Download link for anyone who is curious enough: https://bazaar.abuse.ch/sample/9a10e1faa86a5d39417cae44da5ad... I'll probably build a Windows XP VM first.
Has anyone posted the windows service file yet? That looks just to be the loader.
Fast16: High-precision software sabotage 5 years before Stuxnet
51–60 of 107 posts
Re: Fast16: High-precision software sabotage 5 years before Stuxnet
#52My favorite part of this was: That kind of notation, called SCCS/RCS, is the equivalent of finding a rotary phone in a modern office. Nobody uses it in 2005 Windows kernel code unless their programming background goes back decades, to government and military computing environments — The astrophysics lab I worked at in 2006 was still using svn and had a bunch of Fortran with references to systems from the 70s and 80s.…
Ha, I worked for a company that until ~2012 still used RCS-backed SCM, absolute hack job on a shared file share that wrapped RCS with a "project file" to allow a tree of specific revisions for a "project". "MKS" it was called. And by the sound of it the "old" '90s version, not the java EE rewrite.
That meant the files has the entire "$Revision: 1.3 $" nonsense and "file changelog" at the top too - though many newer files never bothered to include the tags to actually get RCS to replace them. Inconsistent as hell.
And while the "family" of devices the software was for traces it's origin to the mid '90s, functionally none of the code was older than ~5 years at that time.
Naturally even with only a few tens of engineers it regularly messed up, commits stepped on each other's toes and the entire tree got corrupted regularly. For fun I wrote a script that read it all and imported the entire history into git - you only had to go back a few years before the entire thing was absolute nonsense.
I have no idea why that was still being used then, but I assume it had been in use from the very start of that entire hardware family. Perhaps as it was fundamentally a "hardware" company - which until surprisingly recently seemed to consider "source control" to be "shared folders on remote machines" - "software" source control wasn't considered a priority.
Re: Fast16: High-precision software sabotage 5 years before Stuxnet
#53[dead]
Re: Fast16: High-precision software sabotage 5 years before Stuxnet
#54Earlier quoted context omitted.
I think that in the time period we're talking about, RCS wasn't really even all that old. Like, RCS is old, sure, but it was also in common use especially by Unix systems people; it's what you might have reached for by default to version your dotfiles, for instance.
Yes, but even back then I was aware of the sections in executables (wasn’t this where it was found?) and any neckbeard from the 70s and 80s might be even more so aware. That said, yeah, sure, it’s a very possible and understandable oversight, but I’m weary because of all the text in viruses and such as indicators. Seems like a pass over ‘strings’ would be obvious. Though. TIL, strings doesn’t necessarily scan the ent…
The same binary has encrypted strings so I assume there was a pass, but if you look at the source control strings they seem to decrease the appearance of maliciousness, even today they are out of place for malware
Re: Fast16: High-precision software sabotage 5 years before Stuxnet
#55[flagged]
Re: Fast16: High-precision software sabotage 5 years before Stuxnet
#56sabotaging science must be the most morally corrupt thing you can do as a civilisation
I wonder how many results got nerfed via https://en.wikipedia.org/wiki/Pentium_FDIV_bug before it was known about.
What you should worry about is how many scientific "results" are still wrong due to random bugs in numerical code. If anyone's actually verifying the results, they'll catch things like the FDIV bug just as easily as a mistake in the calculations.
Re: Fast16: High-precision software sabotage 5 years before Stuxnet
#57My favorite part of this was: That kind of notation, called SCCS/RCS, is the equivalent of finding a rotary phone in a modern office. Nobody uses it in 2005 Windows kernel code unless their programming background goes back decades, to government and military computing environments — The astrophysics lab I worked at in 2006 was still using svn and had a bunch of Fortran with references to systems from the 70s and 80s.…
Yeah, I used to be skeptical of the government provenance of things like Stuxnet (I am not any more, I'm fully sold, like everyone else), and notes like this were why. People used RCS well into the 2000s! RCS as a tool had virtues over SVN and CVS.
> used to be skeptical of the government provenance
Do you mean skeptical on which government was responsible or that it was in fact a government effort?
I can see how attribution could be debatable (between two main suspects mainly), but are / were there any good arguments against this being a gov effort? I would find it highly unlikely that someone other than a gov could muster up so much domain knowledge, source pristine 0days and be so stealthy at the same time.
Re: Fast16: High-precision software sabotage 5 years before Stuxnet
#58Earlier quoted context omitted.
Yeah, I used to be skeptical of the government provenance of things like Stuxnet (I am not any more, I'm fully sold, like everyone else), and notes like this were why. People used RCS well into the 2000s! RCS as a tool had virtues over SVN and CVS.
My favorite part of the paper is that the “attack” isn’t just exploiting a bug — it’s exploiting how different components interpret the same input. Modifying an executable as it’s loaded into memory is one example, but the deeper pattern is the mismatch. What’s interesting about the malware in this post is that it goes one step further: instead of exploiting mismatches, it corrupts the computation itself — so every i…
Just curious, are you purposely mocking the LLM writing style?
Re: Fast16: High-precision software sabotage 5 years before Stuxnet
#59sabotaging science must be the most morally corrupt thing you can do as a civilisation
Developing weapons is pretty high on my list of shitty things to do as humanity.
We will probably keep doing it until we encounter an alien intelligence and snap out of it.
Re: Fast16: High-precision software sabotage 5 years before Stuxnet
#60[dead]