21–30 of 507 posts
IIRC, its sequel actually used certain directory listings (registry keys or filesystem) of a target system as input to a KDF that is used to generate an AES key that is used to decrypt the next stage payload. That is, if you don’t have the exact specific system configuration that is being targeted (program names, versions, et c) then the primary function of the worm remains entirely opaque.
Earlier quoted context omitted.
Try not to think about how many SREs in the big five are likely receiving a second secret paycheck from Langley and/or Fort Meade.
Interesting. This is the first time I've seen a public comment anywhere about a strong suspicion I've held for more than 20 years.
“Keep this quiet or go to the same jail in which Manning was tortured basically to death” is a pretty persuasive argument.
The fact that Google was asleep at the wheel so long wrt encryption of internal network WAN links (I mean, wikipedia has an article about the double-hull sub that the navy uses to tap intercontinental fibers) suggests to me that most Googlers (and despite organizational differences, also most Apple and FB and Amazon staff (outside of govcloud)) simply aren’t thinking about the illegal lengths to which the military will go to obtain huge amounts of information about possible threats to their safety, security, or persistence methods (e.g. whistleblowers).
It’s like the industrial rank and file never read the military-industrial complex speech, even while hearing their bosses take off from Moffet using taxpayer jet fuel. [1]
[1] https://www.wsj.com/articles/google-jet-fleet-loses-a-nasa-f...
I'm curious.
Don't get me wrong, but "sophisticated" doesn't exactly mean obscure and stealth which is what stuxnet worm is all about. With access to all those vulnerabilities, i would call the worm implementation straighforward & stealth rather than sophisticated. Most likely the engineers didn't have much choice than to proceed in one possible way to be able to make it work. If one of the vulnerabilities didn't then stux.net wouldn't exist.
> This driver was digitally signed by Realtek > that driver started signing it with secret keys from JMicron I think this is the scariest part of the worm. Not only do the people writing it have access to zero-days, they also somehow have (possibly physical) access to the private keys of two large corporations.
Try not to think about how many SREs in the big five are likely receiving a second secret paycheck from Langley and/or Fort Meade.
The respect comes with the single-mindedness of this code's approach. You would think the people doing this would have at least a little bit of The Joker in them - if they saw an opportunity to cause chaos for chaos' sake they tend to take it. Whoever did this - didn't. That is impressive focus.
It’s not really a secret anymore.
> This driver was digitally signed by Realtek > that driver started signing it with secret keys from JMicron I think this is the scariest part of the worm. Not only do the people writing it have access to zero-days, they also somehow have (possibly physical) access to the private keys of two large corporations.
Try not to think about how many SREs in the big five are likely receiving a second secret paycheck from Langley and/or Fort Meade.
Earlier quoted context omitted.
Try not to think about how many SREs in the big five are likely receiving a second secret paycheck from Langley and/or Fort Meade.
What is the legal situation with this? I mean, forget for a second that illegal things are done all the time, I presume it would be unconstitutional were the CIA or NSA found to be paying google engineers? How big of a scandal would this be, or is it kind of tacitly understood in the way that black-budgets for large projects are?
Or perhaps a video of a high ranking intelligence official lying to congress under oath, whilst answering questions received in advance, and then never being prosecuted for perjury to cover up such illegal activity.
So, not a big scandal at all. Page 2 news.