Live data from Hacker News

The Stuxnet worm may be the most sophisticated software ever written

quora.com

391–400 of 507 posts

Re: The Stuxnet worm may be the most sophisticated software ever written

#391
post #296

Earlier quoted context omitted.

They are a family, as in, all of them were almost certainly created by the same group. Symantec said that Duqu is "near identical" to Stuxnet. As for Flame, Kaspersky[0] initially said that it contains no resemblance to Stuxnet, and then later on discovered that they've even shared a zero day in their early versions. From my understanding, I don't necessarily consider them as different software, more as a single soft…

Out of topic but your defense for referencing Kaspersky makes me wonder why people would see a problem with it? I'm not familiar with the field and don't know who's who.

They're a Russian company and semi-recently Trump banned their software from government agencies.

People theorize they're controlled by the Russian government but I've never come across any evidence that they're anything other than a top tier security company though.

They have done some fairly bold moves in the past though, like cleverly calling out other AV companies that were copying their detections [0] and kind of embarrassing the NSA [1] when a NSA employee took their malware/cyber weapons home to their PC running Kaspersky AV, which detected the malware and sent it back to Kaspersky server for analysis.

[0]https://www.theregister.co.uk/2010/02/10/kaspersky_malware_d...

[1] https://www.bleepingcomputer.com/news/security/nsa-employee-...

Re: The Stuxnet worm may be the most sophisticated software ever written

#392

Earlier quoted context omitted.

Just a guess, but: Gas stations use pumps that run on electricity.

They are still pumps: a physical system. Give me a couple hours and I can get gasoline out of any gas station without needing electricity. Of course I will destroy large parts of the machine in the process. I'll get my gas, and so will anyone else while that turns the crank. The pump will need to be replaced to use normally afterwards. The bigger worry is gasoline in tanks is good for at most a month. The refinery is…

Maybe you would, would people everywhere? Also, the tanks are underground, encased in concrete, with a submersible pump, and there are no power tools.

Might be possible to get to them. But that's solving one problem. If we're talking continent scale blackout it's also unclear what that gets you.

Typical backup power is measured in hours or days. Black start time scale for a blackout that scale is potentially significantly longer than that.

Long before petrol in refineries runs out our logistics system that distributes food to people has failed. The water system probably has failed. Now if you're in the countryside with a full pantry and a stream next to you that might not matter too much. You'll sit this one out. But if you're in the middle of New York?

Re: The Stuxnet worm may be the most sophisticated software ever written

#393
post #239
post #238

IMHO monitoring/controlling a high-speed centrifuge with Windows (or with any non-real-time-OS for that mattters) is actually a huge design flaw, there is even a warning somewhere in MS documentation about Windows not being suited to Real Time operation, and RTOS are specifically used/needed for closed-loop applications (such as monitoring and controlling motors). References (National Instruments): http://www.ni.com/…

The actual monitoring is done by the embedded controller, Windows is just there for displaying fancy panels and programming the devices.

Ok, still seemingly the trick Stuxnet used was looping a good copy of those fancy panels and (still through windows) changing (slightly) the operating parameters of the machine, so in this case Windows (directly or indirectly) was capable of monitoring the device and change its operating status.

Re: The Stuxnet worm may be the most sophisticated software ever written

#394
post #126
post #109

Earlier quoted context omitted.

Actually, in a capitalist country it might be easier to survive such an attack. If there is demand for a product or service, people and businesses will find a way to meet that demand. Millions of people working independently to satisfy their local market demand. It would probably hurt centralized socialist or communist countries more since it severs their control, surveillance, and communication mechanisms.

I agree that markets tend to buffer the effects significantly. The problem is in times of crisis, the appreciation of market dynamics and rule of law tend to wane. Even if those things are intact, the flow of goods and services can be undermined by well-intentioned but misguided politicians. My point was simple. Despite the systems of trade, a catastrophic shock in trade or production systems could literally kill mil…

I’m intrigued - how does that play out in your head? There’s a disaster causing social collapse but a free market for food remains. Demand outstrips supply so it becomes too expensive for many to buy. What do people do before they can go back to the land and sow their own food? What about areas with a lack of suitable available land (as referenced in a sister post by the potato famine)?

Re: The Stuxnet worm may be the most sophisticated software ever written

#396
post #332

"most sophisticated software ever written" is a bit of a hyperbole. "most sophisticated computer worm ever discovered" seems more accurate.

Its amazing to see people go crazy about this worm -- I mean how can someone think that that's the "most" sophisticated software. Come on, people.

It's very cool in a hacker-movie kind of way, and carries a certain mystique because of the fact that nobody's ever claimed responsibility for it. I think those facts amplify its media presence.

Re: The Stuxnet worm may be the most sophisticated software ever written

#397

Earlier quoted context omitted.

It's probably not a single project, but the insights of many projects for years, finally merged on one that took a long time as well.

For the 0days, probably. But even the integration is impressive.

I think devising this plan altogether was a huge investment in time and patience. Consider the social engineering feats needed to get your hands on the driver signature cerificates, for example. And that's just one step in the entire sequence of lateral movement.

Re: The Stuxnet worm may be the most sophisticated software ever written

#398

Earlier quoted context omitted.

For all the evidence we have, MAD has worked. Still here. Still no WWIII. At the beginning of the twentieth century it was looking like we'd have another world war every twenty years or so for the rest of time. As best we can tell, nukes actually did end large-scale war. I would call that at least a partially mitigated disaster.

While my humble opinion is that MAD was effective, let's be careful not to infer causation from a sequence of events (the rooster crows and then the sun rises). And the events of 'MAD' and 'peace' are not in sequence: WWII ended in 1945. MAD wasn't an idea until the 1960s and not implemented in a treaty until the 1972 Anti-Ballistic Missile (ABM) Treaty, AFAICT.[0] It makes more sense if you remember that nuclear wea…

Your timeline is wrong. Bernard Brodie came up with Nuclear deterrence in 1946. The Soviets would have read his work or understood the implicatikns. There was a reason they raced to get the bomb.

Re: The Stuxnet worm may be the most sophisticated software ever written

#399
post #364

Earlier quoted context omitted.

The key part is that you have to bring all of those all together. In hindsight it might be straightforward but if you had a blank slate, how would you approach the problem of "stop Iran from refining Uranium"?

To me the most surprising result would be if it cost fewer than bombing the nuclear facility. At 100k$ each bomb, Stuxnet looks affordable, plus all the expertise and other attack vectors you get from piecing it togethet.

$100K for a bomb? I have no idea what bombs really cost, but if we go with that number, they could have dropped a lot of bombs for that price. One junior engineer working for a year costs that much. We know that expertise in a lot of fields existed, that implies a number of engineers.

I'm going to guess a bomb is cheaper. Of course a bomb has a lot of other disadvantages which is why it wasn't used.

Re: The Stuxnet worm may be the most sophisticated software ever written

#400

Considering that we have known about Stuxnet for nearly a decade, why are we still using OS technology that makes such changes/intrusions/phoning-home so easy to conceal?

Because people keep requiring an interface to the machine...
Post reply on HN