Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stuxnet Source Code

github.com

Post reply on HN
Print view View original

31–40 of 127 posts

Re: Stuxnet Source Code

#31

Post by kafrofrite »

cies wrote: post #21

In Iran the copyrights of foreign works are not well protected. This lead to a lot of copying: western software and books are/were available for little more than the price of the writable CD-ROM or paper+ink you got it on. Translations of works were slightly more expensive, that the translator did have to get paid. Since Windows (etc.) was free, and the university thought curriculum based largely on US uni-books, Win…

I'm not a fan of Windows but Stuxnet didn't happen because of Windows. Iran decided to spin up a nuclear program and Israel and the US had concerns and wanted to stop it. They had the resources to develop something tailored for this unique situation, which included windows, Siemens PLCs (IIRC), Centrifuges etc. and developed the malware based on their target. Even if their target used a different stack, they'd find a way to achieve the same result.

Re: Stuxnet Source Code

#32

Post by rozenmd »

I remember having to write a presentation about Stuxnet while at Uni, it was insane.

At the time they reckoned the authors had a functioning QA environment to ensure it actually worked (broke) the Siemens PLCs they were targeting.

Re: Stuxnet Source Code

#33

Post by phendrenad2 »

What always impressed me about Stuxnet wasn't the technical complexity, but the amount of spycraft that must have gone into identifying exactly what to program it to do, and what they could get away with.

Re: Stuxnet Source Code

#34

Post by wslh »

cies wrote: post #21

In Iran the copyrights of foreign works are not well protected. This lead to a lot of copying: western software and books are/were available for little more than the price of the writable CD-ROM or paper+ink you got it on. Translations of works were slightly more expensive, that the translator did have to get paid. Since Windows (etc.) was free, and the university thought curriculum based largely on US uni-books, Win…

Beyond Windows security issues, if you (an organization mainly) are enough motivated you can attack other OSes as well. There is anwjole industry about exploiting bugs for more secure platforms.

Re: Stuxnet Source Code

#35

Post by dfox »

speps wrote: post #5
Jimmc414 wrote: post #2

Technically, Stuxnet was and is an absolute masterpiece. Infiltration (dropper/1. Main.c): Stuxnet infiltrated systems by exploiting vulnerabilities in Windows. It often spread through infected USB drives. When a user plugged the USB into a computer, Stuxnet would use these vulnerabilities to install itself. In the dropper/1. Main.c file, the DllMain function is where this initial infiltration mechanism is initiated.…

Looks like most of this reply is ChatGPT generated... "but the specific code targeting PLCs might be in other parts of the codebase that aren't as clearly identified" is something I've seen it generate when I asked details about a codebase as well, but it didn't have all the details.

Also, it is mostly wrong. The whole /dropper part is the initial loader, which has nothing to do with either hiding the presence or the actual PLC payload. Effectively it is an somewhat obfuscated stub for obfuscated self-extracting archive that is an dll and not executable.

Re: Stuxnet Source Code

#36

Post by bschne »

rozenmd wrote: post #32

I remember having to write a presentation about Stuxnet while at Uni, it was insane. At the time they reckoned the authors had a functioning QA environment to ensure it actually worked (broke) the Siemens PLCs they were targeting.

Nitpick but it was even harder, they wanted to keep the PLCs intact, report back normal operation, and change the control output specifically to destroy/damage uranium centrifuges

Re: Stuxnet Source Code

#38

Post by bazmattaz »

jonplackett wrote: post #28

Can anyone explain why Stuxnet was admitted to and publicised so much. Aren’t secret operations usually kept… secret? What was the motivation for the PR drive?

It was never admitted to though;

https://en.wikipedia.org/wiki/Stuxnet

It was publicised so much because it was the most advanced cyber weapon of its kind to ever been released.

Re: Stuxnet Source Code

#39

Post by Sprint9935 »

jonplackett wrote: post #28

Can anyone explain why Stuxnet was admitted to and publicised so much. Aren’t secret operations usually kept… secret? What was the motivation for the PR drive?

It was said that it would not have been discovered had it not been modified half way through its life to spread faster. This led to it spreading beyond the Natanz facility that it targeted.

Re: Stuxnet Source Code

#40

Post by Alifatisk »

Have anyone seen the documentary about stuxnet (Zero Days, 2016)? It's incredible.

On the documentary, they mention another virus which was supposed to be even worse than Stuxnet, the project name was Nitro Zeus.

Post reply on HN