Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

github.com

Post reply on HN
Print view View original

51–60 of 62 posts

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#51

Post by BLKNSLVR »

stingraycharles wrote: post #39
BLKNSLVR wrote: post #24

Earlier quoted context omitted.

Important to note that the system(s) it infected were non-trivially air-gapped, so it had to do the entirety of it's infectious work without command and control servers or receiving any additional input. It had to be an entirely autonomous process from infection to propagation to execution. Pretty amazing to have been pulled off seemingly so successfully.

Wasn’t it actually not as successful as it could have been? I recall something about it spreading to more machines than it should have, which caused it to be detected earlier than it should have.

Playing with definitions of success in this reply, but, yes, I think the industrial control system detection wasn't quite narrow enough.

Very successful in doing what was intended. Less successful in limiting collateral damage; the collateral damage of which was earlier than intended discovery (or discovery at all).

What lessons have they learned, though, so what's out there now, with 10 years more learning, and now AI assistance?

Scary thought. We're all pwnt.

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#52

Post by Retr0id »

CMDDestory wrote: post #44
rep_lodsb wrote: post #18

Earlier quoted context omitted.

But then did it hallucinate that registry key? Or this? "instance of ActiveScriptEventConsumer as $Consumer\n" "{\n" " Name = \"StuxnetConsumer\";\n" " ScriptingEngine = \"VBScript\";\n" " ScriptText = \"CreateObject(\\\"WScript.Shell\\\").Run \\\"%SystemRoot%\\\\system32\\\\winsta.exe\\\", 0, False\";\n" "};\n"

[flagged]

What?

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#55

Post by ptidhomme »

rep_lodsb wrote: post #15

This looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one does not include the literal string "Stuxnet" anywhere, like it does here: RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet"); Wikipedia about the origin of the name: The original name given by VirusBlokAda was "Ro…

Interestinly, it does include the string "myrtus", which was likely it's real internal name.

https://medium.com/@arpit.writes/stuxnet-and-the-birth-of-di...

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#57

Post by nilsherzig »

beavis000 wrote: post #42
strictnein wrote: post #14

Earlier quoted context omitted.

I always enjoyed Kim Zetter's work. Well written and researched, and she doesn't put herself in the story, unlike some other authors. She highlights the practitioners who are actually the ones doing the work.

You might also enjoy "Command and Control" by Eric Schlosser.

i really enjoyed that one

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#58

Post by __alexander »

mzs wrote: post #12

I always wondered about how feasible the usb drive propagation bit always noted was. Was there ever any evidence that the hardware was already infected at a less scrupulous reseller? I’ve heard of another site in EU that had misbehaving s7. It could have been a reseller that played loose with licensing.

It was very feasible. The exploit to propagate via usb was CVE-2010-2568. Odds are you can still find details on it.

Re: Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon

#59

Post by Tangurena2 »

theturtletalks wrote: post #43
BLKNSLVR wrote: post #24

Earlier quoted context omitted.

Important to note that the system(s) it infected were non-trivially air-gapped, so it had to do the entirety of it's infectious work without command and control servers or receiving any additional input. It had to be an entirely autonomous process from infection to propagation to execution. Pretty amazing to have been pulled off seemingly so successfully.

Yes they actually flooded the market with USB drives with Stuxnet. But it was actually too good and started infecting non-target computers. That’s what got a malware researcher to dig in and he saw multiple zero days being used and deduced it was a Mossad and US operation.

Some of the code needed to be digitally signed to execute on target hardware, so being able to get the actual digital certs meant that Stuxnet could not be a hacker group and could only be some national agency or "Bond villain."
Post reply on HN