Out of curiosity, do we know that the state actors that built stuxnet didn't simply pay or force those taiwanese companies to turn over the keys?
The Stuxnet worm may be the most sophisticated software ever written
431–440 of 507 posts
Re: The Stuxnet worm may be the most sophisticated software ever written
#432Earlier quoted context omitted.
But do those things really contribute to the sophistication of the software? For example imagine some code written with no understanding of uranium enrichment: const int CENTRIFUGE_RPM = 500; And then some other code written with a deep understanding of uranium enrichment: const int CENTRIFUGE_RPM = 1203; Can you really say that the second bit of code is more "complex"? Same goes for stolen driver signing keys and so…
I, personally, would differentiate between complex and sophisticated. That is just one line of code, sure. But I can't imagine what it took to get that line of code there, and everything that comes with that. How many people were involved, PhD's, years of experience in a range of fields, and not just years of experience in any field but experience in fields like espionage. My uneducated brain would still put "most so…
yeah. in order to agree with that "most sophisticated software" claim i think he'd need to compare it to some other candidates for that title.
Re: The Stuxnet worm may be the most sophisticated software ever written
#433Earlier quoted context omitted.
Out of topic but your defense for referencing Kaspersky makes me wonder why people would see a problem with it? I'm not familiar with the field and don't know who's who.
They're a Russian company and semi-recently Trump banned their software from government agencies. People theorize they're controlled by the Russian government but I've never come across any evidence that they're anything other than a top tier security company though. They have done some fairly bold moves in the past though, like cleverly calling out other AV companies that were copying their detections [0] and kind o…
> They're a Russian company and semi-recently Trump banned their software from government agencies.
I know it's popular to bash Trump, but it was the DHS that banned the software, not Trump:
In a binding directive, acting homeland security secretary Elaine Duke ordered that federal civilian agencies identify Kaspersky Lab software on their networks. After 90 days, unless otherwise directed, they must remove the software, on the grounds that the company has connections to the Russian government and its software poses a security risk.
Which came after the GSA removed them from the list of approved vendors:
The directive comes months after the federal General Services Administration, the agency in charge of government purchasing, removed Kaspersky from its list of approved vendors. In doing so, the GSA suggested a vulnerability exists with Kaspersky that could give the Kremlin backdoor access to the systems the company protects.
https://www.washingtonpost.com/world/national-security/us-to...
Re: The Stuxnet worm may be the most sophisticated software ever written
#434Earlier quoted context omitted.
In my view, the sophistication is implied by the breadth of expertise required to put the whole thing together. Google Search and the OS landscape are for sure broad and sophisticated. However, their development was accomplished by computer scientists. In order for stuxnet to be effective, it was necessary to employ expertise in: - Uranium enrichment methods and processes - Capital equipment control systems and their…
But do those things really contribute to the sophistication of the software? For example imagine some code written with no understanding of uranium enrichment: const int CENTRIFUGE_RPM = 500; And then some other code written with a deep understanding of uranium enrichment: const int CENTRIFUGE_RPM = 1203; Can you really say that the second bit of code is more "complex"? Same goes for stolen driver signing keys and so…
Splitting hairs ... lets not reduce the thread to defining sophistication
Heres a question... what the most sophisticated part of struxnet
I vote java most sophisticated ... the vm runs everywhere ... the language incorporates almost every feature
Re: The Stuxnet worm may be the most sophisticated software ever written
#435I'd argue that Google Search is much more sophisticated than Stuxnet. Windows is much more sophisticated. Linux is more sophisticated than Stuxnet. The list goes on. We tend to ignore the sophistication of things we are familiar with, and hype those that surprise. But that's not a fair measure of anything.
That is an utterly braindead assertion. I wrote the quoted article about Stuxnet. And I've helped write multiple operating systems. Your argument not an argument. It's just a random assertion with no technical knowledge of either Stuxnet or how to write an operating system. Stuxnet specifically took advantage of Windows's lack of sophistication in order to replicate.
[deleted]
Re: The Stuxnet worm may be the most sophisticated software ever written
#436Earlier quoted context omitted.
That wouldn't work because HSMs are typically not delivered with keys, you generate the private key yourself.
Ok, makes sense. It could also be that the HSM was shipped from one office to another after keys had been loaded onto it. Dunno.
HSMs are designed to resist exporting private key material. And to sign something, you normally have to enter a PIN or a password. :)
Re: The Stuxnet worm may be the most sophisticated software ever written
#437If this short read piked your interest in Stuxnet, I can recommend the book "Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon". It explains in great detail how Stuxnet worked and, which I found the most exciting, how it was discovered and reverse engineered.
I read this book a while ago. Whilst I enjoyed the multiple viewpoints it provides (some claim that Stuxnet was actually quite sloppily written, depending on numerous factors), it happened to be one of those books which wrote 100 pages worth of information in 400 pages instead and dragged every little point on. YMMV.
The movie felt similar to me. It's been sitting on my In Progress list for years. I loved what I saw but it lost it's hooks in me.
Re: The Stuxnet worm may be the most sophisticated software ever written
#438I've been arguing about this for the last three days. Mostly around the reason that "complexity" is not strictly the same thing as "sophistication" when it comes to software. Noobs will conflate the two, but experienced programmers will agree that -- just to illustrate my point -- some code which solves a complex problem in a very clever way while also being very clean and easy to maintain will be considered strictly…
On complexity vs sophistication: During the cold war, a US company noticed the USSR had stolen the plans for a natural gas pipeline system, but not the software. In response, the US introduced an integer overflow bug that was uptime dependent, and took something like 6 months to hit. The bug simultaneously cranked up the pumps and closed all the valves in the network. It was known that the Soviet economy would crash…
How do you even define sophistication in context of computer software? Let me try by defining the opposite. What would be unsophisticated computer program? I would say it is brute force algorithm. It is unsophisticated because it uses simple logic and iterative approach to achieve aim in inefficient manner. So sophisticated program is:concise(non-iterative), efficient (doesnt use too many steps to arrive at destination) and uses non-simplistic modeling of given problem. Anyone has anything better :)?
Re: The Stuxnet worm may be the most sophisticated software ever written
#439Earlier quoted context omitted.
Well I don't think my dead self would mind being dead with it being dead and all. So I don't really see how any kind of suffering is better than death. In a way death doesn't really hurt you, since you stop living.
> So I don't really see how any kind of suffering is better than death. So maybe we should round up all the poor people and gas them to put them out of their misery?
You joke, but from a certain perspective and within certain parameters, there are people who would find this acceptable, and even preferred. I recall the movie Solace (which wasn't great, but I digress) where the premise is that a serial killer has psychic powers that allow him to see others' futures. When he detects a future that is particularly horrible (disease, injury, etc) with no hope of survival, he makes sure their last moments are wildly happy and kills them painlessly with no warning.
If we were to regard the life of the average poverty stricken human as being _terrible_, then killing them painlessly and suddenly becomes less abhorrent. Of course, then we need to define criteria for whose lives are of sufficiently bad quality where sudden death is a superior option.
Some nihilists might say all humans satisfy that criteria. Even if you're a wealthy and generally happy person, you will become old and die. If you were suddenly dead at this second with no warning, you would not care - the only downside would be those who remained alive, who presumably would care. Let's recurse until no one cares.
And the universe moves along just the same.
I am not advocating for this at all, but I felt your comment justified some sort of explanation. And I have been thinking about these existential questions quite a bit recently.
Re: The Stuxnet worm may be the most sophisticated software ever written
#440Whether he is right or wrong, that was a fantastic writeup.