5 ms·

>The code itself is 50 times as big as the typical computer worm All else aside, this is a clear pointer to government contractors.

kamaal 14y ago
How did they possibly know the code is 50 times that big. Is the code out in the open?
- c16 14y ago
  "Several layers of masking obscured the zero-day exploit inside, requiring work to reach it, and the malware was huge — 500k bytes, as opposed to the usual 10k to 15k." - http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/all/1 http://www.wired.com/threatlevel/2011/07/how-digital-detecti... This is a great read and very informative!
  - ArbitraryLimits 14y ago
    Yes it is, but your parent post was asking how they knew how large the source code was. This quotation is reporting the size of the final binary.
    - schiffern 14y ago
      Where did the article say 'source code'? Machine code is still 'code'. You have to consider the audience the NY Times is targeting. Just knowing what a compiler is puts one in relatively sparse company.
- petegrif 14y ago
  Yes.
- tptacek 14y ago
  The relationship between compiled code and source code is not as mysterious as you're making it out to be. This is not a hard analysis to conduct. Incidentally, from friends who do serious malware reversing work (we do not do any malware work): the "50x bigger, feels like pro contractors" assessment rings true for several other reasons; for instance, the style of programming used in the worm itself.
Achshar 14y ago
I think they are confusing the terms here. What they mean is that the worm itself is 20 mb in size where as average is about 1 mb. So The worm's code is 20x. They probably don't know that worm's size and it's source code are two different things. They are NYT not a tech blog, so i guess this is excusable.
- chii 14y ago
  but i think they got their point across well enough; technical trvialities don't matter at all in this case.

kamaal 14y ago

How did they possibly know the code is 50 times that big. Is the code out in the open?

c16 14y ago
"Several layers of masking obscured the zero-day exploit inside, requiring work to reach it, and the malware was huge — 500k bytes, as opposed to the usual 10k to 15k." - http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/all/1 http://www.wired.com/threatlevel/2011/07/how-digital-detecti... This is a great read and very informative!
- ArbitraryLimits 14y ago
  Yes it is, but your parent post was asking how they knew how large the source code was. This quotation is reporting the size of the final binary.
  - schiffern 14y ago
    Where did the article say 'source code'? Machine code is still 'code'. You have to consider the audience the NY Times is targeting. Just knowing what a compiler is puts one in relatively sparse company.
petegrif 14y ago
Yes.
tptacek 14y ago
The relationship between compiled code and source code is not as mysterious as you're making it out to be. This is not a hard analysis to conduct. Incidentally, from friends who do serious malware reversing work (we do not do any malware work): the "50x bigger, feels like pro contractors" assessment rings true for several other reasons; for instance, the style of programming used in the worm itself.

Achshar 14y ago

I think they are confusing the terms here. What they mean is that the worm itself is 20 mb in size where as average is about 1 mb. So The worm's code is 20x. They probably don't know that worm's size and it's source code are two different things. They are NYT not a tech blog, so i guess this is excusable.

chii 14y ago
but i think they got their point across well enough; technical trvialities don't matter at all in this case.