4 ms·
Technically, Stuxnet was and is an absolute masterpiece. Infiltration (dropper/1. Main.c): Stuxnet infiltrated systems by exploiting vulnerabilities in Window
by Jimmc414 3y ago
Technically, Stuxnet was and is an absolute masterpiece.
Infiltration (dropper/1. Main.c):
Stuxnet infiltrated systems by exploiting vulnerabilities in Windows. It often spread through infected USB drives. When a user plugged the USB into a computer, Stuxnet would use these vulnerabilities to install itself. In the dropper/1. Main.c file, the DllMain function is where this initial infiltration mechanism is initiated. This function sets up the malware in the system after it's been triggered, typically by the insertion of the infected USB.
Staying Hidden (dropper/2. STUBHandler.c):
Once installed, Stuxnet used rootkit techniques to hide its files and processes from antivirus software and the system’s administrators.
In dropper/2. STUBHandler.c, the code manages the hiding of Stuxnet's activities, including concealing its files and processes, making the malware invisible to regular detection methods.
Verifying the target (dropper/3. OS.c):
Stuxnet was designed to act under specific conditions. It checked the infected system to determine if it matched its target - typically industrial control systems, particularly those using Siemens software and PLCs. In dropper/3. OS.c, functions like CheckSystemVersion ensure the system is compatible, and potentially, if it matches the target specifications, before proceeding further.
Delivering Payload through PLCs (dropper/6. MemorySections.c and beyond):
real damage was done by manipulating the PLCs controlling the centrifuges. Stuxnet altered the commands sent to these PLCs, causing the centrifuges to spin erratically and eventually fail. In dropper/6. MemorySections.c file likely includes functions for loading the malware's payload into memory, but the specific code targeting PLCs might be in other parts of the codebase that aren't as clearly identified.
- throw310822 3y agoDid it also spread in the West? How did they prevent it from affecting also friendly countries nuclear programs, is Iran the only country working at that stage of the technology?
- elliotwagner 3y agoPretty sure it was delivered by usb not internet access, plus stuxnet was designed to work in a very specific environment (iran nuclear plant)
- defrost 3y ago> plus stuxnet was designed to work ... its way towards ... > a very specific environment (iran nuclear plant) Stuxnet was a full stack of plugins (which lends huge weight toward the early "big team" design and build theories of first observers). There was a payload intended for very specific centrifuges ... and there was replication toward target logic ( Farsi language | locale seeking targets for copying ) IIRC. The "work" of Stuxnet wasn't limited to screwing up the centrifuges, it also had seeking and limited comms.
- vlovich123 3y agoTo add onto that, the public infection was meant as a smoke screen to provide cover for the CIA setting up a fake business to enter the nuclear facility and installing it via USB. I’m not sure what kind of value the smoke screen created. Maybe created some confusion in Iranian intelligence services as to how stuxnet invaded? But ultimately knowledge of infection was counter productive as stuxnet was design to subtly change the control parameters so that the system would get damaged in a hard to detect way (spinning centrifuges slightly faster than they should have if I recall correctly)
- johndunne 3y agoWorth a watch on the subject: https://www.youtube.com/watch?v=U_7CGl6VWaQ https://www.youtube.com/watch?v=U_7CGl6VWaQ
- speps 3y agoLooks like most of this reply is ChatGPT generated... "but the specific code targeting PLCs might be in other parts of the codebase that aren't as clearly identified" is something I've seen it generate when I asked details about a codebase as well, but it didn't have all the details.
- ryanjshaw 3y agoThe grammar is poor in places suggesting human editing, but I'll bet 10 bucks this is mostly ChatGPT too. OP testing a new GitHub code walkthrough tool? 1 day ago OP professed being quite familiar with ChatGPT's capabilities. OP, next time just give us a link to your tool's beta analysis of the repo.
- dfox 3y agoAlso, it is mostly wrong. The whole /dropper part is the initial loader, which has nothing to do with either hiding the presence or the actual PLC payload. Effectively it is an somewhat obfuscated stub for obfuscated self-extracting archive that is an dll and not executable.