Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Stuxnet worm may be the most sophisticated software ever written

quora.com

Post reply on HN
Print view View original

231–240 of 507 posts

Re: The Stuxnet worm may be the most sophisticated software ever written

#231

Post by forapurpose »

erkkie wrote: post #192
Cthulhu_ wrote: post #179

Earlier quoted context omitted.

The world also became a lot more connected, so we're exposed a lot more to wars and such abroad, and we've matured morally speaking and can see that all wars are unnecessary.

Only in a western welfare bubble. Morality over war is what you can afford having other security needs taken care of.

> Only in a western welfare bubble. Morality over war is what you can afford having other security needs taken care of.

That's actually a false hypothesis of people in the 'western bubble' who haven't experienced war. Research I've seen shows that people in places that have experienced it, such as in Syria, are much more opposed to it.

And that bears out in Western experiences: Who created the UN, with the stated purpose to prevent another war? Who created (the ancestor institutions that became) the EU to prevent another European war? Who enforced the Geneva conventions and prosecuted war criminals after WWII?

The answer is, the people who had lived WWI and WWII. They knew far more of war than anyone today in the West, and they thought it was the worst scourge of humanity which must be prevented from happening again at almost any cost. Who are we to disagree?

Re: The Stuxnet worm may be the most sophisticated software ever written

#232

Post by hedora »

fapjacks wrote: post #8

I've been arguing about this for the last three days. Mostly around the reason that "complexity" is not strictly the same thing as "sophistication" when it comes to software. Noobs will conflate the two, but experienced programmers will agree that -- just to illustrate my point -- some code which solves a complex problem in a very clever way while also being very clean and easy to maintain will be considered strictly…

On complexity vs sophistication: During the cold war, a US company noticed the USSR had stolen the plans for a natural gas pipeline system, but not the software.

In response, the US introduced an integer overflow bug that was uptime dependent, and took something like 6 months to hit. The bug simultaneously cranked up the pumps and closed all the valves in the network.

It was known that the Soviet economy would crash in under a year without the ability to cheaply move natural gas, so they couldn’t test long enough to find this.

A year or so later, the DoD’s seismographs detected the largest non-nuclear explosion in human history.

The main impact wasn’t the explosion or the short-term economic damage. The main impact was that the USSR stopped trusting stolen software, which set them way further back, economically and militarily.

Arguably, that ~one line of code was infinitely more sophisticated than stuxnet.

Re: The Stuxnet worm may be the most sophisticated software ever written

#233

Post by packet_nerd »

Clubber wrote: post #69
fapjacks wrote: post #8

I've been arguing about this for the last three days. Mostly around the reason that "complexity" is not strictly the same thing as "sophistication" when it comes to software. Noobs will conflate the two, but experienced programmers will agree that -- just to illustrate my point -- some code which solves a complex problem in a very clever way while also being very clean and easy to maintain will be considered strictly…

Yes, in my experience, solving a problem / feature well involves three steps: 1. Get the code to work 2. Clean up the code 3. Simplify the code 1 is self explanatory. 2 involves removing any logical redundancy, separating and cleaning the logic into methods, etc. 3 involves simplifying logic and logical mechanisms. Most developers only do step 1 and maybe step 2. Step 3 is where beauty comes in. If I could organize m…

“Any fool can make something complicated. It takes a genius to make it simple.”

I made a poster with this for my office wall.

Re: The Stuxnet worm may be the most sophisticated software ever written

#234

Post by exikyut »

acutesoftware wrote: post #162
vinayms wrote: post #107

I am just your average software dev with zero knowledge of malware creation, speculating here, and might come across as a fool. The author sensationalizes the effort of the creators, painting a Holywoodesque scenario where they break into every possible software company to steal keys to misrepresent the software, going undetected by every possible security company etc. Since this is a Quora post, I can live with him…

They certainly wouldn't be calling lots and lots of API's, as that would likely trigger some antivirus software or at least leave traces in system logs. The sophistication of this software is that it did all this undetected.

"x86 is a high-level language": https://blog.erratasec.com/2015/03/x86-is-high-level-languag... / https://news.ycombinator.com/item?id=9264195

Everything's an API at the end of the day.

There was an article on here recently about the practical effects of the TLS 1.3 drafts, and how they broke proxies. I can't find it. It was talking about how the proxies choked because so many variable wire bits in TLS 1.2 stayed static for so long they rusted in place in proprietary implementations, and the proxies crashed once the values changed (despite this being a concrete protocol violation). This situation reminds me of that.

Re: The Stuxnet worm may be the most sophisticated software ever written

#236

Post by perlgeek »

I'd argue that Google Search is much more sophisticated than Stuxnet. Windows is much more sophisticated. Linux is more sophisticated than Stuxnet. The list goes on.

We tend to ignore the sophistication of things we are familiar with, and hype those that surprise. But that's not a fair measure of anything.

Re: The Stuxnet worm may be the most sophisticated software ever written

#237

Post by INTPenis »

How do you define sophisticated? Complex or elegant? Because if it's more towards the latter then I'd suggest the software that took humans to the moon and back, several times, is much more sophisticated.

But from reading the article it seems the author is aiming more for complex than elegant.

Re: The Stuxnet worm may be the most sophisticated software ever written

#238

Post by jaclaz »

IMHO monitoring/controlling a high-speed centrifuge with Windows (or with any non-real-time-OS for that mattters) is actually a huge design flaw, there is even a warning somewhere in MS documentation about Windows not being suited to Real Time operation, and RTOS are specifically used/needed for closed-loop applications (such as monitoring and controlling motors).

References (National Instruments):

http://www.ni.com/white-paper/3938/en/

http://www.ni.com/white-paper/14238/en/

Re: The Stuxnet worm may be the most sophisticated software ever written

#239

Post by lima »

jaclaz wrote: post #238

IMHO monitoring/controlling a high-speed centrifuge with Windows (or with any non-real-time-OS for that mattters) is actually a huge design flaw, there is even a warning somewhere in MS documentation about Windows not being suited to Real Time operation, and RTOS are specifically used/needed for closed-loop applications (such as monitoring and controlling motors). References (National Instruments): http://www.ni.com/…

The actual monitoring is done by the embedded controller, Windows is just there for displaying fancy panels and programming the devices.

Re: The Stuxnet worm may be the most sophisticated software ever written

#240

Post by otakucode »

ufmace wrote: post #145

IMO, the sophistication of the final worm that made it out to security researchers doesn't have anything on the process that must have been used to develop it. Take the normal iterative development process, except that: You don't know anything at all about the design of your targeted system and networks. Even getting a little information about it requires writing sophisticated malware, using various spy capers to get…

The IAEA was all over Iran's nuclear production facilities for a decade. The CIA has been all over them as well. There really wasn't nearly as much impenetrable mystery as you imagine. For a very long time, Iran was completely cooperative with the IAEA to an absurd degree. Even the big CIA report said they were building power plants, not bombs, and they saw no evidence any bomb project existed. (Of course they hedged that for political reasons by sticking a 'absence of evidence isn't evidence of absence and they might have a super duper extra secret lab 500 miles underground' on the end which was reported in the media as 'secret Iran nuke project confirmed') It wasn't until that point that Iran realized the US really didn't care whether they were building a bomb or not, and it didn't matter how much they cooperated, they were going to be targetted regardless. Hell, at one point they offered to give up their entire nuclear program and all their facilities to the IAEA if the IAEA would run a power plant for them, and the west even turned that down.
Post reply on HN