g_dwCentrifugeDestroyed++;
g_dwBrainsDestroyedBySlop++;
Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
31–40 of 62 posts
Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
#32Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
#33What binary did you start from?
Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
#34This looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one does not include the literal string "Stuxnet" anywhere, like it does here: RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet"); Wikipedia about the origin of the name: The original name given by VirusBlokAda was "Ro…
Yeah... it's reverse engineered. They explained that.
as the other commentator said, it's one thing if it's just variable names (opaque to reverse engineering) but the fact that it is registry keys....
Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
#35Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as…
Where did the binaries come from? Did Iran release them?
Are you referring to the government of Iran,
or the (possibly Iranian) sec people they handed the flash drives from the parking lot to?
Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
#36Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as…
Where did the binaries come from? Did Iran release them?
From what I recall reading, stuxnet itself was found in the wild. Even though it was certainly created for a specific target. That’s how security researchers were able to study it fairly quickly. So the binaries were already out there to pull from other infected systems.
Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
#37Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
#38I always wondered about how feasible the usb drive propagation bit always noted was. Was there ever any evidence that the hardware was already infected at a less scrupulous reseller? I’ve heard of another site in EU that had misbehaving s7. It could have been a reseller that played loose with licensing.
Given the 'pager attack' supply chain involvement, it can't be ruled out in any other state-sponsored hack / attack.
See also: https://www.schneier.com/blog/archives/2015/03/cisco_shippin...
Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
#39Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as…
Important to note that the system(s) it infected were non-trivially air-gapped, so it had to do the entirety of it's infectious work without command and control servers or receiving any additional input. It had to be an entirely autonomous process from infection to propagation to execution. Pretty amazing to have been pulled off seemingly so successfully.
Wasn’t it actually not as successful as it could have been? I recall something about it spreading to more machines than it should have, which caused it to be detected earlier than it should have.
Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
#40Earlier quoted context omitted.
Important to note that the system(s) it infected were non-trivially air-gapped, so it had to do the entirety of it's infectious work without command and control servers or receiving any additional input. It had to be an entirely autonomous process from infection to propagation to execution. Pretty amazing to have been pulled off seemingly so successfully.
Wasn’t it actually not as successful as it could have been? I recall something about it spreading to more machines than it should have, which caused it to be detected earlier than it should have.
[deleted]