4 ms·

Yea, that's what someone wrote on Quora, but Stuxnet isn't the most sophisticated piece of software ever written - let alone that it is not the most sophisticat

by IncRnd 6y ago

Yea, that's what someone wrote on Quora, but Stuxnet isn't the most sophisticated piece of software ever written - let alone that it is not the most sophisticated exploit ever written.

mhh__ 6y ago
Find me another program that requires knowledge more niche than nuclear refinement processes suitable for the production of weapons, and enough HUMINT to know what to target etc. Stuxnet is probably not the most sophisticated program ever, but it's probably the most information dense.
- pooya13 6y ago
  > suitable for the production of weapons Where have you seen any evidence that Stuxnet relied on information on production of nuclear weapons?
  - mhh__ 6y ago
    So you're saying they went to all that effort and then just picked a random number for what to spin the centrifuges up to? All they'd have to do is get a Nuclear Physicist from the weapons program in
    - pooya13 6y ago
      No. I’m saying how do infer it was suitable for nuclear weapons production? The International Atomic Agency has the most stringent oversight on the Iranian nuclear program and there has been no evidence of a nuclear weapons program.
      - IncRnd 6y ago
        It is not inference but deduction and knowledge. Iran has long said that they enrich 20% uranium and can enrich 60% if needed. 20% is the minimum needed for weapons-grade and is 4-6 times what is needed for civilian power. There were talks between the US and Iran in 2010 about lowering the enrichment levels.
        pooya13 6y ago
        20% is for medical isotopes not power. They can also export not just for domestic use. Good thing we don’t base international law on deduction.
        IncRnd 6y ago
        You didn't read my comment. I definitely did not write that 20% is for power.
- luckylion 6y ago
  > Find me another program that requires knowledge more niche than nuclear refinement processes suitable for the production of weapons, and enough HUMINT to know what to target etc. How does that add sophistication to the programming?
  - mhh__ 6y ago
    How doesn't it? Programming doesn't matter, even in a program that is classically sophisticated like a big compiler that's still only an implementation of an algorithm from a book rather than some divine poem that only exists in that compiler
    - luckylion 6y ago
      I'd agree if you'd say that the Stuxnet operation was very sophisticated. That is, coming up with a plan, infecting the right machine in the right plant at the right time so an unknowing technician would accidentally become a carrier for it, then finding a way to make him drop by at the target next, learn enough about the target without having access to be able to write code to identify it with confidence among lots of similar machines etc, but most of that is classical intelligence work and has nothing to do with programming, tech, or Stuxnet specifically. If someone sews on a hidden pocket to a jacket to be used in an extremely complex intelligence operation, that doesn't make it "the most sophisticated seam in history".
- kortilla 6y ago
  > Find me another program that requires knowledge more niche than nuclear refinement processes suitable for the production of weapons Every piece of software used for these centrifuges in day to day operations? Stuxnet is just a worse version of the normal software operating machinery and it used a non-standard install mechanism. Having HUMINT to target a specific configuration is not sophisticated either. Those are just activation conditions which are used all over legitimate and illegitimate software. Extracting secrets from processor caches based on timing is far more sophisticated and it didn’t even require HUMINT.
  - mhh__ 6y ago
    > Stuxnet is just a worse version of the normal software operating machinery and it used a non-standard install mechanism. No it's not. Stuxnet was specifically tuned to ruin the centrifuges under the noses of the presumably well-trained operators and scientists using them. If the PLC suddenly stopped or sped up to the point that it triggered some kind of failsafe then the game is up. > Extracting secrets from processor caches based on timing is far more sophisticated and it didn’t even require HUMINT. Implementing spectre is really not that hard. Also, the secrets aren't extracted from the caches (in the archetypal spectre implementation at least, the vulnerabilities are popping up all over the place): Spectre is an attack against the branch predictor and speculative execution - the cache is just the side channel to exfiltrate data (specifically having each byte value map to a cacheline which you can then time the latency of).
- deleted 6y ago
  [deleted]
busyant 6y ago
> Stuxnet isn't the most sophisticated piece of software ever written I think "sophisticated" is in the eye of the beholder. However you'd like to characterize it, the full scope of the Stuxnet attack seems pretty impressive. Especially the part where the virus simultaneously increases centrifuge speeds while concealing this information from the people monitoring the fuges.

by IncRnd 6y ago

Yea, that's what someone wrote on Quora, but Stuxnet isn't the most sophisticated piece of software ever written - let alone that it is not the most sophisticated exploit ever written.

mhh__ 6y ago

Find me another program that requires knowledge more niche than nuclear refinement processes suitable for the production of weapons, and enough HUMINT to know what to target etc. Stuxnet is probably not the most sophisticated program ever, but it's probably the most information dense.

pooya13 6y ago
> suitable for the production of weapons Where have you seen any evidence that Stuxnet relied on information on production of nuclear weapons?
- mhh__ 6y ago
  So you're saying they went to all that effort and then just picked a random number for what to spin the centrifuges up to? All they'd have to do is get a Nuclear Physicist from the weapons program in
  - pooya13 6y ago
    No. I’m saying how do infer it was suitable for nuclear weapons production? The International Atomic Agency has the most stringent oversight on the Iranian nuclear program and there has been no evidence of a nuclear weapons program.
    - IncRnd 6y ago
      It is not inference but deduction and knowledge. Iran has long said that they enrich 20% uranium and can enrich 60% if needed. 20% is the minimum needed for weapons-grade and is 4-6 times what is needed for civilian power. There were talks between the US and Iran in 2010 about lowering the enrichment levels.
      - pooya13 6y ago
        20% is for medical isotopes not power. They can also export not just for domestic use. Good thing we don’t base international law on deduction.
        IncRnd 6y ago
        You didn't read my comment. I definitely did not write that 20% is for power.
luckylion 6y ago
> Find me another program that requires knowledge more niche than nuclear refinement processes suitable for the production of weapons, and enough HUMINT to know what to target etc. How does that add sophistication to the programming?
- mhh__ 6y ago
  How doesn't it? Programming doesn't matter, even in a program that is classically sophisticated like a big compiler that's still only an implementation of an algorithm from a book rather than some divine poem that only exists in that compiler
  - luckylion 6y ago
    I'd agree if you'd say that the Stuxnet operation was very sophisticated. That is, coming up with a plan, infecting the right machine in the right plant at the right time so an unknowing technician would accidentally become a carrier for it, then finding a way to make him drop by at the target next, learn enough about the target without having access to be able to write code to identify it with confidence among lots of similar machines etc, but most of that is classical intelligence work and has nothing to do with programming, tech, or Stuxnet specifically. If someone sews on a hidden pocket to a jacket to be used in an extremely complex intelligence operation, that doesn't make it "the most sophisticated seam in history".
kortilla 6y ago
> Find me another program that requires knowledge more niche than nuclear refinement processes suitable for the production of weapons Every piece of software used for these centrifuges in day to day operations? Stuxnet is just a worse version of the normal software operating machinery and it used a non-standard install mechanism. Having HUMINT to target a specific configuration is not sophisticated either. Those are just activation conditions which are used all over legitimate and illegitimate software. Extracting secrets from processor caches based on timing is far more sophisticated and it didn’t even require HUMINT.
- mhh__ 6y ago
  > Stuxnet is just a worse version of the normal software operating machinery and it used a non-standard install mechanism. No it's not. Stuxnet was specifically tuned to ruin the centrifuges under the noses of the presumably well-trained operators and scientists using them. If the PLC suddenly stopped or sped up to the point that it triggered some kind of failsafe then the game is up. > Extracting secrets from processor caches based on timing is far more sophisticated and it didn’t even require HUMINT. Implementing spectre is really not that hard. Also, the secrets aren't extracted from the caches (in the archetypal spectre implementation at least, the vulnerabilities are popping up all over the place): Spectre is an attack against the branch predictor and speculative execution - the cache is just the side channel to exfiltrate data (specifically having each byte value map to a cacheline which you can then time the latency of).
deleted 6y ago
[deleted]

busyant 6y ago

> Stuxnet isn't the most sophisticated piece of software ever written I think "sophisticated" is in the eye of the beholder. However you'd like to characterize it, the full scope of the Stuxnet attack seems pretty impressive. Especially the part where the virus simultaneously increases centrifuge speeds while concealing this information from the people monitoring the fuges.