Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

github.com

Post reply on HN
Print view View original

21–30 of 62 posts

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#23

Post by qarl »

rep_lodsb wrote: post #15

This looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one does not include the literal string "Stuxnet" anywhere, like it does here: RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet"); Wikipedia about the origin of the name: The original name given by VirusBlokAda was "Ro…

Yeah... it's reverse engineered. They explained that.

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#24

Post by BLKNSLVR »

kibitzor wrote: post #3

Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as…

Important to note that the system(s) it infected were non-trivially air-gapped, so it had to do the entirety of it's infectious work without command and control servers or receiving any additional input. It had to be an entirely autonomous process from infection to propagation to execution.

Pretty amazing to have been pulled off seemingly so successfully.

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#27

Post by [deleted] »

nullbio wrote: post #16
rep_lodsb wrote: post #15

This looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one does not include the literal string "Stuxnet" anywhere, like it does here: RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet"); Wikipedia about the origin of the name: The original name given by VirusBlokAda was "Ro…

Astra can reverse engineer binaries now. That's likely where it came from.

[deleted]

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#29

Post by rep_lodsb »

qarl wrote: post #23
rep_lodsb wrote: post #15

This looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one does not include the literal string "Stuxnet" anywhere, like it does here: RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet"); Wikipedia about the origin of the name: The original name given by VirusBlokAda was "Ro…

Yeah... it's reverse engineered. They explained that.

And the Wikipedia article explains where the name came from, a combination of ".stub" and "mrxnet.sys".

Not one literal string as it appears several times in this purported "reconstruction". Including as the name for a registry key, in the hex code at the end of an EXE header stub ("REALTEK",0x00,"Stuxnet"), and in a frigging autorun.inf as the program name.

Even if Wikipedia is wrong and that string should appear somewhere in the original binary, whatever LLM they used has really been overdoing it beyond the bounds of realism: "Hey look, it's the REAL STUXNET, you've all read about it, here is the 100% real authentic reverse-engineered source code!"

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#30

Post by tehjoker »

kibitzor wrote: post #3

Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as…

Where did the binaries come from? Did Iran release them?
Post reply on HN