4 ms·
Hm. Stuxnet feels less like a normal software project, and more like a NASA mission. Something like a botnet can run updates and patches, and you have a much e
by tetha 4y ago
Hm. Stuxnet feels less like a normal software project, and more like a NASA mission.
Something like a botnet can run updates and patches, and you have a much easier time to iterate, optimize and also to fail in less than catastrophic ways. Sure, you lose some nodes, but you infect some nodes, so be it.
Something like Stuxnet is more like the mars rover. You eventually fire it off, and then it has to work correctly autonomously. Once the boosters are going, you cannot fix it anymore. Once Stuxnet is in that facility, there are no more patches. It has to work. And if it's discovered, you've probably blown your only chance.
In such a setup, simplicity and options with known and explored failure modes are good.
- srvmshr 4y agoI liken the Stuxnet ops to be like if targetting Osama bin Laden with a sophisticated custom-made virus transmitted through his children. It delivers its payload once, and does very little collateral damage to others. The virus itself was sophisticated in the way obfuscation was incorporated, using 4 zero-days.
- daniel-cussen 4y agoThey did in fact target Osama bin Laden with mandated vaccines for boys for some very very important ailment to which there could be no religious objections...to get DNA material they could track down to him. That's how I heard it.
- aahortwwy 4y agoSlightly different from what the parent is describing. Especially the "little collateral damage" part. https://www.thelancet.com/journals/lancet/article/PIIS0140-6736(14)60900-4/fulltext https://www.thelancet.com/journals/lancet/article/PIIS0140-6...
- daniel-cussen 4y ago[flagged]
- eru 4y ago> In such a setup, simplicity and options with known and explored failure modes are good. The comments on the submitted article itself also point that out. They are worth reading.
- weare138 4y agoAlso these techniques can be a double edged sword. Like the author mentions techniques known to Bulgarian hackers in the 90's. Well that's the problem, everyone knows about it already so you should assume there's a good chance the enterprise security software you're up against knows about it too. Plus I'm sure if this was created by US intel they already had a pretty good idea what the Iranians would have been running on their networks and tested Stuxnet against it before it was launched.