6 ms·

Stuxnet Authors Made Several Basic Errors

25 points by Garbage 16y ago

icarus_drowning 16y ago
What? A state-funded program that appears to have been somewhat hampered by bureaucracy? Say it ain't so! ;)
bugsy 16y ago
> "Whoever did this needed to know WinCC programming, Step 7, they needed platform process knowledge, the ability to reverse engineer a number of file formats, kernel rootkit development and exploit development. That's a broad set of skills. Does anyone here think they could do all of that?" Sure, I could do that and I am nobody special. That's absolutely nothing compared to the "minimum requirements" stated in most job ads for jobs that pay crap.
- nitrogen 16y ago
  One must be careful about admitting to possessing skills that could be used in the creation of digital "weapons..." But yes, it's not all that uncommon to meet career generalists that have gathered both the breadth and depth of knowledge necessary to write something like Stuxnet.
  - khafra 16y ago
    If you want to get on the Sourcefire Vulnerability Research Team, or many other similar groups, you need to put those skills in your resume. Courts may overreact to anything the media dubs a "hack," but I don't believe that merely possessing those abilities is as yet something to hide.
  - bugsy 16y ago
    I'm not admitting to any special skills whatsoever that's the whole point. Programming logic controllers is very simple. They are designed to be like Excel, something that non-programmers can program. The hard part of this operation was getting the information about the Iranian labs, which was surely beyond top secret. There were probably dozens of special ops guys involved in that part. But that's nothing to do with the programming. As far as zero day exploits, they are widely for sale to the highest bidder, one only needs money not skills. But if one has no money, that's not a problem either. It's not like there's a shortage of them, I've made plenty of vulnerability reports myself to various vendors. So have most people who are even moderately competent. There are thousands of vulnerabilities to choose from. I don't find it hard to believe there are people holding some back. If you're a government agency monitoring all the hacking boards though you already know about a bunch of unpublicized vulnerabilities.
- jeffreyg 16y ago
  > However, he also said that there was very little chance that one person could have put the entire attack together alone. I think to make his case that more than one person was involved, he left some important points off his list: 1) finding four 0-days to exploit and gain escalation of privilege on XP/2000 and Vista/7 machines (how long would it take you to do that?) and 2) Knowing HOW to program the PLCs so that they screw up the centrifuges without being detected. Sorry if your comment was entirely a joke. Too early; not sure.
nutjob123 16y ago
I wonder how much making this virus cost taxpayers. http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html?pagewanted=1 http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet...
acabal 16y ago
I'm so confused about Stuxnet--some people were saying it was among the most brilliant viruses ever, (from memory) using several 0-day exploits and doing things like recording normal activity to play back to machine operators while it did its damage. That alone sounds pretty impressive to me. Then on the other hand I've seen a few articles in the past few days calling it "nothing special after all." Which is it?
- psyklic 16y ago
  The complaining is simply that the authors did not hide the payload. Consensus seems to be that it would have bought them an additional few months. However, the virus worked and hiding the payload would have added to its complexity. So, kudos to its authors.
  - tptacek 16y ago
    Huh? What consensus are you talking about? The techniques Nate brought up --- techniques that are in a book that (while good) you can buy at Barnes and Noble --- would have made brute-force recovery of the payload infeasible; within reach only of organizations that had a full "stack" of "centrifuge"† equipment in the Natanz† configuration, and certainly out of Symantec's reach. † If that's really the "target"
    - updog 16y ago
      You keep forgetting that the points that Nate brought up are completely irrelevant. The goal was not to hide from Symantec a year after the fact. The goal was to ruin Iran's nuclear plant. And that is what they did. In fact, many modern military strategies involve intentionally demonstrating your capabilities. There are good reasons to do that. It seems silly that there is this debate going on about advanced code obfuscation that absolutely no one involved cares about. "Security experts" really need to learn when not to give their 2 cents. I think anyone that has actually shipped complex software would agree, adding stuff like that is seriously not worth the risk. If you jeopardize a mission like that by inserting what amounts to intellectual masturbation just so that irrelevant bloggers can praise your technique, you definitely aren't the person for the job.
Helianthus16 16y ago
>Parker wrote a tool that analyzed similarities between the Stuxnet code and the code of some other well-known worms and applications and found that the code was fairly low quality. well isn't that hand-wavy. >For example, the command-and-control mechanism is poorly done and sends its traffic in the clear and the worm ended up propagating on the Internet, which was likely not the intent. this is part speculative and part, in my subjective mind, stupid. propagating on the Internet seems a highly reasonable method to me. what do you expect it to use, facebook? maybe the constraint is that it has to express itself on the internet and therefore 'in the clear?' >"This was probably not a western state. There were too many mistakes made. There's a lot that went wrong," Is that really so western-centric? this guy is seriously just reaching for criticism in order to grab headlines. >Lawson concludes that whoever wrote Stuxnet likely was constrained by time and didn't think there was enough of a return to justify the investment of more time in advanced cloaking techniques. That's at least reasonable, because in all honesty maybe there wasn't enough of a return. Lawson seems a better analyst than this Parker fellow.
- tptacek 16y ago
  No, it is the opposite of hand-wavy. It is a guy getting up on stage and performing an actual technical analysis in front of his peers, rather than posting an anonymous message board post insulting someone they presumably don't know.
  - khafra 16y ago
    If he wrote a tool that broke up the decompiled stuxnet binary into n-grams and did principal component analysis, then used a a boosting classifier to put it in clusters of similarly machine-analysed code deemed by some group of experts to be "high," "medium," or "low" quality, that's an actual technical analysis. Its merits could be debatable, but it's technical. If all we know is that he wrote a tool that found the code to be of fairly low quality, he got up on stage in front of his peers and waved his hands.
  - Helianthus16 16y ago
    My judgment comes from the scant information in the article. I don't see his actual technical analysis, I see some claim that we can technically (mathematically) define code as good, fair, or poor, which sounds ridiculous. You're cherry-picking my arguments anyway.
perlgeek 16y ago
As far as I can tell, Stuxnet did what it was supposed to do, and left no provable trace to its authors. Seriously, what more could the authors want? Additional sophistication, just to keep some random bloggers happy? I'm pretty sure their mission was "destroy some Uranium centrifuges" and not "create the perfect stealth cyber weapon". They succeeded at the former, so it doesn't matter that they "failed" at the latter.
- tptacek 16y ago
  How about "not disclosing the manner in which it disrupted the target, thus leaving precisely the same avenue of attack open at multiple sites in the future"? The fact that this is plastered all over the newspaper would, were this a professional intelligence operation, be a major flaw in the operation. So much so that I don't think that's what it is.
- MichaelSalib 16y ago
  The goal was not to destroy centrifuges per se; the goal was to delay the enrichment program. More delay is better. By failing to cloak the payload, Stuxnet's creators ensured they'd get less delay.
napierzaza 16y ago
I guess the author was not an early adopter. He'll like Stuxnet 2.0 I'm sure.

25 points by Garbage 16y ago

What? A state-funded program that appears to have been somewhat hampered by bureaucracy? Say it ain't so! ;)

bugsy 16y ago

> "Whoever did this needed to know WinCC programming, Step 7, they needed platform process knowledge, the ability to reverse engineer a number of file formats, kernel rootkit development and exploit development. That's a broad set of skills. Does anyone here think they could do all of that?" Sure, I could do that and I am nobody special. That's absolutely nothing compared to the "minimum requirements" stated in most job ads for jobs that pay crap.

nitrogen 16y ago
One must be careful about admitting to possessing skills that could be used in the creation of digital "weapons..." But yes, it's not all that uncommon to meet career generalists that have gathered both the breadth and depth of knowledge necessary to write something like Stuxnet.
- khafra 16y ago
  If you want to get on the Sourcefire Vulnerability Research Team, or many other similar groups, you need to put those skills in your resume. Courts may overreact to anything the media dubs a "hack," but I don't believe that merely possessing those abilities is as yet something to hide.
- bugsy 16y ago
  I'm not admitting to any special skills whatsoever that's the whole point. Programming logic controllers is very simple. They are designed to be like Excel, something that non-programmers can program. The hard part of this operation was getting the information about the Iranian labs, which was surely beyond top secret. There were probably dozens of special ops guys involved in that part. But that's nothing to do with the programming. As far as zero day exploits, they are widely for sale to the highest bidder, one only needs money not skills. But if one has no money, that's not a problem either. It's not like there's a shortage of them, I've made plenty of vulnerability reports myself to various vendors. So have most people who are even moderately competent. There are thousands of vulnerabilities to choose from. I don't find it hard to believe there are people holding some back. If you're a government agency monitoring all the hacking boards though you already know about a bunch of unpublicized vulnerabilities.
jeffreyg 16y ago
> However, he also said that there was very little chance that one person could have put the entire attack together alone. I think to make his case that more than one person was involved, he left some important points off his list: 1) finding four 0-days to exploit and gain escalation of privilege on XP/2000 and Vista/7 machines (how long would it take you to do that?) and 2) Knowing HOW to program the PLCs so that they screw up the centrifuges without being detected. Sorry if your comment was entirely a joke. Too early; not sure.

nutjob123 16y ago

I wonder how much making this virus cost taxpayers. http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html?pagewanted=1 http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet...

acabal 16y ago

I'm so confused about Stuxnet--some people were saying it was among the most brilliant viruses ever, (from memory) using several 0-day exploits and doing things like recording normal activity to play back to machine operators while it did its damage. That alone sounds pretty impressive to me. Then on the other hand I've seen a few articles in the past few days calling it "nothing special after all." Which is it?

psyklic 16y ago
The complaining is simply that the authors did not hide the payload. Consensus seems to be that it would have bought them an additional few months. However, the virus worked and hiding the payload would have added to its complexity. So, kudos to its authors.
- tptacek 16y ago
  Huh? What consensus are you talking about? The techniques Nate brought up --- techniques that are in a book that (while good) you can buy at Barnes and Noble --- would have made brute-force recovery of the payload infeasible; within reach only of organizations that had a full "stack" of "centrifuge"† equipment in the Natanz† configuration, and certainly out of Symantec's reach. † If that's really the "target"
  - updog 16y ago
    You keep forgetting that the points that Nate brought up are completely irrelevant. The goal was not to hide from Symantec a year after the fact. The goal was to ruin Iran's nuclear plant. And that is what they did. In fact, many modern military strategies involve intentionally demonstrating your capabilities. There are good reasons to do that. It seems silly that there is this debate going on about advanced code obfuscation that absolutely no one involved cares about. "Security experts" really need to learn when not to give their 2 cents. I think anyone that has actually shipped complex software would agree, adding stuff like that is seriously not worth the risk. If you jeopardize a mission like that by inserting what amounts to intellectual masturbation just so that irrelevant bloggers can praise your technique, you definitely aren't the person for the job.

Helianthus16 16y ago

>Parker wrote a tool that analyzed similarities between the Stuxnet code and the code of some other well-known worms and applications and found that the code was fairly low quality. well isn't that hand-wavy. >For example, the command-and-control mechanism is poorly done and sends its traffic in the clear and the worm ended up propagating on the Internet, which was likely not the intent. this is part speculative and part, in my subjective mind, stupid. propagating on the Internet seems a highly reasonable method to me. what do you expect it to use, facebook? maybe the constraint is that it has to express itself on the internet and therefore 'in the clear?' >"This was probably not a western state. There were too many mistakes made. There's a lot that went wrong," Is that really so western-centric? this guy is seriously just reaching for criticism in order to grab headlines. >Lawson concludes that whoever wrote Stuxnet likely was constrained by time and didn't think there was enough of a return to justify the investment of more time in advanced cloaking techniques. That's at least reasonable, because in all honesty maybe there wasn't enough of a return. Lawson seems a better analyst than this Parker fellow.

tptacek 16y ago
No, it is the opposite of hand-wavy. It is a guy getting up on stage and performing an actual technical analysis in front of his peers, rather than posting an anonymous message board post insulting someone they presumably don't know.
- khafra 16y ago
  If he wrote a tool that broke up the decompiled stuxnet binary into n-grams and did principal component analysis, then used a a boosting classifier to put it in clusters of similarly machine-analysed code deemed by some group of experts to be "high," "medium," or "low" quality, that's an actual technical analysis. Its merits could be debatable, but it's technical. If all we know is that he wrote a tool that found the code to be of fairly low quality, he got up on stage in front of his peers and waved his hands.
- Helianthus16 16y ago
  My judgment comes from the scant information in the article. I don't see his actual technical analysis, I see some claim that we can technically (mathematically) define code as good, fair, or poor, which sounds ridiculous. You're cherry-picking my arguments anyway.

perlgeek 16y ago

As far as I can tell, Stuxnet did what it was supposed to do, and left no provable trace to its authors. Seriously, what more could the authors want? Additional sophistication, just to keep some random bloggers happy? I'm pretty sure their mission was "destroy some Uranium centrifuges" and not "create the perfect stealth cyber weapon". They succeeded at the former, so it doesn't matter that they "failed" at the latter.

tptacek 16y ago
How about "not disclosing the manner in which it disrupted the target, thus leaving precisely the same avenue of attack open at multiple sites in the future"? The fact that this is plastered all over the newspaper would, were this a professional intelligence operation, be a major flaw in the operation. So much so that I don't think that's what it is.
MichaelSalib 16y ago
The goal was not to destroy centrifuges per se; the goal was to delay the enrichment program. More delay is better. By failing to cloak the payload, Stuxnet's creators ensured they'd get less delay.

napierzaza 16y ago

I guess the author was not an early adopter. He'll like Stuxnet 2.0 I'm sure.