Live data from Hacker News

Fast16: High-precision software sabotage 5 years before Stuxnet

sentinelone.com

81–90 of 107 posts

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#82
post #62

Earlier quoted context omitted.

That’s how everybody in academia, tech, and published authors in general used to write. Where do you think the LLM is getting it from? ^_^

the full on em dash requires a different character than - or -- it was generated that way, or else this person happens to know the correct combination of buttons to make that happen. in 2026, at least 20-40% of social media traffic is bots (and probably higher with better LLMs), so it is usually safer to just assume.

On a Mac, at least, the "correct combination of buttons" is trivial and easy to remember, even for someone like me who rarely uses em-dash. (But, I want to start using it more because I'm sick to death of people treating it as a scarlet letter.)

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#83
post #7

My favorite part of this was: That kind of notation, called SCCS/RCS, is the equivalent of finding a rotary phone in a modern office. Nobody uses it in 2005 Windows kernel code unless their programming background goes back decades, to government and military computing environments — The astrophysics lab I worked at in 2006 was still using svn and had a bunch of Fortran with references to systems from the 70s and 80s.…

Does that mean that three-letter agencies were/are able to recruit from the fields for each type of malware? For example, fast16 might actually be written by someone who used to write scientific calculation software, while Stunex was written by someone who used to work for Siemens?

I doubt you will find an answer here, but a few bits of anecdata:

1. CIA had recruiting events that invited STEM majors at my university, I suspect they do this very broadly.

2. Our funding came partially from the Air Force and part of the rules was our data and source had to be open. We know from conversations and other details from integrating with Air Force partners that they had models like ours that were an order of magnitude more accurate because they amalgamated models from all academics in our field and had their own career scientists on staff (often coming up through military ranks)

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#84
post #77

Earlier quoted context omitted.

Not just Iranians, something odd it's happening with the JPL people. Shitty and brainwashed people in Middle East comes in both ways. Can't wait to the Chinese secularizing all the Abrahamic bullshit by brute force -not by war, but my mere productivity and good reasoning- throwning all the Abrahamic legacy to the dust bin. So, y'all think you are the center of the world, Mediterranean fools? The Chinese got everythin…

These middle eastern "civilizations" which torture and mutilate their own children... it's hard to see such barbarity winning out in the very long run against intelligence and human rights.

violence is the undisputed rule of life. rationalize the power of intelligence to whatever degree you may .... the bigger guy is still gonna wipe the floor with the smaller one. and if an entire homogenous block of the world agrees on a core set of violent tenets, they are bestowed a greater capacity to violence.

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#85
post #20

This is an amazing find. I'm very curious regarding the specific targets of these rules, and in the exact changes to the results. Wonder if they will only make a difference in simulated conditions super specific to nuclear reactors?

I dug into how software such as LS-DYNA could have been modified. Take for example the EOS_JWL equation at [1] (vendor website, public manual) which is implemented by LS-DYNA. This equation seemingly could be used, alongside other equations implemented within LS-DYNA, to answer questions such as how long it'd take for a detonator in a missile warhead to detonate a primary explosive substance to cause a particular pressure wave at 20m distance. Working backwards from this result may provide a required fuze timing. Equations and parameters used with LS-DYNA are derived from scientific research, such as [2], which is US government research from the 1980's providing experimental results for high explosive substances. One such example from [2] is experimentation to determine the friction an explosive substance has against different materials which may enclose it. Given the software has equations purposely designed for explosives modelling, it'd be fairly easy to just target those equations in ways which will just slightly frustrate a scientist/engineer into thinking they've got a problem with the manufacturing quality of steel, rather than suspect the software is deliberately adding +/-20% noise to a friction coefficient.

The modern equivalent may be something like {insert adversarial country name here} downloading a pirated version of Ansys Autodyn 2026 R1 shortly after official release from a Chinese cracking group on a Chinese bulletin board forum, where just a handful of seeders sit behind Russian ISPs. And then {insert adversarial country name here} later notice during experimentation that the software calculations never quite match experimental results, and maybe then suspecting the pirated copy was deliberately tampered with and distributed. However, this situation may be fairly easily solved by {insert adversarial country name here} by just grabbing a copy of the software they want off a hacked network of a random university or engineering consulting firm in the aerospace and defence sector. Plus it may be naive to assume {insert adversarial country name here} in 2026 couldn't develop their own software from scratch (and/or perform calculations manually), or just rely on experiments, to achieve whatever outcome some other nation state group of hackers is trying to avoid. {insert adversarial country name here} would have to have experimentation equipment and skills regardless to verify manufacturing quality. Simulation software mostly reduces costs and timeframes by reducing the number of mockups and physical experiments needed. For example, it's cheap to run 1000 simulations of an artillery shell hitting vehicle armor plates as shown in [3], and more expensive and time consuming to do the same repetitive thing in the real world.

[1] https://ftp.lstc.com/anonymous/outgoing/jday/manuals/LS-DYNA...

[2] https://www.osti.gov/servlets/purl/6530310

[3] https://www.youtube.com/watch?v=_dv2PecKUBM

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#86

Earlier quoted context omitted.

the full on em dash requires a different character than - or -- it was generated that way, or else this person happens to know the correct combination of buttons to make that happen. in 2026, at least 20-40% of social media traffic is bots (and probably higher with better LLMs), so it is usually safer to just assume.

On a Mac, at least, the "correct combination of buttons" is trivial and easy to remember, even for someone like me who rarely uses em-dash. (But, I want to start using it more because I'm sick to death of people treating it as a scarlet letter.)

Option-shift-hyphen

Thanks for sticking up for my humanity ;)

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#87
post #24

Earlier quoted context omitted.

Yeah, I used to be skeptical of the government provenance of things like Stuxnet (I am not any more, I'm fully sold, like everyone else), and notes like this were why. People used RCS well into the 2000s! RCS as a tool had virtues over SVN and CVS.

> used to be skeptical of the government provenance Do you mean skeptical on which government was responsible or that it was in fact a government effort? I can see how attribution could be debatable (between two main suspects mainly), but are / were there any good arguments against this being a gov effort? I would find it highly unlikely that someone other than a gov could muster up so much domain knowledge, source p…

I didn't want to give bumptious government CNE teams that much credit, and also a lot of the indicators people were giving of state origin didn't seem all that predictive. I don't agree with your premise that it takes a state-level adversary to collect the domain knowledge needed to do this stuff, and I certainly don't agree about the "pristine zero days".

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#88
post #72
post #52

Earlier quoted context omitted.

Ha, I worked for a company that until ~2012 still used RCS-backed SCM, absolute hack job on a shared file share that wrapped RCS with a "project file" to allow a tree of specific revisions for a "project". "MKS" it was called. And by the sound of it the "old" '90s version, not the java EE rewrite. That meant the files has the entire "$Revision: 1.3 $" nonsense and "file changelog" at the top too - though many newer f…

RCS->CVS and from that you can convert it to GIT or SVN.

The issue was the rcs files were simply corrupt - no matter what tool you used the older deltas were just bad. Just people didn't notice/care as they were "old" revisions.

And I couldn't find any tool that supported the mks "project" files that linked multiple rcs revisions into a single "commit", so something a little custom was needed anyway. At least for the ancient mks version used.

Quite a bit of effort was put into it during the "official" migration, but they eventually gave up too as even the oldest backup archives they could find had the same issues.

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#89
post #62

Earlier quoted context omitted.

That’s how everybody in academia, tech, and published authors in general used to write. Where do you think the LLM is getting it from? ^_^

the full on em dash requires a different character than - or -- it was generated that way, or else this person happens to know the correct combination of buttons to make that happen. in 2026, at least 20-40% of social media traffic is bots (and probably higher with better LLMs), so it is usually safer to just assume.

Microsoft Word changes "--" to an em-dash, by default.

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#90
post #46

Earlier quoted context omitted.

Try to remember how hypothetical everything tended to be before Snowden. And 'twas a meager pittance that was revealed. They have toys that'd blow minds and people yee'd swear weren't people. It's all fun and games to poke fun, but holy shit those guys are NTBF'dW. Every academic institution, every school, all under the radar of recruitment and more. It's difficult to believe, but the network is real. There are certa…

Fun to imagine that and painful to think of what we could have if such efforts and budgets were put toward education, healthcare, social welfare, public infrastructure + reliability, etc. But then I am getting too utopian

Exactly. But there's ideology, and there's reality. You know how pervasive and colossal the black budget is. We could be, as a society, almost unimaginably advanced of where we are, sans such things, sans the modern patent system, sans greed, sans corruption.

But we are, precisely where we are

Edit: I thought it prudent to leave a reminder, that the US military operates beyond patent regulations. If they want or need something, the silly games end there. And they do what they will.

Post reply on HN