Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon • Hacker News Board

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#41

Post by qarl » Tue, Sep 08, 2026, 2:47 AM UTC

rep_lodsb wrote: post #29

qarl wrote: post #23

Earlier quoted context omitted.

Yeah... it's reverse engineered. They explained that.

And the Wikipedia article explains where the name came from, a combination of ".stub" and "mrxnet.sys". Not one literal string as it appears several times in this purported "reconstruction". Including as the name for a registry key, in the hex code at the end of an EXE header stub ("REALTEK",0x00,"Stuxnet"), and in a frigging autorun.inf as the program name. Even if Wikipedia is wrong and that string should appear so…

Yeah... you've convinced me. An reverse engineering LLM should/would never invent literal strings in the code.

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#42

Post by beavis000 » Tue, Sep 08, 2026, 3:07 AM UTC

strictnein wrote: post #14

beavis000 wrote: post #8

I very much recommend reading "Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon". Fascinating stuff.

I always enjoyed Kim Zetter's work. Well written and researched, and she doesn't put herself in the story, unlike some other authors. She highlights the practitioners who are actually the ones doing the work.

You might also enjoy "Command and Control" by Eric Schlosser.

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#43

Post by theturtletalks » Tue, Sep 08, 2026, 3:08 AM UTC

BLKNSLVR wrote: post #24

kibitzor wrote: post #3

Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as…

Important to note that the system(s) it infected were non-trivially air-gapped, so it had to do the entirety of it's infectious work without command and control servers or receiving any additional input. It had to be an entirely autonomous process from infection to propagation to execution. Pretty amazing to have been pulled off seemingly so successfully.

Yes they actually flooded the market with USB drives with Stuxnet. But it was actually too good and started infecting non-target computers. That’s what got a malware researcher to dig in and he saw multiple zero days being used and deduced it was a Mossad and US operation.

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#44

Post by CMDDestory » Tue, Sep 08, 2026, 3:18 AM UTC

rep_lodsb wrote: post #18

nullbio wrote: post #16

Earlier quoted context omitted.

Astra can reverse engineer binaries now. That's likely where it came from.

But then did it hallucinate that registry key? Or this? "instance of ActiveScriptEventConsumer as $Consumer\n" "{\n" " Name = \"StuxnetConsumer\";\n" " ScriptingEngine = \"VBScript\";\n" " ScriptText = \"CreateObject(\\\"WScript.Shell\\\").Run \\\"%SystemRoot%\\\\system32\\\\winsta.exe\\\", 0, False\";\n" "};\n"

[flagged]

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#45

Post by SiyuanFeng » Tue, Sep 08, 2026, 3:26 AM UTC

[flagged]

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#46

Post by sneak » Tue, Sep 08, 2026, 3:26 AM UTC

AIUI, the successors used a hash of certain system configurations or directory listings to serve as the decryption key for the malicious payload, so that if you found the binary but didn’t have a target system also, it was meaningless.

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#47

Post by CMDDestory » Tue, Sep 08, 2026, 3:38 AM UTC

tonyhart7 wrote: post #13

waiting for Pegasus source code

Of course! But it depends. Zero-click is essentially client‑side XSS.

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#48

Post by CMDDestory » Tue, Sep 08, 2026, 3:39 AM UTC

monster_truck wrote: post #2

Directory filtering needs to be fixed, one weird filename or symlink will make it BSOD. SSDT should probably have a lock. The chance of a race is ~low (higher under heavy sustained workloads) but it's too important to leave to chance. I'd probably do a rebuild of the directory lists in a separate buffer instead of working in place to avoid alignment fuckups. Yes I used LLMs, just like I did for all of the other vulns…

Thank PR!

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#49

Post by CMDDestory » Tue, Sep 08, 2026, 3:40 AM UTC

wiml wrote: post #33

What binary did you start from?

MRxNet and MRxCls.

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#50

Post by CMDDestory » Tue, Sep 08, 2026, 3:42 AM UTC

kibitzor wrote: post #3

Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as…

Thanks,providing readable code for everyone is inherently a thing of pride.