Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Stuxnet worm may be the most sophisticated software ever written

quora.com

Post reply on HN
Print view View original

181–190 of 507 posts

Re: The Stuxnet worm may be the most sophisticated software ever written

#181

Post by Aissen »

Aissen wrote: post #172
saagarjha wrote: post #17

> This driver was digitally signed by Realtek > that driver started signing it with secret keys from JMicron I think this is the scariest part of the worm. Not only do the people writing it have access to zero-days, they also somehow have (possibly physical) access to the private keys of two large corporations.

Nah, this is almost easy. In comparison, Flame used a previously-unknown (and still unknown AFAIK) method to compute MD5 collisions on a certificate, which was used for a signature. https://arstechnica.com/information-technology/2012/06/flame... This isn't stealing a cert or burning four zero-days. This is dropping a zero-day cryptographical attack, which hasn't been reverse engineered yet.

Also: we only know about this because one of the world's best hash-collision experts, Marc Stevens, wrote a tool to detect the method of collision used when we have two different cleartext with the same hash.

He's also one of the minds behind shattered.io ; which happened because Google decided to invest some resources on his research (estimated at around ~300k). Imagine if he "simply" took a job working for an intelligence agency ?

Re: The Stuxnet worm may be the most sophisticated software ever written

#182

Post by petemc_ »

mFixman wrote: post #127
um_ya wrote: post #109

Earlier quoted context omitted.

Actually, in a capitalist country it might be easier to survive such an attack. If there is demand for a product or service, people and businesses will find a way to meet that demand. Millions of people working independently to satisfy their local market demand. It would probably hurt centralized socialist or communist countries more since it severs their control, surveillance, and communication mechanisms.

So what happened during the Irish Potato Famine?

The British.

Re: The Stuxnet worm may be the most sophisticated software ever written

#183

Post by piaste »

LeonM wrote: post #134
cptskippy wrote: post #116

> This driver was digitally signed by Realtek, which means that the authors of the worm were somehow able to break into the most secure location in a huge Taiwanese company, and steal the most secret key that this company owns, without Realtek finding out about it. > Later, whoever wrote that driver started signing it with secret keys from JMicron, another big Taiwanese company. Yet again, the authors had to figure o…

That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet th…

> The fact that they pulled it of to break into not one, but two of those secrets is extremely impressive on it's own.

Did they break into them? Stuxnet had government backing, most articles I've read assume American or Israeli.

If it was the American government (on its own or on Israel's behalf), then it might have 'simply' applied its considerable influence to get the Taiwanese government to get Realtek and JMicron to hand over the HSMs.

Re: The Stuxnet worm may be the most sophisticated software ever written

#185

Post by erkkie »

titzer wrote: post #174
amaccuish wrote: post #156

Earlier quoted context omitted.

That wouldn't work because HSMs are typically not delivered with keys, you generate the private key yourself.

Ok, makes sense. It could also be that the HSM was shipped from one office to another after keys had been loaded onto it. Dunno.

In "secure" places, HSM's are basically in a vault with armed guards.

Re: The Stuxnet worm may be the most sophisticated software ever written

#186

Post by lossolo »

4llan wrote: post #108

"Zero Days" documentary is focused on Stuxnet. https://www.imdb.com/title/tt5446858/

I highly recommend this documentary, it explains step by step how stuxnet was found, how it was debugged (by people that debugged it) and how it was used.

Re: The Stuxnet worm may be the most sophisticated software ever written

#187

Post by 34k5uoi5ui »

LeonM wrote: post #134
cptskippy wrote: post #116

> This driver was digitally signed by Realtek, which means that the authors of the worm were somehow able to break into the most secure location in a huge Taiwanese company, and steal the most secret key that this company owns, without Realtek finding out about it. > Later, whoever wrote that driver started signing it with secret keys from JMicron, another big Taiwanese company. Yet again, the authors had to figure o…

That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet th…

Sorry, this _IS_ how it works. These are usually stored on developers workstations with a weak password protected PKCS12 file (.pfx/.p12)

HSMs. Lol.

Re: The Stuxnet worm may be the most sophisticated software ever written

#188

Post by igravious »

1: What is sophisticated for a non-state actor may be semi-trivial for a state actor. Why? State actors demand access to the source code of proprietary software; state actors circumvent laws that bind mere mortals like ourselves. If you own the playing field that which is sophisticated for even the most competent and knowledgeable coders may be semi-trivial for the spooks.

2: In my opinion Stuxnet is an act of war. If Iran doesn't consider itself to be at war with Israel and the US (even though there has been no formal declaration of war) then they are not thinking straight.

If I were to enrich uranium I wouldn't let a Windows PC within a mile of the centrifuges, I'd only use locked down versions of Linux.

Re: The Stuxnet worm may be the most sophisticated software ever written

#190

Post by VectorLock »

LeonM wrote: post #134
cptskippy wrote: post #116

> This driver was digitally signed by Realtek, which means that the authors of the worm were somehow able to break into the most secure location in a huge Taiwanese company, and steal the most secret key that this company owns, without Realtek finding out about it. > Later, whoever wrote that driver started signing it with secret keys from JMicron, another big Taiwanese company. Yet again, the authors had to figure o…

That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet th…

>You need the private key to sign the drivers. This is not a file that developers of those companies have access too.

The developers would need access to the private key to sign the drivers they're deploying. Convenience is the ultimate foil of most good security intentions.

Post reply on HN