack-Russia-warns-of-Iranian-Chernobyl.html http://www.telegraph.co.uk/news/worldnews/europe/russia/8262...
    - MichaelSalib 16y ago
      I am really confused. I thought the goal of Stuxnet was to delay the production of Iranian enrichment efforts at Natanz. Not to delay a civilian reactor at Bushehr, which is hundreds of miles away. Assuming the Telegraph report is correct, I don't see how this tells us anything about how effective Stuxnet was at delaying enrichment efforts.
deleted 16y ago
[deleted]
nikcub 16y ago
Stuxnet worked. Very well. It was out in the wild, by best estimates, for over two years before it was detected. During that time it caused complete chaos within the Iranian nuclear program (to the point where some officials were executed on the suspicion of espionage). This post and its backhanded compliments are very arrogant in a way that epitomizes everything that is wrong with the security industry. It is a game of one-upmanship amongst those who can talk the talk but not walk the walk. This blog post is basically: Dear most successful team of virus and backdoor writers in history who completely changed the paradigm for what worms can do, I suggest you read this book that I probably know nothing about or haven't read and definitely do not understand. Ps. here are a ton of links to stuff I googled that you didn't do, pss. isn't it awesome that you are anonymous and can't respond to my criticism? psss. Did you get the part about me being smart? Pathetic. To make it worse, the entire industry is full of such assholes.
- m0nastic 16y ago
  I don't happen to share Nate's opinion that Stuxnet is embarrassing, but I think your characterization of him based on his blog post is pretty off-base.
  - nikcub 16y ago
    It wasn't a specific characterization of Nate, but rather a generalized, overly sarcastic and sweeping view of the security industry as a whole. Many in security are just far too condescending, as this post was (not just wrong, but smug to boot). For some reason there is a constant, tense competition between netsec bloggers and personalities for absolutely no reason. It is ridiculous.
    - m0nastic 16y ago
      You said "This blog post is basically:", which I took to mean that you referring to him specifically (as he is the author of the blog post). I apologize if you weren't targeting him specifically. Many in security are indeed condescending, although I don't find it to be more true than in the computer community at large; especially amongst programmers (who seem to feel an almost intrinsic need to disparage someone else's opinion about a language or design choice). It might just be that we travel in different circles, but I actually am constantly impressed with how helpful and non-condescending most folks in the security community are. I frequently ask questions of people on Twitter who are among the best in the industry and I generally get really helpful replies (as helpful as you can be in 140 characters). And I don't know Nate personally (I only refer to him by his first name because "Mr. Lawson" has a bit too much of a "Agent Smith" vibe to it), but I've never gotten the impression from anything he's written that he's smug or especially competitive about the infosec industry.
jessriedel 16y ago
Most of the comments here seem to be of the form "Well, maybe Stuxnet isn't that elegant, but it got the job done and that's what matters", but is it really that bad of software? All the technical people I've heard discuss the software in person gush over how advanced and clever it is. Can anyone point me toward a more technical discussion of Stuxnet which could confirm/dispute the OP's view?
- NateLawson 16y ago
  Well, you can compare the Symantec analysis for Stuxnet to other malware (say, Conficker, the previous media darling). http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf http://www.symantec.com/content/en/us/enterprise/media/secur... http://www.malwareinfo.org/files/W32.DownadupThreat.pdf http://www.malwareinfo.org/files/W32.DownadupThreat.pdf You'll notice that most of the gushing has devolved to focusing on the payload and not the infection mechanism. That's because the worm itself is surprisingly average.
rbanffy 16y ago
I think it's safe to assume Iran will no longer control their nuclear facilities with Windows boxes...
- kenjackson 16y ago
  Nor use OpenBSD ;-)
Desireco 16y ago
Stuxnet is really dangerous precedent, where hacking is legitimized to the point of destroying nuclear facilities. Chinese now can't be criticized for spying on gmail as this was lesser intrusion then this. If tomorrow some rogue group, and there is always a rogue group would use us computers to create havoc here, and I don't even want to speculate and give ideas on what can be hacked, they can always say it is the same like this. Having said all this, I would like to say that in terms of working software, this got the job done. So yeah, maybe not as cool as some newer viruses, but it did what it was supposed to do. Which is why I am worried what Chinese can do as they seem to be more advanced.
GHFigs 16y ago
It may be that the authors did not want to telegraph their true capabilities to other state actors with cyberwarfare units. Although Iran is one such nation, the outcome suggests they're too far behind to constitute a threat. More sophisticated states are looking at this and either learning: 1) that Israeli/US offensive cyberwarfare capability is much weaker than they previously believed, or 2) nothing, because they already know better.
Stonewall9093 16y ago
I'm a sophomore CS major in college now. I've had several interviews for summer internships with some big name companies (i.e Facebook, Amazon, etc.). Is there a large discrepancy in sophomore->junior interns compared to junior->senior interns? Thanks for the advice though!
Tycho 16y ago
I don't see what the problem is... I thought everyone was in favour of launching with a minimal viable product these days. But seriously, maybe the thing was cobbled together from a whole bunch of government workers/contractors who didn't really know what they were building. Sort of like that film, Cube. Hence the lack of finesse. Or, maybe they wanted it to be analysed so other factions would be less wary of it. I mean, who knows.
shareme 16y ago
Consider this: -Obfuscation is often used to obscure the operative. I submit the conclusion that Stuxnet was 'dumbed' down on purpose to obscure which country wrote it. Also by obfuscation of the virus one can also send a strong message of 'You do not know who attacked and you will never know'

72 points by r11t 16y ago

I know nothing about malware, but I know a lot about shipping production software. - Simpler is better than complicated. As pointed out in one of the comments on the article, increasing complexity increases risk of failure. - Proven techniques are, uhh, proven. Newer techniques are inherently riskier. - Really speculating here, but maybe impenetrable obfuscation was actually undesirable? I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it. A successful cyber-attack means that future attacks of the same sort are possible, and adds a bargaining chip to the Israeli/US side. This can lead to Iranian concessions down the road. Without a proven success, a similar negotiation tactic would have to be much more difficult.

viraptor 16y ago
Alternatively, maybe they just thought it is not that important? They were attacking important infrastructure. They were actually going against a country... which had access to the destination machines. As long as they go through usual AVs and don't do extensive dynamic updates of the malware, how much time would they gain? How many experienced people were really looking at that thing? Since their attack wasn't really done the day after the malware was released, even hiding the payload for a month or more wouldn't make much difference in reality, would it?
gte910h 16y ago
>Really speculating here, but maybe impenetrable obfuscation was actually undesirable? I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it. I think the idea (Making the red team have to put up with expensive and costly countermeasures to malware) is a good one, however I think it is unlikely the reason this was detected.
potatolicious 16y ago
> "I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it." Or perhaps it was engineered to be as complex as necessary to accomplish the job (sabotage), but simple enough that Israel didn't have to show all of its cyber-warfare cards. There's a good chance that any worm, no matter how engineered, will be detected and reverse engineered. It makes sense not to go all-in on any single one and reveal your techniques unless the difficulty of intrusion calls for it.
NateLawson 16y ago
The technique I describe is actually less-risky in terms of false positives. If you don't get the right combination of inputs right, you literally can't decrypt the payload. Even 1 bit of error gives a completely invalid key. It also isn't a new technique. I've seen it in shipping products for at least 12 years. The one valid criticism is that it is more work to implement. But it's not that hard.

raganwald 16y ago

No wireless. Less space than a nomad. Lame. Substitute any of a thousand critiques of <any language except Lisp|Haskell>, Windows, Linux, you name it that is out in the world getting its job done.

tptacek 16y ago
Uncharacteristically facile. The subtext of Nate's post is that while Stuxnet clearly didn't foreclose on Iran's nuclear ambitions, its careless design may have foreclosed on an otherwise viable nonviolent method of shutting down the harmful industrial processes of other rogue states. Nate is saying, take exactly one step back and look at Stuxnet and you see that it has two jobs: one†, to retard the Iranian nuclear program, and two, to do so at a minimal cost to future intelligence activities. At that second objective it seems to have demonstrably failed; there are teenagers who have done better jobs of concealing the payloads of malware. † If you believe all the Stuxnet press.
- raganwald 16y ago
  I like your thinking, but the tone of the post doesn't communicate that point as well as your comment. Now as to point two, I read elsewhere in these comments that one possible advantage of Stuxnet's simplicity is that whomever launched this attack can launch another one with a higher level of stealth. You are the expert, not I. I only know that in Sports this is often a good strategy. Hold off on your strongest plays until the opposition has proven they can stop your average plays.
  - NateLawson 16y ago
    The problem with that approach is the game is over once your infection route is revealed. You don't get to play your stronger plays. No one will attach a USB flash drive to any Iranian or North Korean industrial computer now. Why burn a perfectly good vector when you don't have to?

gcb 16y ago

You don't want to hide your weapons in an arms race.

deleted 16y ago
[deleted]
nikcub 16y ago
My own theory is that after watching Iran kill themselves for a year trying to figure this thing out, they sent out an update of Stuxnet that made it easier to discover as a way of showing their hand. By that point, according to most reports, the program had been set back by three years (as effective as what a military strike would have been, according to the NYT article). It was hidden for almost two years, then suddenly discovered - at which point dozens of security companies around the world deconstructed the worm in a process that took weeks.

deleted 16y ago

[deleted]

fleitz 16y ago

The simplicity of the design makes it easy to point fingers at non-US / Israeli sources. Via the simplistic design the US and Israel have plausible deniability. When a piece of malware looks no different than any other released last year then it could well have been developed by bulgarian teenagers. Bulgarian teenagers will raise less international issues than using advanced techniques that only the highly trained CIA / NSA / Mossad operatives have.

mxavier 16y ago
Most Bulgarian teenagers don't have access to nuclear centrifuge controller units for the purpose of designing/testing their code.

jcl 16y ago

Or perhaps the software got an accidental "early release"?

redthrowaway 16y ago

As to the "in a hurry" bit, we know that to be true, or at least we do if we believe the recent NYT article. Obama was, according to that article, briefed on Stuxnet before coming into office. As soon as he was in office, he rushed the program. It may be that he simply removed some bureaucratic hurdles, or he may have told the team that said they needed 9 months to get in done in 4. I suspect we'll never know.

georgieporgie 16y ago

I do not understand this criticism at all. Stuxnet worked, right?

MichaelSalib 16y ago
Assuming that Stuxnet was designed to delay Iranian nuclear efforts, there are different degrees of "working". Delaying for a week is better than delaying for a day, etc. If better cloaking would have allowed Stuxnet to remain hidden for longer, than it would have delayed Iranian nuclear efforts more.
- eli 16y ago
  Sending a clear message of, "we have the ability to launch effective cyberattacks against you" may have been a goal as well. Make it too stealthy and it might be a while before anyone realizes they were attacked.

InclinedPlane 16y ago

The current interpretation of events is that Stuxnet is a project of the Israeli government which has been at least partially successful in slowing Iran's attempts to build nuclear weapons. Considering that the alternative would be bombing of nuclear facilities involving perhaps unauthorized overflights of neighboring countries and the risk of inflaming a hot war in the middle east (through the overflights and the bombings) I don't think I can rate this operation as anything other than a huge success.

rbanffy 16y ago
A huge success would be if it derailed Iran's nuclear program completely and managed to contaminate the installations for the next couple thousand years, with enough warning as to avoid loss of human life, while forcing Iran to rebuild from scratch somewhere else and, at the same time, leave their authorities wondering what kind of bad luck hit them. Of course, not all Israeli military want to avoid a confrontation. Military don't usually get medals for preventing wars.
kreneskyp 16y ago
according to leaked cables some middle eastern countries actually encouraged us to bomb Iran. Otherwise I agree that a non-military solution is at least initially appealing. I fear whoever unleashed this has opened a pandora's box of destructive malware. We've already seen things like China hacking major corporations and manipulating it's currency. It's not hard to picture a future where malware is used to hurt the competition's production, at either a corporate or state level.
- InclinedPlane 16y ago
  From the perspective of just about every other country in the region there is a hell of a lot of difference between Israel bombing Iran and the US bombing Iran.
NateLawson 16y ago
All the current interpretations of events commit the fallacy of "if A then B, B therefore A". Just because centrifuges have purportedly been taken offline recently doesn't mean Stuxnet necessarily caused it. There are other potential causes that are more mundane.

ig1 16y ago

Stuxnet is a hugely complex piece of code already, and it's something that needed to be as bug free as possible, and that means avoiding unnecessary complexity. A key part of being a software developer is knowing when to make trade-offs rather than striving for "perfection". The virus did it's complex job successfully. Building a piece of software of this complexity that has to work in an unknown environment first time is amazing.

marcinw 16y ago
Being a software developer and being an exploit developer are two entirely different things. Professional exploit developers DO NOT ship unless it's perfect. Malware authors will ship even if it's not perfect, because the target is not technically advanced and can get away with it. If you're targeting a nation-state, you best not compromise your intent, how you broke in, nor how long you've been there for.
- NateLawson 16y ago
  Yes, that is the exact point of this article.

danilocampos 16y ago

Real Mossad Operatives Ship. These guys weren't making a paean to beautiful, hardened software to impress their hacker friends. They needed to get the simplest, most reliable and effective code possible out the door in as short a time as possible. Israel bought itself a few more years of a nuke-free Iran. This is a successful, amazing, even miraculous outcome. Outside of nerd circles, software is measured by results, not architecture or complexity. Beautiful systems that never ship are fine for weekend projects but, uh, we're talking about stopping a nuclear weapons program here. It's a bit like saying that Apollo 11 was bullshit because the accommodations weren't anywhere near as nice as flying on Pan Am. Stuxnet is the Jack Bauer of software. Rough edges but badass and gets the job done under impossible circumstances.

MichaelSalib 16y ago
Israel bought itself a few more years of a nuke-free Iran. Do we actually know that? Is there any evidence that this delayed the program by "years" rather than a few months?
- tkahn6 16y ago
  Seems like they really messed them up. According to Western intelligence reports, Russian scientists warned the Kremlin that they could be facing "another Chernobyl" if they were forced to comply with Iran's tight deadline to activate the complex this summer. http://www.telegraph.co.uk/news/worldnews/europe/russia/8262853/Stuxnet-virus-attack-Russia-warns-of-Iranian-Chernobyl.html http://www.telegraph.co.uk/news/worldnews/europe/russia/8262...
  - MichaelSalib 16y ago
    I am really confused. I thought the goal of Stuxnet was to delay the production of Iranian enrichment efforts at Natanz. Not to delay a civilian reactor at Bushehr, which is hundreds of miles away. Assuming the Telegraph report is correct, I don't see how this tells us anything about how effective Stuxnet was at delaying enrichment efforts.

deleted 16y ago

[deleted]

nikcub 16y ago

Stuxnet worked. Very well. It was out in the wild, by best estimates, for over two years before it was detected. During that time it caused complete chaos within the Iranian nuclear program (to the point where some officials were executed on the suspicion of espionage). This post and its backhanded compliments are very arrogant in a way that epitomizes everything that is wrong with the security industry. It is a game of one-upmanship amongst those who can talk the talk but not walk the walk. This blog post is basically: Dear most successful team of virus and backdoor writers in history who completely changed the paradigm for what worms can do, I suggest you read this book that I probably know nothing about or haven't read and definitely do not understand. Ps. here are a ton of links to stuff I googled that you didn't do, pss. isn't it awesome that you are anonymous and can't respond to my criticism? psss. Did you get the part about me being smart? Pathetic. To make it worse, the entire industry is full of such assholes.

m0nastic 16y ago
I don't happen to share Nate's opinion that Stuxnet is embarrassing, but I think your characterization of him based on his blog post is pretty off-base.
- nikcub 16y ago
  It wasn't a specific characterization of Nate, but rather a generalized, overly sarcastic and sweeping view of the security industry as a whole. Many in security are just far too condescending, as this post was (not just wrong, but smug to boot). For some reason there is a constant, tense competition between netsec bloggers and personalities for absolutely no reason. It is ridiculous.
  - m0nastic 16y ago
    You said "This blog post is basically:", which I took to mean that you referring to him specifically (as he is the author of the blog post). I apologize if you weren't targeting him specifically. Many in security are indeed condescending, although I don't find it to be more true than in the computer community at large; especially amongst programmers (who seem to feel an almost intrinsic need to disparage someone else's opinion about a language or design choice). It might just be that we travel in different circles, but I actually am constantly impressed with how helpful and non-condescending most folks in the security community are. I frequently ask questions of people on Twitter who are among the best in the industry and I generally get really helpful replies (as helpful as you can be in 140 characters). And I don't know Nate personally (I only refer to him by his first name because "Mr. Lawson" has a bit too much of a "Agent Smith" vibe to it), but I've never gotten the impression from anything he's written that he's smug or especially competitive about the infosec industry.

jessriedel 16y ago

Most of the comments here seem to be of the form "Well, maybe Stuxnet isn't that elegant, but it got the job done and that's what matters", but is it really that bad of software? All the technical people I've heard discuss the software in person gush over how advanced and clever it is. Can anyone point me toward a more technical discussion of Stuxnet which could confirm/dispute the OP's view?

NateLawson 16y ago
Well, you can compare the Symantec analysis for Stuxnet to other malware (say, Conficker, the previous media darling). http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf http://www.symantec.com/content/en/us/enterprise/media/secur... http://www.malwareinfo.org/files/W32.DownadupThreat.pdf http://www.malwareinfo.org/files/W32.DownadupThreat.pdf You'll notice that most of the gushing has devolved to focusing on the payload and not the infection mechanism. That's because the worm itself is surprisingly average.

rbanffy 16y ago

I think it's safe to assume Iran will no longer control their nuclear facilities with Windows boxes...

kenjackson 16y ago
Nor use OpenBSD ;-)

Desireco 16y ago

Stuxnet is really dangerous precedent, where hacking is legitimized to the point of destroying nuclear facilities. Chinese now can't be criticized for spying on gmail as this was lesser intrusion then this. If tomorrow some rogue group, and there is always a rogue group would use us computers to create havoc here, and I don't even want to speculate and give ideas on what can be hacked, they can always say it is the same like this. Having said all this, I would like to say that in terms of working software, this got the job done. So yeah, maybe not as cool as some newer viruses, but it did what it was supposed to do. Which is why I am worried what Chinese can do as they seem to be more advanced.

GHFigs 16y ago

It may be that the authors did not want to telegraph their true capabilities to other state actors with cyberwarfare units. Although Iran is one such nation, the outcome suggests they're too far behind to constitute a threat. More sophisticated states are looking at this and either learning: 1) that Israeli/US offensive cyberwarfare capability is much weaker than they previously believed, or 2) nothing, because they already know better.

Stonewall9093 16y ago

I'm a sophomore CS major in college now. I've had several interviews for summer internships with some big name companies (i.e Facebook, Amazon, etc.). Is there a large discrepancy in sophomore->junior interns compared to junior->senior interns? Thanks for the advice though!

Tycho 16y ago

I don't see what the problem is... I thought everyone was in favour of launching with a minimal viable product these days. But seriously, maybe the thing was cobbled together from a whole bunch of government workers/contractors who didn't really know what they were building. Sort of like that film, Cube. Hence the lack of finesse. Or, maybe they wanted it to be analysed so other factions would be less wary of it. I mean, who knows.

shareme 16y ago

Consider this: -Obfuscation is often used to obscure the operative. I submit the conclusion that Stuxnet was 'dumbed' down on purpose to obscure which country wrote it. Also by obfuscation of the virus one can also send a strong message of 'You do not know who attacked and you will never know'