5 ms·

> For anybody getting worked up about the Stuxnet article in de Volkskrant: A water pump cannot carry a copy of Stuxnet Erik van Sabben's visit to Iran allegedl

> For anybody getting worked up about the Stuxnet article in de Volkskrant: A water pump cannot carry a copy of Stuxnet Erik van Sabben's visit to Iran allegedly happened end of 2018, whereas we assume initial infiltration in 2017. Well, that's all the proof I needed — a twitter post with no further information. Obviously he may be right as he is a researcher and most likely actually did the research, but an non-sourced definitive statement on social media is not what I consider "proof".

boringg 3y ago
A water pump has no software on it. If you have a variable frequency drive - potentially in that case you do.
- leptons 3y ago
  A water pump on sophisticated scientific equipment may well have software running it, it depends on the device and the water pump.
  - carlmr 3y ago
    I'd say it's even likely. I have worked on software for electric pumps, not this kind, but in general everything has software running on it now. The more hard to believe part is that a lot of electric equipment like water pumps have very simple software running on them, which might only be controlled by some messages on a serial bus that sends certain commands. To use that as a vector you would need the software to have very specific vulnerabilities.
    - leptons 3y ago
      You're thinking of one specific kind of "water pump", a small device with a simple microcontroller. But a "water pump" could mean many things, and it could be a larger system that is run by a computer running windows, with functionality that is essentially "a water pump" but it may be doing far more than only pumping water. Often the details are lost when journalists try to dumb down a subject so an average luddite can read it. The actual equipment may be a large box that has a water input and water output, but contain many other functions within - and the article does not describe any of this, it simply says "water pump", so of course some people are going to construe that as simply a motor, an H-bridge, and a microcontroller. But the reality is that it could be a far more complex device than that. The "water pump" designation could come from nothing more than the "telephone game" where information gets diluted as it gets told to successive people in the chain until it gets written in an article simply as "water pump" when it could be a far more sophisticated piece of equipment than that.
      - carlmr 3y ago
        True, I wouldn't call it a water pump if it was some separate, sophisticated control system that controls more than a water pump. But it's a realistic scenario.
- otikik 3y ago
  Well a water pump for a nuclear reactor (or around) might.
14 3y ago
Furthermore he may be wrong. After living through the Xbox 360 modding scene and the cat and mouse between home hackers not state sponsored hackers with unlimited resources I am always amazed when I look back at the cat and mouse game and what the Xbox hackers came up with. It’s simply mind blowing at times. The one that comes to mind is when Microsoft started making games 8gb by default. Lots of games used padding to fill that space so hackers then truncated games. Microsoft learned to detect and ban consoles using truncated games so hackers created custom software to flash to dvd burners so that the burner could burn to the outermost edge of the disc not normally useable. It was so cool to see this back and forth. My point is that with unlimited resources who knows what sort of creative way this water pump could have been used to transport the malware.
- whycome 3y ago
  I think Sony benefitted from turning a blind eye to PS2 piracy. And I also think Microsoft might have purposefully used hackers to develop counter attacks. Maybe for fun.
  - toyg 3y ago
    Piracy promotes a platform - if there is one company that understands that thoroughly, that's Microsoft. Hence, I doubt they employed people to promote piracy on the PS2.
input_sh 3y ago
Langner's a pretty authoritative source on the matter. I believe he was the first one to figure out what Stuxnet's target actually was.

boringg 3y ago

A water pump has no software on it. If you have a variable frequency drive - potentially in that case you do.

leptons 3y ago
A water pump on sophisticated scientific equipment may well have software running it, it depends on the device and the water pump.
- carlmr 3y ago
  I'd say it's even likely. I have worked on software for electric pumps, not this kind, but in general everything has software running on it now. The more hard to believe part is that a lot of electric equipment like water pumps have very simple software running on them, which might only be controlled by some messages on a serial bus that sends certain commands. To use that as a vector you would need the software to have very specific vulnerabilities.
  - leptons 3y ago
    You're thinking of one specific kind of "water pump", a small device with a simple microcontroller. But a "water pump" could mean many things, and it could be a larger system that is run by a computer running windows, with functionality that is essentially "a water pump" but it may be doing far more than only pumping water. Often the details are lost when journalists try to dumb down a subject so an average luddite can read it. The actual equipment may be a large box that has a water input and water output, but contain many other functions within - and the article does not describe any of this, it simply says "water pump", so of course some people are going to construe that as simply a motor, an H-bridge, and a microcontroller. But the reality is that it could be a far more complex device than that. The "water pump" designation could come from nothing more than the "telephone game" where information gets diluted as it gets told to successive people in the chain until it gets written in an article simply as "water pump" when it could be a far more sophisticated piece of equipment than that.
    - carlmr 3y ago
      True, I wouldn't call it a water pump if it was some separate, sophisticated control system that controls more than a water pump. But it's a realistic scenario.
otikik 3y ago
Well a water pump for a nuclear reactor (or around) might.

14 3y ago

Furthermore he may be wrong. After living through the Xbox 360 modding scene and the cat and mouse between home hackers not state sponsored hackers with unlimited resources I am always amazed when I look back at the cat and mouse game and what the Xbox hackers came up with. It’s simply mind blowing at times. The one that comes to mind is when Microsoft started making games 8gb by default. Lots of games used padding to fill that space so hackers then truncated games. Microsoft learned to detect and ban consoles using truncated games so hackers created custom software to flash to dvd burners so that the burner could burn to the outermost edge of the disc not normally useable. It was so cool to see this back and forth. My point is that with unlimited resources who knows what sort of creative way this water pump could have been used to transport the malware.

whycome 3y ago
I think Sony benefitted from turning a blind eye to PS2 piracy. And I also think Microsoft might have purposefully used hackers to develop counter attacks. Maybe for fun.
- toyg 3y ago
  Piracy promotes a platform - if there is one company that understands that thoroughly, that's Microsoft. Hence, I doubt they employed people to promote piracy on the PS2.

input_sh 3y ago

Langner's a pretty authoritative source on the matter. I believe he was the first one to figure out what Stuxnet's target actually was.