8 ms·
Stuxnet Source Code
- Jimmc414 3y agoTechnically, Stuxnet was and is an absolute masterpiece. Infiltration (dropper/1. Main.c): Stuxnet infiltrated systems by exploiting vulnerabilities in Windows. It often spread through infected USB drives. When a user plugged the USB into a computer, Stuxnet would use these vulnerabilities to install itself. In the dropper/1. Main.c file, the DllMain function is where this initial infiltration mechanism is initiated. This function sets up the malware in the system after it's been triggered, typically by the insertion of the infected USB. Staying Hidden (dropper/2. STUBHandler.c): Once installed, Stuxnet used rootkit techniques to hide its files and processes from antivirus software and the system’s administrators. In dropper/2. STUBHandler.c, the code manages the hiding of Stuxnet's activities, including concealing its files and processes, making the malware invisible to regular detection methods. Verifying the target (dropper/3. OS.c): Stuxnet was designed to act under specific conditions. It checked the infected system to determine if it matched its target - typically industrial control systems, particularly those using Siemens software and PLCs. In dropper/3. OS.c, functions like CheckSystemVersion ensure the system is compatible, and potentially, if it matches the target specifications, before proceeding further. Delivering Payload through PLCs (dropper/6. MemorySections.c and beyond): real damage was done by manipulating the PLCs controlling the centrifuges. Stuxnet altered the commands sent to these PLCs, causing the centrifuges to spin erratically and eventually fail. In dropper/6. MemorySections.c file likely includes functions for loading the malware's payload into memory, but the specific code targeting PLCs might be in other parts of the codebase that aren't as clearly identified.
- throw310822 3y agoDid it also spread in the West? How did they prevent it from affecting also friendly countries nuclear programs, is Iran the only country working at that stage of the technology?
- elliotwagner 3y agoPretty sure it was delivered by usb not internet access, plus stuxnet was designed to work in a very specific environment (iran nuclear plant)
- defrost 3y ago> plus stuxnet was designed to work ... its way towards ... > a very specific environment (iran nuclear plant) Stuxnet was a full stack of plugins (which lends huge weight toward the early "big team" design and build theories of first observers). There was a payload intended for very specific centrifuges ... and there was replication toward target logic ( Farsi language | locale seeking targets for copying ) IIRC. The "work" of Stuxnet wasn't limited to screwing up the centrifuges, it also had seeking and limited comms.
- vlovich123 3y agoTo add onto that, the public infection was meant as a smoke screen to provide cover for the CIA setting up a fake business to enter the nuclear facility and installing it via USB. I’m not sure what kind of value the smoke screen created. Maybe created some confusion in Iranian intelligence services as to how stuxnet invaded? But ultimately knowledge of infection was counter productive as stuxnet was design to subtly change the control parameters so that the system would get damaged in a hard to detect way (spinning centrifuges slightly faster than they should have if I recall correctly)
- johndunne 3y agoWorth a watch on the subject: https://www.youtube.com/watch?v=U_7CGl6VWaQ https://www.youtube.com/watch?v=U_7CGl6VWaQ
- speps 3y agoLooks like most of this reply is ChatGPT generated... "but the specific code targeting PLCs might be in other parts of the codebase that aren't as clearly identified" is something I've seen it generate when I asked details about a codebase as well, but it didn't have all the details.
- ryanjshaw 3y agoThe grammar is poor in places suggesting human editing, but I'll bet 10 bucks this is mostly ChatGPT too. OP testing a new GitHub code walkthrough tool? 1 day ago OP professed being quite familiar with ChatGPT's capabilities. OP, next time just give us a link to your tool's beta analysis of the repo.
- dfox 3y agoAlso, it is mostly wrong. The whole /dropper part is the initial loader, which has nothing to do with either hiding the presence or the actual PLC payload. Effectively it is an somewhat obfuscated stub for obfuscated self-extracting archive that is an dll and not executable.
- rurban 3y agoThis was 2012 with the kernel module 2014 added
- johndunne 3y agoI remember first hearing about this while working at a US firewall company. The scale and precision of the attack kept this virus in the minds of everyone who appreciated what it proved capable of and the scale of social engineering employed to effect it. It kind of ushered in state-on-state cyber warfare, or at least, brought the reality of weaponized viruses to the public conscience.
- odyssey7 3y agoImagine if the same strategy were applied to biological warfare. Novel viruses tailored to be symptomatic and cause harm to just one specific world leader. If the technology exists, it could be the most formidable assassination tool available; a self-delivering, non-nuclear ace-in-the-hole for winning a war.
- bragr 3y agoIt's probably not that imaginary. There was much hand ringing during COVID that Russia's testing protocol for meeting Putin would allow them to collect DNA from world leaders. https://www.reuters.com/world/europe/putin-kept-macron-distance-snubbing-covid-demands-sources-2022-02-10/ https://www.reuters.com/world/europe/putin-kept-macron-dista...
- odyssey7 3y agoAnd conversely, the article also mentions Putin’s social distancing, which could be a rational defensive measure against biological warfare that he believes might exist, rumors of an undisclosed serious health issue notwithstanding.
- jerrygenser 3y agoThis concept is featured in The Dark Forest, the second book in the Three Body Problem trilogy. It was something where you could genetically tag someone and then if they woke up 50 years later from a chrono sleep, various systems were preprogrammed to have "accidents" around them, like self driving cars, etc.
- stef25 3y agoWhen this happened it was real edge of your seat stuff. I couldn't get enough of the podcasts covering this, nor of the book "countdown to zero". This was one of the first reports on the subject https://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/ https://krebsonsecurity.com/2010/07/experts-warn-of-new-wind... * EDIT removed two paragraphs with wrong information
- darkclouds 3y ago[dead]
- rereasonable 3y agoTechnical wonder aside, the argument for using nuclear power over fossil fuels really hits a faultline in situations like this. I wonder how the majority of folk rationalise their viewpoint surrounding this situation without being seen as massively hypocritical?
- wiz21c 3y agoA nuclear plant is just as weaponizable as any large dam...
- moontear 3y agoIs it? The nuclear fallout of a plant may linger for longer than any destruction done by the water of a large dam I would say or do you mean something else?
- sofixa 3y agoA modern nuclear powerplant is incapable of exploding, at worst it can meltdown and leak radiation in the vicinity. This can of course have very bad results, but check Fukushima - more people died from the evacuation, and from a fire caused by a fuel tank in another city due to the natural disasters that caused the meltdown, than did from radiation. A radiation leak is easy to detect (and all areas near nuclear power plants in semi-developed countries have automated collection of radiation), and isn't an immediate death sentence. Meanwhile when a dam breaks, immediately everyone and everything in its path will be obliterated. Vastly more people have died from dam failures than even the worst of the worst of nuclear power plant incidents, Chernobyl, where staggering incompetence met horrific design flaws and bugs. Something like that is impossible to happen today.
- le-mark 3y agoCertain types of nuclear reactors can be used to create fissile material; kind of super weaponisable? https://en.wikipedia.org/wiki/Breeder_reactor https://en.wikipedia.org/wiki/Breeder_reactor
- 3y ago
- zmgsabst 3y agoA shame EQGroup tightened their security and we’ll possibly never see the other examples. But probably for the best, considering the havoc EternalBlue caused.
- fulafel 3y agoAccording to the README, this is not the Stuxnet source code. Rather it's authored by people mentioned in the license by reverse engineers from the binaries. The real source code would probably have lots of juicy interesting things revealing how it was developed.
- marsRoverDev 3y ago// TODO: תקן את זה
- asylteltine 3y ago[flagged]
- bigallen 3y agoSeems like it was a joint effort between USA and Israel https://arstechnica.com/tech-policy/2012/06/confirmed-us-israel-created-stuxnet-lost-control-of-it/ https://arstechnica.com/tech-policy/2012/06/confirmed-us-isr...
- mablopoule 3y agoNo casual antisemitism here. I would be very surprised if it turns out that Israel wasn't involved in Stuxnet. It's not like they don't have extremely good cyber capacity, or incentives to hinder an iranian nuclear program.
- asylteltine 3y ago[flagged]
- AussieWog93 3y agoHonestly, it would be irresponsible and surprising if Israel _didn't_ try to sabotage Iran's nuclear program, especially given some of the things that the Iranians were saying publicly at the time.
- cies 3y agoIn Iran the copyrights of foreign works are not well protected. This lead to a lot of copying: western software and books are/were available for little more than the price of the writable CD-ROM or paper+ink you got it on. Translations of works were slightly more expensive, that the translator did have to get paid. Since Windows (etc.) was free, and the university thought curriculum based largely on US uni-books, Windows is/was everywhere, even in sensitive environments. Window has the worst track record privacy and security (remember NSA_KEY?), and Iran got bitten by this very hard.
- kafrofrite 3y agoI'm not a fan of Windows but Stuxnet didn't happen because of Windows. Iran decided to spin up a nuclear program and Israel and the US had concerns and wanted to stop it. They had the resources to develop something tailored for this unique situation, which included windows, Siemens PLCs (IIRC), Centrifuges etc. and developed the malware based on their target. Even if their target used a different stack, they'd find a way to achieve the same result.
- cies 3y agoIt's all about price. Attacking Linux will be harder, thus more expensive. You make it sound easy, if that was the case they'd launch one attack every few months or so. This stuff is expensive, and making it 100x harder means 100x less attacks before the budget runs out.
- wslh 3y agoBeyond Windows security issues, if you (an organization mainly) are enough motivated you can attack other OSes as well. There is anwjole industry about exploiting bugs for more secure platforms.
- MikusR 3y agohttps://youtu.be/vjkBAl84PJs https://youtu.be/vjkBAl84PJs
- richardw 3y agoThe relevant Darknet Diaries episode: https://darknetdiaries.com/episode/29/ https://darknetdiaries.com/episode/29/
- bazmattaz 3y agoSuperb podcast. Shame he dropped down to only 1 episode per month
- jonplackett 3y agoCan anyone explain why Stuxnet was admitted to and publicised so much. Aren’t secret operations usually kept… secret? What was the motivation for the PR drive?
- Arson9416 3y agoChilling effect? "We have the ability to infiltrate any system and catastrophically destroy your hardware."
- bazmattaz 3y agoIt was never admitted to though; https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet It was publicised so much because it was the most advanced cyber weapon of its kind to ever been released.
- bitcharmer 3y ago> it was the most advanced cyber weapon of its kind to ever been released Correction: ... it was the most advanced cyber weapon of its kind to ever been discovered
- Sprint9935 3y agoIt was said that it would not have been discovered had it not been modified half way through its life to spread faster. This led to it spreading beyond the Natanz facility that it targeted.
- dijit 3y agoI don't think there was a PR drive from the US/Israeli government, more like despite the US/Israeli government. Remembering that the only reason we even know about stuxnet is because it was so aggressive that practically every PC on the planet caught it at one point. Also "stuxnet" is the name we gave it, it seems similar to another US Govt project that we know very little about codenamed "Olympic Games". If it had not been so aggressive it would have gone completely unnoticed. Likely this is the case for a lot of state-sponsored malware. (especially coming out of FIVE-EYES).
- rozenmd 3y agoI remember having to write a presentation about Stuxnet while at Uni, it was insane. At the time they reckoned the authors had a functioning QA environment to ensure it actually worked (broke) the Siemens PLCs they were targeting.
- bitcharmer 3y agoStuxnet didn't break anything. It was used to override the working regime of centrifuges and conceal this fact from being discovered.
- irobeth 3y agoI guess to be more exact, Stuxnet didn't break anything, but the PLC payload it delivered was designed to damage centrifuges, and that would have been the module under test in that QA environment
- bitcharmer 3y agoWasn't it actually about spoiling the whole stock of Iranian's Uranium by applying damaging amounts of centrifugal force to it? I'm probably wrong about that, just asking.
- irobeth 3y agothe payload had a few modes of operation, IIRC one was to spin it far faster than it should, then stop abruptly in an attempt to damage the centrifuge one was to run it at the wrong RPM to spoil the product of the centrifuge in either mode, it would replay 'good' data to make the centrifuge look functional to an administrator the way I understood, a 'bonus goal' was to keep the Iranians unable to diagnose what was going wrong, both with their production process (producing bad stock) and the failures (promoting distrust in their engineers) - i can't find an article right now, but I remember reading they were churning through site engineers at the time - presumably firing them for the on-site failures of centrifuges or their inability to stop them
- 3y ago
- phendrenad2 3y agoWhat always impressed me about Stuxnet wasn't the technical complexity, but the amount of spycraft that must have gone into identifying exactly what to program it to do, and what they could get away with.
- baybal2 3y agoFrance has enabled nuclear weapons programmes of many rouge states. Maybe Israelis just went to the Elysee palace, and asked?
- MilStdJunkie 3y agoI don't know about French nukes, but French-affiliated aerospace has a general rep as being leakier than most. Eh, "leakier" is a negative way of putting it . . how about "loose-lipped"? One tools selection from a French-based vendor - a cloud option for uncontrolled data - was turned down by uniformed dudes from the program office, based on this prejudice. But a similar cloud offering from "Ze Germans"? Oh, that was A-OK. Both products seemed built from compressed pellets of Turkish dander - of course they did, this is DoD shopping - but one of them did have that snappy Aryan zing.
- CodeWriter23 3y agoYou don’t need to be a genius nor invest very deeply to figure out the technical details of introducing vibration into a high-speed centrifuge using SCADA (industrial automation protocol) in a barely noticeable way. As you suggest, tradecraft is the primary skill, jumping the air gap required an asset inside.
- Alifatisk 3y agoHave anyone seen the documentary about stuxnet (Zero Days, 2016)? It's incredible. On the documentary, they mention another virus which was supposed to be even worse than Stuxnet, the project name was Nitro Zeus.
- aaron695 3y ago[dead]
- LorenDB 3y agoHas anybody else here read Kim Zetter's great book Countdown to Zero Day? It's a wonderful look at the discovery of Stuxnet.
- Lunar5227 3y agoYes i can't recommend this book enough if you are interested in Stuxnet or cybersecurity. Very detailed and thorough.
- erez 3y agoI just love that not only they copyrighted it, they even give excuses for it. You can't copyright someone else's work, regardless of how long you took to reverse-engineer it from disassembled binaries. Obviously the "rights owners" are not going to take those two guys to court (pity though, that would've been hilarious), but since the only reason those two could license this is that this is a computer virus and no one will claim authority, their claims to ownership of the code have no merit. I would love it if someone would publish or use it and not give them credit or "violate" the terms of the license in some manner, as I'd love to see those two try to claim their case.
- lupire 3y agoIs the law clear in this? They created something different from the source material binary program.
- data_maan 3y agoThis. They don't give you the same as the original virus code, they give you different code (namely readable one), than apparently compiles to the virus assembly. It's plausible this took effort, so I think it's only fair if they license it - it seems also ethically fair, since their licence is permissive.
- ses1984 3y agoWouldn’t that be considered a derivative work? You can copyright those.
- ses1984 3y agoI mean you cannot copyright derivative work.
- cafeinux 3y agoI am sure big software companies wouldn't agree on this: decompile Excel or Photoshop and copyright the resulting code, and you shall get a nice lawsuit within days, if not hours. However, I guess there would have a bit of ToS breach, a pinch of DMCA and a lot of copyright infringement for reverse-engineering the software, maybe not that much for copyrighting the decompiled code.
- jonahrd 3y agoI remember reading a very well written article on stuxnet, detailing the entire way it worked. It was written in a very story-like way that built slowly until it revealed what the actual payload and impact was. Does anyone have a link to this article?
- mackman 3y agoThe book about it is a great read although I think it could have used a lot more editing. Chapters approach the timeline from different angles and as a result it does feel like later chapters are going over the same material too many times. Anyhow, you can read part of it here: https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/ https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/
- munksbeer 3y agoI also remember reading something like that. Sorry that I can't help locate it. Edit: Maybe it isn't what I wanted, but this article was good. https://arstechnica.com/tech-policy/2011/07/how-digital-detectives-deciphered-stuxnet-the-most-menacing-malware-in-history/ https://arstechnica.com/tech-policy/2011/07/how-digital-dete...
- idontwantthis 3y agoThe Perfect Weapon by David Sanger.
- rsingel 3y agoEverything Sanger knows about Stuxnet he borrowed from Kim Zetter without attribution. Goes double for Alex Gibney
- wtf_is_up 3y agoThe Symantec dossier [1] is a great read. [1]: https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en https://docs.broadcom.com/doc/security-response-w32-stuxnet-...
- justneedaname 3y ago
- max_ 3y ago>This repository contains RCEd code extracted from Stuxnet binaries via disassembler and decompilers. Is there a way to write code (make binaries) such that it would be extremely difficult to recover the source code via decompilers or a disassembler?
- karatinversion 3y agoThere’s always movfuscator [1] [1] https://github.com/Battelle/movfuscator https://github.com/Battelle/movfuscator
- misja111 3y agoYes, there are many ways to do that. When writing in a higher language such as e.g. C, you can use code obfuscators to make your C code extremely hard to read. If you want to make decompiling even impossible, you could modify the machine code generated by the C compiler. Even slight moderations are already enough. If you want to make it (virtually) impossible to even disassemble the machine code, you could encrypt your binary itself except for a small bootstrap that will unencrypt the remainder of the binary when it runs.
- lozenge 3y agoAnd the countermeasures for that: DEP or pause the program after decryption and inspect its memory.
- misja111 3y agoYeah true. But at least the virus binary might be able to get passed the heuristic checks of a virus scanner.
- inetknght 3y ago> When writing in a higher language such as e.g. C, you can use code obfuscators to make your C code extremely hard to read. Obfuscating C code shouldn't have any bearing on the decompilability of the output. > If you want to make it (virtually) impossible to even disassemble the machine code, you could encrypt your binary itself except for a small bootstrap that will unencrypt the remainder of the binary when it runs. Unencrypting the binary at startup is somewhat easy to hook into. It's harder to decrypt each individual function when that function is called and then re-encrypt it after the function ends. Bonus points if you re-encrypt after each `CALL`. This is stuff which was available back in 2003 -- that's when I first used techniques.
- JohnCClarke 3y agoI asked GPT to describe the main rootkit code. The high level view made it a little easier to find my way around. https://chat.openai.com/share/d5f0f002-6739-4b0f-ad50-d712078c08a5 https://chat.openai.com/share/d5f0f002-6739-4b0f-ad50-d71207... SetFastIoDispatch(): This function sets up the Fast I/O dispatch table for the driver. Fast I/O operations are a more efficient way to handle certain I/O operations in the Windows kernel. HookingFileSystems(): Hooks into the file systems (NTFS, FastFAT, CDFS) to intercept file system operations. It modifies system behavior by redirecting calls to these file systems. HookOne(): Hooks a single file system. It references a file system object by name and then attaches to it. DriverNotificationRoutine(): A notification routine called when the driver's status changes, such as when a device is attached or detached. AttachDevice(): Attaches the rootkit's device object to a target device in the system, allowing the rootkit to intercept calls to this device. IsAllreadyAttached(): Checks if the rootkit is already attached to a target device. CreateDevice(): Creates a device object for the rootkit, enabling it to interact with the system as a device driver. IsMyDevice(): Checks if a given device object belongs to the rootkit. SettingFlags(): Sets various flags for a device object to define its characteristics and behavior. AttachToStack(): Attaches the rootkit's device object to the device stack of the target device. OnFileSystemControl() and OnDirectoryControl(): These functions handle specific file system control and directory control operations, respectively. They are likely points where the rootkit intercepts and manipulates file system requests. SetCompletionFileControl() and SetCompletionDirControl(): Set up completion routines for file and directory control operations, allowing the rootkit to execute additional code when these operations complete. FileControlCompletionRoutine() and DirectoryCompletionRoutine(): Completion routines for file and directory control operations. They are invoked when file system and directory operations are completed, allowing the rootkit to intervene at this stage. FreeMdl(), AllocateMdl(), CreateWorkRoutine(), WorkerRoutine(): These functions manage memory descriptors (MDLs) and work items, which are kernel objects used for deferred or asynchronous work. GetOffsets(), FileCheck(), StrCheck(), TMPCheck(): These functions are involved in analyzing and potentially modifying file information during directory listings. They seem to be designed to hide or manipulate certain files or directories from being listed or accessed in a specific way. CallDriver(), IRPDispatchRoutine(), SetZero(): Helper functions for handling IRP (I/O Request Packet) processing and manipulating device extension structures. DriverEntry(): The entry point for the driver, setting up the rootkit when it is loaded into the system.
- stiray 3y agoThose who find stuxnet interesting, might appreciate some older art, just for fun to see where malware technology was in 2001: http://pferrie.epizy.com/papers/zmist.pdf?i=1 http://pferrie.epizy.com/papers/zmist.pdf?i=1 Author mirrored web page: https://z0mbie.dreamhosters.com/ https://z0mbie.dreamhosters.com/
- hyperific 3y agoIf you want the story of Stuxnet, Countdown to Zero Day by Kim Zetter is a great book. I have it on Audible and I've probably listened to it three times now.