5 ms·

> Stuxnet does not use all advanced malware techniques the author can think of Why use (and give away) any more capabilities than required to do the job?

coretx 7y ago
Stuxnet carried a irresponsible overload amount of 8 zero days. The US asked the Netherlands to implant it at the Iranian plant. TL;DR Whoever was responsible for Stuxnet within the US indisputably is mentally challenged / not a rational actor.
- deleted 7y ago
  [deleted]
- PostOnce 7y ago
  Who are we armchair generals to determine what is the needed amount? For all we know, they have a stockpile of thousands of zero days, or more! Plus, if "attempting to prevent nuclear war" isn't a responsible use of these zero days, then I would love to hear what you think calls for deploying them.
  - coretx 7y ago
    Officially, as in - what has been stated via formal public channels - Stuxnet was implanted to delay Iran's inevitable ability to use sufficient amounts of weapon-grade isotopes c.q to decrease the production by means of sabotaging centrifuges. Not to prevent nuclear war. If there are other or more reasons in play regarding why Stuxnet was implanted, it is something we're not likely to ever find out. What we do know for a fact is that it's atleast very risky and irrational at best to risk handing over a single let alone eight zero days to a adversary you deem to be bonkers enough to go nuclear since the reluctance to apply them is significantly lower compared to conventional or nbc weapons. To further answer your final question i'd say it depends on a multitude of factors among them the nature of the 0day, the theater of deployment down to the most mundane operational details and much more. Surely a analysis you do not want to be done by a armchair general indeed, but from the looks of it this might actually exactly be what occurred.
    - blix 7y ago
      > What we do know for a fact is that it's atleast very risky and irrational at best to risk handing over a single let alone eight zero days to a adversary you deem to be bonkers enough to go nuclear since the reluctance to apply them is significantly lower compared to conventional or nbc weapons. Only two nuclear weapons have been deployed ever. This single 8 zero day attack already quadruples it. There is absolutely more relectance for nuclear. the "n" is not like the "bc" in nbc. Delaying Iran's enrichment program and preventing nuclear war are very similar goals. A near-nuclear Iran would likely foment a war in the region, involving at least one other nuclear capable state. Preventing Iran from obtaining weapons is a tactic to prevent the possibility of nuclear exchange in the region. I don't think the distinction you are drawing is valid.
      - JadeNB 7y ago
        > Only two nuclear weapons have been deployed ever. … intentionally; if you want to feel a stark sense of wonder that we ever survived the height of the nuclear-weapons age, you could do worse than to read Schlosser's "Command and Control" (https://www.amazon.com/Command-Control-Damascus-Accident-Illusion/dp/1594202273 https://www.amazon.com/Command-Control-Damascus-Accident-Ill...).
        blix 7y ago
        Oh yeah, it's miracle the USA didn't accidentally nuke itself. There are a lot of scary stories out there. However, I dont think that necessarily means nukes are taken less seriously than zero-days.
        JadeNB 7y ago
        > However, I dont think that necessarily means nukes are taken less seriously than zero-days. Sure, I didn't mean to argue that; only to point out that saying that only two nuclear weapons had been deployed, even if true in a perfectly reasonable sense, required at least some qualification.
  - gdy 7y ago
    "if "attempting to prevent nuclear war" isn't a responsible use of these zero days" What on Earth are you talking about?
- manigandham 7y ago
  How is it irresponsible? Because it gives away the exploits? That only happens if it gets reverse engineered. The main objective of stopping the nuclear arms enrichment was a more important goal and the security bulletins could be published anytime after the payload was delivered.
pizza234 7y ago
In fact, there's no need at all. Some of the most complex malway (viruses, to be specific) every written (Zmist, MetaPHOR), which the post author would "appreciate", never had any wide diffusion; Stuxnet accomplished its task. All in all, the post author just wanted some attention.
rafa1981 7y ago
Exactly. If it did the job why showing the enemy (and the world) all your cards, so they can learn your most advanced tricks? It's better to keep some advanced techniques for the next target than to expose them with no need.

coretx 7y ago

Stuxnet carried a irresponsible overload amount of 8 zero days. The US asked the Netherlands to implant it at the Iranian plant. TL;DR Whoever was responsible for Stuxnet within the US indisputably is mentally challenged / not a rational actor.

deleted 7y ago
[deleted]
PostOnce 7y ago
Who are we armchair generals to determine what is the needed amount? For all we know, they have a stockpile of thousands of zero days, or more! Plus, if "attempting to prevent nuclear war" isn't a responsible use of these zero days, then I would love to hear what you think calls for deploying them.
- coretx 7y ago
  Officially, as in - what has been stated via formal public channels - Stuxnet was implanted to delay Iran's inevitable ability to use sufficient amounts of weapon-grade isotopes c.q to decrease the production by means of sabotaging centrifuges. Not to prevent nuclear war. If there are other or more reasons in play regarding why Stuxnet was implanted, it is something we're not likely to ever find out. What we do know for a fact is that it's atleast very risky and irrational at best to risk handing over a single let alone eight zero days to a adversary you deem to be bonkers enough to go nuclear since the reluctance to apply them is significantly lower compared to conventional or nbc weapons. To further answer your final question i'd say it depends on a multitude of factors among them the nature of the 0day, the theater of deployment down to the most mundane operational details and much more. Surely a analysis you do not want to be done by a armchair general indeed, but from the looks of it this might actually exactly be what occurred.
  - blix 7y ago
    > What we do know for a fact is that it's atleast very risky and irrational at best to risk handing over a single let alone eight zero days to a adversary you deem to be bonkers enough to go nuclear since the reluctance to apply them is significantly lower compared to conventional or nbc weapons. Only two nuclear weapons have been deployed ever. This single 8 zero day attack already quadruples it. There is absolutely more relectance for nuclear. the "n" is not like the "bc" in nbc. Delaying Iran's enrichment program and preventing nuclear war are very similar goals. A near-nuclear Iran would likely foment a war in the region, involving at least one other nuclear capable state. Preventing Iran from obtaining weapons is a tactic to prevent the possibility of nuclear exchange in the region. I don't think the distinction you are drawing is valid.
    - JadeNB 7y ago
      > Only two nuclear weapons have been deployed ever. … intentionally; if you want to feel a stark sense of wonder that we ever survived the height of the nuclear-weapons age, you could do worse than to read Schlosser's "Command and Control" (https://www.amazon.com/Command-Control-Damascus-Accident-Illusion/dp/1594202273 https://www.amazon.com/Command-Control-Damascus-Accident-Ill...).
      - blix 7y ago
        Oh yeah, it's miracle the USA didn't accidentally nuke itself. There are a lot of scary stories out there. However, I dont think that necessarily means nukes are taken less seriously than zero-days.
        JadeNB 7y ago
        > However, I dont think that necessarily means nukes are taken less seriously than zero-days. Sure, I didn't mean to argue that; only to point out that saying that only two nuclear weapons had been deployed, even if true in a perfectly reasonable sense, required at least some qualification.
- gdy 7y ago
  "if "attempting to prevent nuclear war" isn't a responsible use of these zero days" What on Earth are you talking about?
manigandham 7y ago
How is it irresponsible? Because it gives away the exploits? That only happens if it gets reverse engineered. The main objective of stopping the nuclear arms enrichment was a more important goal and the security bulletins could be published anytime after the payload was delivered.

pizza234 7y ago

In fact, there's no need at all. Some of the most complex malway (viruses, to be specific) every written (Zmist, MetaPHOR), which the post author would "appreciate", never had any wide diffusion; Stuxnet accomplished its task. All in all, the post author just wanted some attention.

rafa1981 7y ago

Exactly. If it did the job why showing the enemy (and the world) all your cards, so they can learn your most advanced tricks? It's better to keep some advanced techniques for the next target than to expose them with no need.