4 ms·

> "Whoever did this needed to know WinCC programming, Step 7, they needed platform process knowledge, the ability to reverse engineer a number of file formats,

by bugsy 16y ago

> "Whoever did this needed to know WinCC programming, Step 7, they needed platform process knowledge, the ability to reverse engineer a number of file formats, kernel rootkit development and exploit development. That's a broad set of skills. Does anyone here think they could do all of that?" Sure, I could do that and I am nobody special. That's absolutely nothing compared to the "minimum requirements" stated in most job ads for jobs that pay crap.

nitrogen 16y ago
One must be careful about admitting to possessing skills that could be used in the creation of digital "weapons..." But yes, it's not all that uncommon to meet career generalists that have gathered both the breadth and depth of knowledge necessary to write something like Stuxnet.
- khafra 16y ago
  If you want to get on the Sourcefire Vulnerability Research Team, or many other similar groups, you need to put those skills in your resume. Courts may overreact to anything the media dubs a "hack," but I don't believe that merely possessing those abilities is as yet something to hide.
- bugsy 16y ago
  I'm not admitting to any special skills whatsoever that's the whole point. Programming logic controllers is very simple. They are designed to be like Excel, something that non-programmers can program. The hard part of this operation was getting the information about the Iranian labs, which was surely beyond top secret. There were probably dozens of special ops guys involved in that part. But that's nothing to do with the programming. As far as zero day exploits, they are widely for sale to the highest bidder, one only needs money not skills. But if one has no money, that's not a problem either. It's not like there's a shortage of them, I've made plenty of vulnerability reports myself to various vendors. So have most people who are even moderately competent. There are thousands of vulnerabilities to choose from. I don't find it hard to believe there are people holding some back. If you're a government agency monitoring all the hacking boards though you already know about a bunch of unpublicized vulnerabilities.
jeffreyg 16y ago
> However, he also said that there was very little chance that one person could have put the entire attack together alone. I think to make his case that more than one person was involved, he left some important points off his list: 1) finding four 0-days to exploit and gain escalation of privilege on XP/2000 and Vista/7 machines (how long would it take you to do that?) and 2) Knowing HOW to program the PLCs so that they screw up the centrifuges without being detected. Sorry if your comment was entirely a joke. Too early; not sure.

by bugsy 16y ago

nitrogen 16y ago

One must be careful about admitting to possessing skills that could be used in the creation of digital "weapons..." But yes, it's not all that uncommon to meet career generalists that have gathered both the breadth and depth of knowledge necessary to write something like Stuxnet.

khafra 16y ago
If you want to get on the Sourcefire Vulnerability Research Team, or many other similar groups, you need to put those skills in your resume. Courts may overreact to anything the media dubs a "hack," but I don't believe that merely possessing those abilities is as yet something to hide.
bugsy 16y ago
I'm not admitting to any special skills whatsoever that's the whole point. Programming logic controllers is very simple. They are designed to be like Excel, something that non-programmers can program. The hard part of this operation was getting the information about the Iranian labs, which was surely beyond top secret. There were probably dozens of special ops guys involved in that part. But that's nothing to do with the programming. As far as zero day exploits, they are widely for sale to the highest bidder, one only needs money not skills. But if one has no money, that's not a problem either. It's not like there's a shortage of them, I've made plenty of vulnerability reports myself to various vendors. So have most people who are even moderately competent. There are thousands of vulnerabilities to choose from. I don't find it hard to believe there are people holding some back. If you're a government agency monitoring all the hacking boards though you already know about a bunch of unpublicized vulnerabilities.

jeffreyg 16y ago

> However, he also said that there was very little chance that one person could have put the entire attack together alone. I think to make his case that more than one person was involved, he left some important points off his list: 1) finding four 0-days to exploit and gain escalation of privilege on XP/2000 and Vista/7 machines (how long would it take you to do that?) and 2) Knowing HOW to program the PLCs so that they screw up the centrifuges without being detected. Sorry if your comment was entirely a joke. Too early; not sure.