4 ms·
Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
Stuxnet! Here reproduced by me. Only researchs educations purposes.
- monster_truck 21d agoDirectory filtering needs to be fixed, one weird filename or symlink will make it BSOD. SSDT should probably have a lock. The chance of a race is ~low (higher under heavy sustained workloads) but it's too important to leave to chance. I'd probably do a rebuild of the directory lists in a separate buffer instead of working in place to avoid alignment fuckups. Yes I used LLMs, just like I did for all of the other vulns I've found or refined. As you can see from the source, this shit is tedious as hell. Doesn't change the value of knowing what to look/ask for. Give one of those open models a fresh windows box (not a VM) and tell it to fuck something up, it's fun.
- joshka 21d agoIf you're using coding agents for this, it may be worth splitting this up into multiple well arranged modules that tell a coherent story and make it easy to browse, and add explanatory docs based on the various things the LLM has found about each function / type.
- monster_truck 21d agoWaste of tokens IME, better to do it like this and leave that kind of post processing to signature obfuscation. You don't need exploratory docs, try asking one for complete function signatures of all the Windows APIs used, it's going to spit the docs out.
- joshka 21d agoYour decompilation threads have all the necessary info in them for this, anyone coming after lacks that foundation and effectively is doing a second inference over the hidden state, assumptions, etc. that your sessions have in them. A simulacrum of a simulacrum in essence is likely to be not particularly good.
- CMDDestory 21d agoThank PR!
- kibitzor 21d agoThanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as it’ll either get patched and/or everyone can reverse engineer it to use. For those not familiar with Stuxnet, it’s a discovered cyber-weapon from 2010 which “reportedly destroyed almost one-fifth of Iran's nuclear centrifuges. ” and “ neither the United States nor Israel has openly admitted responsibility” but likely were the developers [1] [1-Wikipedia Entry](https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet) [2-“Countdown To Zero Day” book if you liked the Wikipedia entry](https://www.audible.com/pd/Countdown-to-Zero-Day-Audiobook/B00P30Z5F2 https://www.audible.com/pd/Countdown-to-Zero-Day-Audiobook/B...) [3-“Zero Days” movie](https://www.imdb.com/title/tt5446858/ https://www.imdb.com/title/tt5446858/)
- fathermarz 21d agoThis is amazingly awesome. Very intriguing and what a great idea in the first place. One of the most important pieces of modern software IMO.
- BLKNSLVR 21d agoImportant to note that the system(s) it infected were non-trivially air-gapped, so it had to do the entirety of it's infectious work without command and control servers or receiving any additional input. It had to be an entirely autonomous process from infection to propagation to execution. Pretty amazing to have been pulled off seemingly so successfully.
- stingraycharles 21d agoWasn’t it actually not as successful as it could have been? I recall something about it spreading to more machines than it should have, which caused it to be detected earlier than it should have.
- aussieguy1234 21d agoSomehow, I don't think the original authors of this proprietary code are going to be filing a copyright claim...
- deleted 21d ago[deleted]
- Terr_ 21d agoIt would be really amusing to see, though. Secrecy aside, there may be some other issues with copywriting a product (allegedly) made by a government.
- ceejayoz 21d agoA NSL seems more likely.
- mitxela 21d agoMaybe if this was the real virus, not an AI hallucination.
- Tangurena2 20d agoWell, it would be a very bad idea to use any pagers sent anonymously to the researcher.
- andai 21d agog_dwCentrifugeDestroyed++;
- beavis000 21d agoI very much recommend reading "Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon". Fascinating stuff.
- strictnein 21d agoI always enjoyed Kim Zetter's work. Well written and researched, and she doesn't put herself in the story, unlike some other authors. She highlights the practitioners who are actually the ones doing the work.
- beavis000 21d agoYou might also enjoy "Command and Control" by Eric Schlosser.
- nilsherzig 20d agoi really enjoyed that one
- deleted 21d ago[deleted]
- mzs 21d agoI always wondered about how feasible the usb drive propagation bit always noted was. Was there ever any evidence that the hardware was already infected at a less scrupulous reseller? I’ve heard of another site in EU that had misbehaving s7. It could have been a reseller that played loose with licensing.
- BLKNSLVR 21d agoGiven the 'pager attack' supply chain involvement, it can't be ruled out in any other state-sponsored hack / attack. See also: https://www.schneier.com/blog/archives/2015/03/cisco_shipping_.html https://www.schneier.com/blog/archives/2015/03/cisco_shippin...
- __alexander 20d agoIt was very feasible. The exploit to propagate via usb was CVE-2010-2568. Odds are you can still find details on it.
- tonyhart7 21d agowaiting for Pegasus source code
- CMDDestory 21d agoOf course! But it depends. Zero-click is essentially client‑side XSS.
- Retr0id 21d agoWhat?
- rep_lodsb 21d agoThis looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one does not include the literal string "Stuxnet" anywhere, like it does here: RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet"); Wikipedia about the origin of the name: The original name given by VirusBlokAda was "Rootkit.Tmphider;"[41] Symantec, however, called it "W32.Temphid", later changing it to "W32.Stuxnet".[42] Its current name is derived from a combination of keywords found in the software (".stub" and "mrxnet.sys").[43][44]
- nullbio 21d agoAstra can reverse engineer binaries now. That's likely where it came from.
- rep_lodsb 21d agoBut then did it hallucinate that registry key? Or this? "instance of ActiveScriptEventConsumer as $Consumer\n" "{\n" " Name = \"StuxnetConsumer\";\n" " ScriptingEngine = \"VBScript\";\n" " ScriptText = \"CreateObject(\\\"WScript.Shell\\\").Run \\\"%SystemRoot%\\\\system32\\\\winsta.exe\\\", 0, False\";\n" "};\n"
- CMDDestory 21d ago[flagged]
- Retr0id 21d agoWhat?
- deleted 21d ago[deleted]
- qarl 21d agoYeah... it's reverse engineered. They explained that.
- broodbucket 21d agoIf you're going to spend tokens on the RE for this, it would've been nice to spend some tokens documenting it or making it easier to navigate
- hacker11223 21d ago[flagged]
- hacker11223 21d ago[flagged]
- deleted 21d ago[deleted]
- wiml 21d agoWhat binary did you start from?
- CMDDestory 21d agoMRxNet and MRxCls.
- SiyuanFeng 21d ago[flagged]
- sneak 21d agoAIUI, the successors used a hash of certain system configurations or directory listings to serve as the decryption key for the malicious payload, so that if you found the binary but didn’t have a target system also, it was meaningless.
- outfitcolormatc 21d agoThanks for posting that
- etcetcetcetceta 20d ago[dead]