4 ms·
I remember having to write a presentation about Stuxnet while at Uni, it was insane. At the time they reckoned the authors had a functioning QA environment to
by rozenmd 3y ago
I remember having to write a presentation about Stuxnet while at Uni, it was insane.
At the time they reckoned the authors had a functioning QA environment to ensure it actually worked (broke) the Siemens PLCs they were targeting.
- bitcharmer 3y agoStuxnet didn't break anything. It was used to override the working regime of centrifuges and conceal this fact from being discovered.
- irobeth 3y agoI guess to be more exact, Stuxnet didn't break anything, but the PLC payload it delivered was designed to damage centrifuges, and that would have been the module under test in that QA environment
- bitcharmer 3y agoWasn't it actually about spoiling the whole stock of Iranian's Uranium by applying damaging amounts of centrifugal force to it? I'm probably wrong about that, just asking.
- irobeth 3y agothe payload had a few modes of operation, IIRC one was to spin it far faster than it should, then stop abruptly in an attempt to damage the centrifuge one was to run it at the wrong RPM to spoil the product of the centrifuge in either mode, it would replay 'good' data to make the centrifuge look functional to an administrator the way I understood, a 'bonus goal' was to keep the Iranians unable to diagnose what was going wrong, both with their production process (producing bad stock) and the failures (promoting distrust in their engineers) - i can't find an article right now, but I remember reading they were churning through site engineers at the time - presumably firing them for the on-site failures of centrifuges or their inability to stop them
- bschne 3y agoNitpick but it was even harder, they wanted to keep the PLCs intact, report back normal operation, and change the control output specifically to destroy/damage uranium centrifuges
- ranting-moth 3y agoYep. I'd be surprised if their QA environment didn't contain at least one uranium centrifuge.
- delusional 3y agoYou'd be insane to develop something of the complexity of Stuxnet and not include a full end to end test in the QA process. It would be incredibly embarrassing for this to fail.
- edgyquant 3y agoIndeed. But as engineers it’s insane to think of having a testing environment that includes a uranium enrichment plant
- delusional 3y agoFair point. I can barely get access to a testing environment that contains a keycloak server.
- randomcarbloke 3y agoYou don't really need the centrifuge, just the inverter. I was working in industrial control and automation at the time, there were sweeping changes to what could and could not be done and by whom at every level. Old drives of all manufacturers that sat unused were audited and had to be brought up-to-date before any sale or change of hands could occur, serials were noted etc etc. Never felt like a manufacturer decision since it occurred in unison almost globally.
- 3y ago
- cqqxo4zV46cp 3y agoMe too! It was such a pivotal moment.