9 ms·
Stuxnet is embarrassing, not amazing (2011)
- arnon 4y agoUnfortunately this sounds like fairly typical armchair commentary from someone who doesn't understand the decisions around building and deploying something like this at this scale... Sometimes, yeah, you need to rush things because your window of opportunity is now or never.
- status200 4y agoI agree, if something worked, then it was exactly as sophisticated / obfuscated as it needed to be.
- MontyCarloHall 4y agoThe blog author Nate Lawson [0] runs a small cybersecurity consulting company [1]. It’s not surprising that a small independent consultant would bikeshed over trivial imperfections in something like Stuxnet while ignoring the much bigger picture of the operation. I bet the vast majority of security holes he finds in his line of work are relatively minor exploits (e.g. poor key handling, unpatched software, etc.) that would be devastating to his small business client if exploited but totally irrelevant to an operation like Stuxnet. It is akin to a custom gunsmith criticizing an ICBM for its ugly paint job. As Pauli would say, Lawson’s argument is not only not right, it is not even wrong. [0] https://www.linkedin.com/in/natelawson https://www.linkedin.com/in/natelawson [1] http://www.rootlabs.com/ http://www.rootlabs.com/ (yes, his own site ironically is not HTTPS)
- Threeve303 4y agoIt is also a concern when developing these "weapons" that after using them, they could potentially be reverse engineered. In that context a successful payload that appears poorly constructed could be intentional. Either way, for the mission goals it was a success.
- staticassertion 4y agoWhen you're on the defense side (I am) you often read a lot of research and watch conference talks about cutting edge stuff. It makes you wonder - why don't attackers do these things? I actually asked a criminal I was in contact with once why he didn't attempt to perform an attack a certain way that I thought would be very lucrative and significant. His answer was that there was no point, he made thousands of dollars a month with very little effort, and he was more interested in refining his existing work through improved C2 communications as opposed to what I had been suggesting (academically, I never supported that work). The title's a bit clickbaity too of course. The end is more reasoned: > However, I think the final explanation is most likely. Whoever developed the code was probably in a hurry and decided using more advanced hiding techniques wasn’t worth the development/testing cost. Yes, naturally that is exactly what happened. There is no question at all that the NSA has people capable of doing more advanced work, they just really don't have to. https://www.youtube.com/watch?v=bDJb8WOJYdA https://www.youtube.com/watch?v=bDJb8WOJYdA Rob Joyce gives a great talk about his work on TAO. The short version is that TAO doesn't have to do anything crazy, they just have to know who their target is and spend the time figuring out the environment they'll be working in - then they meet the bar that's beyond what that environment is capable of handling. Homomorphic encryption is gonna be pretty overkill. Then again, the NSA also leveraged the first publicly known attack that used an MD5 collision, which probably cost quite a bit of money, so they can flex when they decide it's worth it.
- mike_d 4y ago> It’s not surprising that a small independent consultant He also co-developed the content protection system for Bluray and was a FreeBSD committer. Judge the words, not the person.
- deleted 4y ago[deleted]
- politelemon 4y agoNo, it is amazing, and the author is missing out on understanding why - it does not need to have passed an architectural and design review if it manages to accomplish its goal(s). Ironically, the author focuses on 'hiding the payload' as the thing that makes it embarrassing, as though that is self evident.
- notacoward 4y agoIt's yet another case of "I know/do X in my context, therefore anyone who doesn't know/do X even in another context is an idiot". (And yet, somehow, X is also an amazingly hard-to-acquire skill that should bring immense rewards to those like the speaker/writer who claim to have mastered it.) Such fare is neither curious nor newsworthy, but seems common.
- axg11 4y agoHiding and obfuscating the payload is pointless in this case. The author doesn’t seem to understand the reasons why a group would go through the trouble of obfuscation or other similar techniques. Stuxnet was a one-time operation with a very limited opportunity window. Target systems were airgapped. A large part of the success of the operation relied on a human penetrating that air gap. A successful operation would be attributed to either Israel or USA immediately. What is the benefit of obfuscation?
- sokoloff 4y agoExactly. All that matters is that the scoreboard reads "Stuxnet - 1; Iran - 0 (Final)"
- spacemanmatt 4y agoYeah, effective trumps every possible hindsight criticism.
- hotpotamus 4y agoConsidering that Iran went on to develop uranium enrichment capabilities it hardly seems like Stuxnet was a final win, though it certainly delayed them.
- cronix 4y agoDelaying has always been the point, whether it's Stuxnet or technology export bans or assassinating 4 scientists in the streets working on the program.
- axg11 4y agoLong term effects of Stuxnet are unclear. In the short term, it was a huge win in delaying the programme and sending a message that even air gapped systems are at risk. In the long term, Stuxnet put the programme and every adversary on notice that they should increase focus on security practices.
- 4y ago
- zmgsabst 4y ago> It does not use virtual machine-based obfuscation, novel techniques for anti-debugging, or anything else to make it different from the hundreds of malware samples found every day. Okay? … simplicity is a virtue. They also addressed that, to where we don’t know what most of their malware even does: >> The name originated from the group's extensive use of encryption. By 2015, Kaspersky documented 500 malware infections by the group in at least 42 countries, while acknowledging that the actual number could be in the tens of thousands due to its self-terminating protocol. > The longer they remained undetected, the more systems that could be attacked and the longer Stuxnet could continue evolving as a deployment platform for follow-on worms. Stuxnet wasn’t meant as a long term penetration: they hit a specific target with a one-time cyber weapon. For reference, when their tools leaked in 2016, exploits from 2013 were still zero-days. >> In August 2016, a hacking group calling itself "The Shadow Brokers" announced that it had stolen malware code from the Equation Group. […] The most recent dates of the stolen files are from June 2013, thus prompting Edward Snowden to speculate that a likely lockdown resulting from his leak of the NSA's global and domestic surveillance efforts stopped The Shadow Brokers' breach of the Equation Group. Source: https://en.wikipedia.org/wiki/Equation_Group https://en.wikipedia.org/wiki/Equation_Group
- deleted 4y ago[deleted]
- motohagiography 4y agoMy impression at the time was that the code was developed by separate teams who did not necessarily know what they were working on, and then integrated by someone cleared for at least part of the real operation. I speculated that the people repsonsible for deploying it would have been in the tactical area of humint agency that was more indexed on direct outcomes than using techniques any more sophisticated than were strictly necessary to accomplish their specific objective, as why risk or waste the advantage of shipping something with additional tradecraft baked into it? I remember thinking they could have at least used hashes of registry entries to detect the modules they were looking for if they wanted to protect the identity of target, but then again, the processor load of the hashing operations would have been a significant IoC. Stuxnet was a straight tactical hack to solve a specific problem, which was to delay that nuclear program. It was not just a threat or demonstration of capability to serve as a deterrent. An example of a demonstration of capability was the silk road arrest, where the FBI mainly used it as a signal to create uncertainty about the absolute security of Tor hidden services, so that people understood they did not have impunity. They didn't break tor, but they showed tor wouldn't protect you if they wanted you. Stuxnet wasn't about demonstrating that they could get at you, it was to delay the nuclear program to give time to negotiations and potential outcomes other than iran achieving a weapons program. What we call 'cyber' now is in support of variously tactical and strategic objectives, and while the criticisms of the code are valid, it's worth evaluating the tools in that higher level more abstract context as well.
- mypastself 4y agoAs far as I recall from Kim Zetter’s book Countdown to Zero Day, the development work was indeed likely split into several individual sections: the actual payload targeting specific models of programmable controllers was made with extreme care and attention, and the worm portion didn’t need to be. So to offer an imperfect analogy, the author of this article is addressing how lame Google’s UI is, discounting the algorithm underpinning the search engine. (I actually wouldn’t recommend Zetter’s book. It’s fairly dull, with several chapters enumerating every software failure of U.S. critical infrastructure she found during research. For once, the movie was better.)
- 4y ago
- TacticalCoder 4y agoIf Stuxnet was made to stop Iran from getting nuclear weapons, here's a headline from today (which may btw be the reason why articles on Stuxnet are reappearing now): "Iran is closer than ever to a nuclear weapon as Biden runs out of options".
- tyingq 4y agoYou could read that as "Stuxnet set Iran back approximately 10 years".
- spacemanmatt 4y agoI would also read something into U.N. monitoring which they recently ejected.
- cokeandpepsi 4y agoIt also helped in negotiations, if we didn't withdraw from JCOPA that headline wouldn't be the same
- aaronbrethorst 4y agoGee, I wonder why Iran restarted its nuclear program... https://trumpwhitehouse.archives.gov/briefings-statements/president-donald-j-trump-ending-united-states-participation-unacceptable-iran-deal/ https://trumpwhitehouse.archives.gov/briefings-statements/pr... https://foreignpolicy.com/2020/05/08/iran-advances-nuclear-program-withdrawal-jcpoa/ https://foreignpolicy.com/2020/05/08/iran-advances-nuclear-p...
- emkoemko 4y agomaybe the USA should of stayed in the deal that prevented this from happening?
- tetha 4y agoHm. Stuxnet feels less like a normal software project, and more like a NASA mission. Something like a botnet can run updates and patches, and you have a much easier time to iterate, optimize and also to fail in less than catastrophic ways. Sure, you lose some nodes, but you infect some nodes, so be it. Something like Stuxnet is more like the mars rover. You eventually fire it off, and then it has to work correctly autonomously. Once the boosters are going, you cannot fix it anymore. Once Stuxnet is in that facility, there are no more patches. It has to work. And if it's discovered, you've probably blown your only chance. In such a setup, simplicity and options with known and explored failure modes are good.
- srvmshr 4y agoI liken the Stuxnet ops to be like if targetting Osama bin Laden with a sophisticated custom-made virus transmitted through his children. It delivers its payload once, and does very little collateral damage to others. The virus itself was sophisticated in the way obfuscation was incorporated, using 4 zero-days.
- daniel-cussen 4y agoThey did in fact target Osama bin Laden with mandated vaccines for boys for some very very important ailment to which there could be no religious objections...to get DNA material they could track down to him. That's how I heard it.
- aahortwwy 4y agoSlightly different from what the parent is describing. Especially the "little collateral damage" part. https://www.thelancet.com/journals/lancet/article/PIIS0140-6736(14)60900-4/fulltext https://www.thelancet.com/journals/lancet/article/PIIS0140-6...
- daniel-cussen 4y ago[flagged]
- seaourfreed 4y agoIt still got a job done. Embarrassing that people found out by the Israeli side screwed up. But this is how cyber attacks will be... They make some impact. Then everyone learns the tech used. Then everyone secures the vector they used. Rinse and repeat. Used too often, and all attack vectors will be closed.
- ZiiS 4y agoIt is not just that it was unnecessary to do more, it would have been harmful. Stuxnet was always going to be disected after the attack; why give away all you best techeques.
- 2Gkashmiri 4y agoSo imagine the scenario if iran made stuxnrt against Israeli nuclear facilities let alone american ones. Imagine the outrage "how dare you" and "attack on the constitution and national integrity of the country" and "causus belli" among other things but its being made as an achievement. Isn't this american propaganda?
- shadowgovt 4y agoOf course. From a point of view sympathetic to Iran's self-defense and militarization interests, stuxnet is an attack on national sovereignty. That having been said, if Iranian agents were able to conduct a similar operation in the US on a US weapons-grade enrichment program, my personal opinion, as somebody categorically in favor of nuclear non-proliferation and long-term disarmament, would be "Well done, point to your team."
- kcb 4y agoYea no foreign states ever attack/hack American facilities. /s
- deleted 4y ago[deleted]
- 2Gkashmiri 4y agoNo. Everyone attacks everyone else. Its jut when america /Israel does this, its seen as an achievement while if someone else attacks these two, its seen as an act of war and all hell breaks loose.
- zen_1 4y ago
- hatware 4y ago
- emkoemko 4y agothis ain't as bad as how many scientists Israel assassinates in Iran, if Iran tried doing the same ....
- xwdv 4y agoThe context of this article makes more since when you realize the author is an Iranian sympathizer.
- draw_down 4y agoWell, I thought it was pretty impressive. Maybe I’m just a rube though. Also, with this encryption based approach, at some point the code needs to run on the systems it targets. So if someone is affected by your payload, by definition they can observe a key that unlocks the payload.
- stavros 4y agoThis article seems like a lot of "Stuxnet didn't do enough to hide", but the author misses the fact that it didn't need to hide, judging from the fact that it worked. If it's stupid but it works, it's not stupid. The author is missing the point by lambasting Stuxnet for not having a feature it didn't need.
- itsoktocry 4y ago>The author is missing the point by lambasting Stuxnet for not having a feature it didn't need. Indeed. It's my understanding that to this day we don't officially know who built/launched it. Mission accomplished?
- staticassertion 4y agoIt's not official but it's irrelevant - no one is going to take the US to court over it, which means the only thing that matters is that everyone knows who did it, and they do.
- photochemsyn 4y agoStuxnet was a reckless operation concocted by a small group of American and Israel spies and hackers who thought the whole thing would remain secret forever. The recklessness involved setting a precedent by targeting industrial control systems for physical destruction, and also the release of the package to spread over the internet with no external controls. See (May 2021): https://verveindustrial.com/resources/blog/what-is-stuxnet/ https://verveindustrial.com/resources/blog/what-is-stuxnet/ > "This second Stuxnet variant likely did not propagate from an initial infection on a susceptible PLC or controller, but rather gained access to one commodity Windows system through the use of zero-day exploits. From that one infected commodity Windows host, the malware moved laterally from one Windows box to another across the unsegmented network." Once it had been done once, similar attacks followed by other nation-states: > "From a historical perspective, the Stuxnet worm signaled that well-equipped, nation-state-sponsored actors possessed advanced capabilities that would set the stage for more serious cyber-physical attacks such as those in Ukraine, Estonia, and Saudi Arabia." I suppose one positive effect has been the upgrading of security for everything relying on industrial controls systems and PLCs, from nuclear reactors to railways to water supply systems.
- woodruffw 4y agoI don't think it's likely that they believed it would remain secret forever. Reckless perhaps, but nation states tend to understand that the window of covert action is relatively brief and that lots of external parties are interested in investigating the aftermath. (That's also why the "there was no special obfuscation" commentary is silly -- they just don't care. Obfuscation is pointless window dressing in these scenarios.)
- raldi 4y agoWhat did Bulgarian teenagers do back in the early 90’s? The link is dead.
- jwilk 4y agohttps://web.archive.org/web/20030505063801/http://vx.netlux.org/lib/static/vdat/epmtervw.htm https://web.archive.org/web/20030505063801/http://vx.netlux....
- deleted 4y ago[deleted]
- jesuspiece 4y agoLow effort article here. Author clearly lacks a grasp on the point/woes of obfuscating payloads
- kerakaali 4y ago
- deleted 4y ago[deleted]
- wepple 4y agoThe idea of “secure triggers” seems like it wouldn’t work here. Your options are: - have a large enough set of input parameters that it’s infeasible to guess-attack them, but risk even just a single parameter not being correct in your target system and therefore your payload never executed (completely undermining the entire operation) - your key space has enough variability input to prevent the above, making it easy to guess or brute-force, and revealing the payload trivially. Also, it would either way be easy for your target to reverse because they have full access to the target parameters.
- irobeth 4y agoWhat you're describing is the Gauss payload: https://securelist.com/gauss-abnormal-distribution/36620/ https://securelist.com/gauss-abnormal-distribution/36620/
- dmix 4y ago> It does not use virtual machine-based obfuscation, novel techniques for anti-debugging, or anything else to make it different from the hundreds of malware samples found every day. Being just like hundreds of other malware seems to be a pretty good idea. Blending in is a big part of spy tradecraft.
- remflight 4y agoThis reads like someone trying to provoke a reaction from the authors of Stuxnet, to try to get a clue as to who they were.
- aaron695 4y ago
- tptacek 4y agoThis is a whole thread of people taking a blog post from a decade ago out of context. Nate Lawson's blog had two major beats, cryptography and content protection (Lawson, an old-school vuln researcher, co-created the Blu-Ray BD+ content protection system at Cryptography Research). It's probably hard for people today to remember this, but in the heyday of "the blogosphere", blogs bounced stories back and forth between them the way you would Twitter threads today. Stuxnet was a topic like that. Lawson was just tying it to the stuff he wrote about. We've all read Kim Zetter's book by now. Instead of bouncing thoughts she's already written about off the post --- thoughts the author probably by now agrees with? --- you'd do better to actually follow the links in the post back to Lawson's earlier posts about obfuscation, reversing, and content protection. They're still extremely interesting. Regardless: saying that you have a better take on Stuxnet in 2022 than Nate Lawson did in 2011 is kind of an embarrassing flex.
- smeagull 4y agoI think it's stupid it got reposted, but even in 2011 this was a poor take. You don't use more capability than necessary to achieve a goal.
- tptacek 4y agoThe "take" isn't even the point of the post. It was barely about Stuxnet, and had a lot more to do with content protection and RE. I'm not agreeing with you about the quality of the take; I don't think we even reach that question.
- ChrisArchitect 4y agoSomething new here? Lots of other Stuxnet articles/revelations. Here's some previous discussions: 11 years ago https://news.ycombinator.com/item?id=2112919 https://news.ycombinator.com/item?id=2112919 3 years ago https://news.ycombinator.com/item?id=21432467 https://news.ycombinator.com/item?id=21432467
- no-dr-onboard 4y agoI’m surprised this article is still making its rounds. Two points have always stood out to me: 1) you never empty the barn on a nation state attack. If you know the systems you’re targeting are primitive, you don’t go in with the F-35 of initial compromise schemas. Aim for +10 over the enemies ability to counter, not +1000. 2) the level of overestimation of federal cyber weapons is too damn high. Is it impressive? Absolutely. Is it the best? No. Check in with your private Israeli intel firms for that kind of James Bond stuff. What sets nation states apart are their ability to acquire and perform highly redundant and critically targeted attacks. The NSA would be hamstrung without the cooperation of the CIA and so on. It’s not technical prowess, it’s money and coordination.
- tptacek 4y agoIt comes up regularly in part because there's a lot of pop-sci reading for people to do on Stuxnet, and so people in 2022 generally feel like they know a lot about it, which makes it easy and fun to dunk on a 2011 take. What's embarrassing about the whole scene is that actual analysis of Stuxnet is almost besides the point of this blog post; it's pretty clear that some of the most strident takes on this thread are from people that haven't read any of it before.