8 ms·
Fast16: High-precision software sabotage 5 years before Stuxnet
- TranspectiveDev 6mo ago[dead]
- Retr0id 6mo agoThe submitted article appears to be an LLM summary of https://www.sentinelone.com/labs/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stuxnet/ https://www.sentinelone.com/labs/fast16-mystery-shadowbroker...
- dd23 6mo agoNo clue if the link that I posted is an AI summary. I also just found it somewhere. But indeed many more details in the link you shared. Thanks for posting this!
- bpt3 6mo agoI think LLMs would do a better job. I was about to respond saying what a terrible article it was, as it reads as if the author has no idea what he was talking about. Attempting to paraphrase the original article would explain it.
- dataflow 6mo agoI don't see how it can be an LLM summary of that page given that it mentions many things that your link doesn't. Edit: Old link for those wondering, since it got changed: https://hackingpassion.com/fast16-pre-stuxnet-cyber-sabotage/ https://hackingpassion.com/fast16-pre-stuxnet-cyber-sabotage...
- Retr0id 6mo agoSuch as?
- dataflow 6mo agoHave you read both of them? There's a ton of stuff. "Advances in Civil Engineering", "TMSR-LF1", "Black Hat Asia"...
- andai 6mo agoIt appears to be a summary of both the official SentinelOne article, and this one: https://www.theregister.com/2026/04/24/fast16_sabotage_malware/ https://www.theregister.com/2026/04/24/fast16_sabotage_malwa...
- dataflow 6mo agoNo, these aren't all mentioned there either: https://news.ycombinator.com/item?id=47914748 https://news.ycombinator.com/item?id=47914748
- arcza 6mo ago> This one did not destroy machines or blow things up. It corrupted the math. This LLM style of writing has had it's day.
- dgacmu 6mo agoThank you for finding this - the original is a really interesting article. (@dang - consider re-pointing to this?)
- DetroitThrow 6mo agoOr to https://www.theregister.com/2026/04/24/fast16_sabotage_malware/ https://www.theregister.com/2026/04/24/fast16_sabotage_malwa... The current article is hard to read
- andai 6mo agohttps://www.theregister.com/2026/04/24/fast16_sabotage_malware/ https://www.theregister.com/2026/04/24/fast16_sabotage_malwa... This one has some additional details, based on a talk given by one of the authors.
- dang 6mo agoChanged now from https://hackingpassion.com/fast16-pre-stuxnet-cyber-sabotage/ https://hackingpassion.com/fast16-pre-stuxnet-cyber-sabotage.... Thanks!
- trebligdivad 6mo agoHaha it's a fun finding though; The source control comment feels a little off; I'm sure there were SCCS (hmm or did cvs use similar?) still around at that time.
- tiagod 6mo agoI believe that comment was specific to it being unusual in Windows software, suggesting the developers were also working in UNIX stuff (where usage SCCS/RCS was common).
- codezero 6mo agoMy favorite part of this was: That kind of notation, called SCCS/RCS, is the equivalent of finding a rotary phone in a modern office. Nobody uses it in 2005 Windows kernel code unless their programming background goes back decades, to government and military computing environments — The astrophysics lab I worked at in 2006 was still using svn and had a bunch of Fortran with references to systems from the 70s and 80s. The code ran perfectly well thanks to modern optimizing compilers and having moved from Vax to Linux in the 90s, it was a surprisingly seamless transition. It reminds me of a conference talk I’ve referenced before “do over or make due” basically implying rewriting large amounts of mostly functioning code was not worth the effort if it could be taped together with modern tools.
- tptacek 6mo agoYeah, I used to be skeptical of the government provenance of things like Stuxnet (I am not any more, I'm fully sold, like everyone else), and notes like this were why. People used RCS well into the 2000s! RCS as a tool had virtues over SVN and CVS.
- codezero 6mo agoI do wonder if these breadcrumbs were also left intentionally. “Oh look, we are using old stuff, don’t be afraid!” Or for some other reason. It is a little surprising to pull off such a sophisticated attack and miss details you could find running ‘strings’ unless I’m missing something and this part was encrypted.
- tptacek 6mo agoI think that in the time period we're talking about, RCS wasn't really even all that old. Like, RCS is old, sure, but it was also in common use especially by Unix systems people; it's what you might have reached for by default to version your dotfiles, for instance.
- codezero 6mo agoYes, but even back then I was aware of the sections in executables (wasn’t this where it was found?) and any neckbeard from the 70s and 80s might be even more so aware. That said, yeah, sure, it’s a very possible and understandable oversight, but I’m weary because of all the text in viruses and such as indicators. Seems like a pass over ‘strings’ would be obvious. Though. TIL, strings doesn’t necessarily scan the entire executable.
- deleted 6mo ago[deleted]
- slim 6mo agosabotaging science must be the most morally corrupt thing you can do as a civilisation
- Cthulhu_ 6mo agoNah; it's to prevent a country from developing a superweapon and possibly triggering WW3 / worldwide nuclear annihilation. This comment is very exaggerated, I can think of a few more "morally corrupt" things to do.
- jabedude 6mo agoSpying on and sabotaging weapons development of foreign adversaries is a completely normal government function
- deleted 6mo ago[deleted]
- stankondrat 6mo agoI hope one day, it will no longer be normal - it will be wild.
- _joel 6mo agoI wonder how many results got nerfed via https://en.wikipedia.org/wiki/Pentium_FDIV_bug https://en.wikipedia.org/wiki/Pentium_FDIV_bug before it was known about.
- codezero 6mo agoI’d be surprised if it were a lot. At that time (open to corrections) not a lot of scientific research was done on consumer intel platforms. Obviously it was found by a mathematician, but I still suspect it wasn’t obvious in published research or that it ended up not causing significant enough deviations to cause research to revisit the calculations. My team ran into some interesting but very small deviations when we moved our iterative solar wind model from 32 bit to 64 bit, but the changes weren’t significant enough to revisit or re-do prior research wholesale. Like my team in the 2000s I suspect anyone who had data crunched by this bug also revisited it and either concluded it wasn’t significant enough or redid the work and it didn’t change the conclusions. I am curious now if this bug was cited in any papers at the time to give a rough idea how aware or affected academics were.
- tiagod 6mo agoThis is an amazing find. I'm very curious regarding the specific targets of these rules, and in the exact changes to the results. Wonder if they will only make a difference in simulated conditions super specific to nuclear reactors?
- dhx 6mo agoI dug into how software such as LS-DYNA could have been modified. Take for example the EOS_JWL equation at [1] (vendor website, public manual) which is implemented by LS-DYNA. This equation seemingly could be used, alongside other equations implemented within LS-DYNA, to answer questions such as how long it'd take for a detonator in a missile warhead to detonate a primary explosive substance to cause a particular pressure wave at 20m distance. Working backwards from this result may provide a required fuze timing. Equations and parameters used with LS-DYNA are derived from scientific research, such as [2], which is US government research from the 1980's providing experimental results for high explosive substances. One such example from [2] is experimentation to determine the friction an explosive substance has against different materials which may enclose it. Given the software has equations purposely designed for explosives modelling, it'd be fairly easy to just target those equations in ways which will just slightly frustrate a scientist/engineer into thinking they've got a problem with the manufacturing quality of steel, rather than suspect the software is deliberately adding +/-20% noise to a friction coefficient. The modern equivalent may be something like {insert adversarial country name here} downloading a pirated version of Ansys Autodyn 2026 R1 shortly after official release from a Chinese cracking group on a Chinese bulletin board forum, where just a handful of seeders sit behind Russian ISPs. And then {insert adversarial country name here} later notice during experimentation that the software calculations never quite match experimental results, and maybe then suspecting the pirated copy was deliberately tampered with and distributed. However, this situation may be fairly easily solved by {insert adversarial country name here} by just grabbing a copy of the software they want off a hacked network of a random university or engineering consulting firm in the aerospace and defence sector. Plus it may be naive to assume {insert adversarial country name here} in 2026 couldn't develop their own software from scratch (and/or perform calculations manually), or just rely on experiments, to achieve whatever outcome some other nation state group of hackers is trying to avoid. {insert adversarial country name here} would have to have experimentation equipment and skills regardless to verify manufacturing quality. Simulation software mostly reduces costs and timeframes by reducing the number of mockups and physical experiments needed. For example, it's cheap to run 1000 simulations of an artillery shell hitting vehicle armor plates as shown in [3], and more expensive and time consuming to do the same repetitive thing in the real world. [1] https://ftp.lstc.com/anonymous/outgoing/jday/manuals/LS-DYNA_manual_Vol_I_R6.1.0.pdf#page=1189 https://ftp.lstc.com/anonymous/outgoing/jday/manuals/LS-DYNA... [2] https://www.osti.gov/servlets/purl/6530310 https://www.osti.gov/servlets/purl/6530310 [3] https://www.youtube.com/watch?v=_dv2PecKUBM https://www.youtube.com/watch?v=_dv2PecKUBM
- vasco 6mo agoSo that's why China still can't make ballpoint pens? /s
- jeremie_strand 6mo ago[dead]
- Lihh27 6mo agoheh the key move is the worm. you can't catch it by checking on a second box because there is no clean box.
- kittikitti 6mo agoThank you for sharing this. I was recently pushing the limits of precision computing and this illuminated a part of my research. It built on top of largely government funded research, where I found a surprising dearth of available precision frameworks with verification. Perhaps national security interests, as elucidated by the original poster, discourages transparency of methods for arbitrary precision calculations.
- hnthrowaway0315 6mo agoDownload link for anyone who is curious enough: https://bazaar.abuse.ch/sample/9a10e1faa86a5d39417cae44da5adf38824dfb9a16432e34df766aa1dc9e3525/ https://bazaar.abuse.ch/sample/9a10e1faa86a5d39417cae44da5ad... I'll probably build a Windows XP VM first.
- int0x29 6mo agoHas anyone posted the windows service file yet? That looks just to be the loader.
- hnthrowaway0315 6mo agoNo I haven't found it yet. AFAIK MalwareBazaar (right now I cannot access the website) only has two files, one .exe and another one some 30K.
- _alphageek 6mo ago[dead]
- aaron695 6mo ago[dead]
- foreman_ 6mo ago[flagged]
- cawksuwcka 6mo ago[dead]
- PoignardAzur 6mo agoThat article is sobering. The fact that this malware stayed under the radar for 20 years is pretty ominous in itself.
- ronin_niron 6mo agoIEEE-754 only mandates correct rounding for +-*/ and sqrt. Transcendentals (sin/cos/exp/log/pow) are explicitly allowed to vary in the last few ULPs, and glibc, musl, MSVC, and Intel SVML all do. PID is just basic ops, so libm divergence doesn't hit there, but motor vector control or sensor linearization touches these functions every cycle and small disagreements compound. Two firmware revisions can have zero source diff and still drift in production. The only thing that changed was the linked libm. It actually shows up in Payne-Hanek argument reduction and at the worst table-maker's-dilemma boundaries. Probably why safety-critical guidance pins a specific libm build instead of just "IEEE-754 compliant".
- aa-jv 6mo agoInteresting that this was discovered after embarking on a journey to understand how widespread the use of Lua is, in the exploits realm .. I also wonder why they opted to make this an injectable worm and not just a side-loaded 'feature' of the OS?
- Schlagbohrer 6mo agoWhat would the difference be? They would have the same effect.
- aa-jv 6mo agoEasier to deliver as an OS bundle, no worm required.
- JDPy 6mo agoI recently read: Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers by Andy Greenberg Very good book. Perhaps a follow up series will be needed with the new information coming out and of course what we have seen/learned since.
- anthk 6mo agoThe govemerment, 1984-like agencies and some others in Middle East will truly hate Guix and reproducible computing being portable to Powerpc and even legacy machines. There more heterogeneous your setup, the better.
- laszlojamf 6mo agothis reminds a lot about the Three-Body Problem series. There it's aliens sabotaging science. In reality it was always the NSA.
- anthk 6mo agoThe NSA can't touch China before turning the whole commerce with the US into shards. They are improving like crazy on clear energies and the Oil Jihad can't do nil.
- Schlagbohrer 6mo agoWhy did this get downvoted so much?
- m3047 6mo agoI hope when people see RCS rev data on some of the stuff I publish it gives them pause.
- andai 6mo agoFor posterity, there was a subthread about how the main submission was some kind of AI generated article. This appears to have been deleted. (Or some HN magic happened where threads are merged? I don't know.) At any rate, the original link was https://hackingpassion.com/fast16-pre-stuxnet-cyber-sabotage/ https://hackingpassion.com/fast16-pre-stuxnet-cyber-sabotage... https://archive.ph/7VpWv https://archive.ph/7VpWv Which while apparently being AI generated, does have some additional information over the other sources. (Which have apparently also been deleted from the thread.) For example it makes a reference to this relevant paper, though it fails to cite it properly. https://onlinelibrary.wiley.com/doi/10.1155/2024/1672269 https://onlinelibrary.wiley.com/doi/10.1155/2024/1672269 --- Another great source for the story is: https://www.theregister.com/2026/04/24/fast16_sabotage_malware/ https://www.theregister.com/2026/04/24/fast16_sabotage_malwa... And in case it changes again, the current link is: https://www.sentinelone.com/labs/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stuxnet/ https://www.sentinelone.com/labs/fast16-mystery-shadowbroker... Which is a write up by the actual researchers.
- password4321 6mo agoThe subthread is here in this discussion, auto-collapsed: https://news.ycombinator.com/item?id=47913855#47914315 https://news.ycombinator.com/item?id=47913855#47914315
- atlasagentsuite 6mo ago[dead]