251–260 of 507 posts
The scary thing about this is: Stuxnet is one of the "most sophisticated" pieces of malware we have discovered up until now . Who knows what kinds of software are still out there quietly doing their thing in the shadows.
"The best ninjas are the ones you've never seen"
I've been arguing about this for the last three days. Mostly around the reason that "complexity" is not strictly the same thing as "sophistication" when it comes to software. Noobs will conflate the two, but experienced programmers will agree that -- just to illustrate my point -- some code which solves a complex problem in a very clever way while also being very clean and easy to maintain will be considered strictly…
On complexity vs sophistication: During the cold war, a US company noticed the USSR had stolen the plans for a natural gas pipeline system, but not the software. In response, the US introduced an integer overflow bug that was uptime dependent, and took something like 6 months to hit. The bug simultaneously cranked up the pumps and closed all the valves in the network. It was known that the Soviet economy would crash…
> This driver was digitally signed by Realtek, which means that the authors of the worm were somehow able to break into the most secure location in a huge Taiwanese company, and steal the most secret key that this company owns, without Realtek finding out about it. > Later, whoever wrote that driver started signing it with secret keys from JMicron, another big Taiwanese company. Yet again, the authors had to figure o…
That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet th…
Sure now they often are - after many security failures 10 years ago before HSMs were widely deployed. A decade ago a much more common ‘secure’ mechanism was to store the keys on an airgapped machine that had never been connected to a network and use sneakernet to get binaries signed.
Earlier quoted context omitted.
The problem is not everyone on the world stage is a rational game theory nerd that links to papers like we want them to be. Also 60 years of treating every other country as a box in a threat model to be manipulated against other boxes has been a completely unmitigated disaster, so maybe we should stop that.
For all the evidence we have, MAD has worked. Still here. Still no WWIII. At the beginning of the twentieth century it was looking like we'd have another world war every twenty years or so for the rest of time. As best we can tell, nukes actually did end large-scale war. I would call that at least a partially mitigated disaster.
The scary thing about this is: Stuxnet is one of the "most sophisticated" pieces of malware we have discovered up until now . Who knows what kinds of software are still out there quietly doing their thing in the shadows.
Not scared of what “we” are doing to “them”, but rather what “they” are doing to “us”... our power plants, dams, electrical grids, gas pipelines, traffic light networks, air traffic control systems.........
I'd argue that Google Search is much more sophisticated than Stuxnet. Windows is much more sophisticated. Linux is more sophisticated than Stuxnet. The list goes on. We tend to ignore the sophistication of things we are familiar with, and hype those that surprise. But that's not a fair measure of anything.
I agree. It's the most sophisticated piece of malware , that's for sure (at least counting the ones we know of). But calling it the most sophisticated piece of software is too big of a stretch. That said, other answers to this question include what we would traditionally consider as contestants (like Linux kernel), it just happens that the submitter decided to submit this specific answer. I don't know was this the to…
Isn't Stuxnet a part of a family of similar nation state malware that would also include Flame and Duqu?
Earlier quoted context omitted.
Indeed. I think that the mark of sophistication is not complexity but irreducible complexity. Sophisticated solutions are those that have been reduced to their simplest form.
I'm wondering why do you think this is true? Using stuxnet as an example, would it not be better if they used every feature within reason that would add to the likelihood of success? Why does reductive elegance make an application of technology superior to an inelegant solution? Does final effectiveness not overrule the developer's aesthetics? I'm asking in honesty, not using the question to merely attack your opinio…
It is easier and more likely to succeed. Also, stuxnet has now been repurposed by multiple governments and criminal organizations. So, it’s creators built a symmetric capability, and gave it to their adversaries, when they could have used asymmetric capabilities that are more expensive to reproduce.
[edit: Also, it is still well within the Iranians’ capabilities to build a bomb, and our recent foreign policy greatly increases the chances that hard liners will take over and restart the program.
Contrast this to the outcome of the broader cold world strategy, which was a regime change to a relatively US-friendly government.]
Isn't this hyperbole? I'd grant that Stuxnet is probably the most sophisticated malware ever written, but calling it the most sophisticated software is a big stretch.
Stuxnet seems to be the product of a competent, professional, and well-funded software engineering organization that writes malware and understands the domain of computer espionage. That was unprecedented in the malware space, but it's not if you include other domains.
I'd argue that Google Search is much more sophisticated than Stuxnet. Windows is much more sophisticated. Linux is more sophisticated than Stuxnet. The list goes on. We tend to ignore the sophistication of things we are familiar with, and hype those that surprise. But that's not a fair measure of anything.
Earlier quoted context omitted.
You know what's worse than the instant obliteration of millions of people? The slow obliteration and starving of millions of people. Imagine Venezuela, but much much worse. Picture a society that doesn't know how to create institutions, conduct trade and collaborate with the people around them without the aid of a computers. Now, I don't know if disabling their computers would result in an incredibly dysfunctional so…
Who stands to benefit by destabilizing the western world to such a degree? Clearly some big players like Russia and China, as well as some smaller players can benefit from destabilizing the western world a little bit. But if they destroy it to the point where millions of people are suffering, they'll bring suffering on themselves as well. It seems to me that they're probably motivated to level the playing field and g…