Live data from Hacker News

Fast16: High-precision software sabotage 5 years before Stuxnet

sentinelone.com

101–107 of 107 posts

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#101
post #7

My favorite part of this was: That kind of notation, called SCCS/RCS, is the equivalent of finding a rotary phone in a modern office. Nobody uses it in 2005 Windows kernel code unless their programming background goes back decades, to government and military computing environments — The astrophysics lab I worked at in 2006 was still using svn and had a bunch of Fortran with references to systems from the 70s and 80s.…

I miss the days of knowing who last touched every source file and precisely what version it was:

  $ what /usr/bin/file
  /usr/bin/file:
   PROGRAM:file  PROJECT:file-106
   $File: apprentice.c,v 1.309 2021/09/24 13:59:19 christos Exp $
   $File: apptype.c,v 1.14 2018/09/09 20:33:28 christos Exp $
   $File: ascmagic.c,v 1.109 2021/02/05 23:01:40 christos Exp $
   $File: buffer.c,v 1.8 2020/02/16 15:52:49 christos Exp $
   $File: cdf_time.c,v 1.19 2019/03/12 20:43:05 christos Exp $
   $File: cdf.c,v 1.120 2021/09/24 13:59:19 christos Exp $
   $File: compress.c,v 1.129 2020/12/08 21:26:00 christos Exp $
   $File: der.c,v 1.21 2020/06/15 00:58:10 christos Exp $
   $File: encoding.c,v 1.32 2021/04/27 19:37:14 christos Exp $
   $File: fsmagic.c,v 1.81 2019/07/16 13:30:32 christos Exp $
   $File: funcs.c,v 1.122 2021/06/30 10:08:48 christos Exp $
   $File: is_csv.c,v 1.6 2020/08/09 16:43:36 christos Exp $
   $File: is_json.c,v 1.15 2020/06/07 19:05:47 christos Exp $
   $File: is_tar.c,v 1.44 2019/02/20 02:35:27 christos Exp $
   $File: magic.c,v 1.115 2021/09/20 17:45:41 christos Exp $
   $File: print.c,v 1.89 2021/06/30 10:08:48 christos Exp $
   $File: readcdf.c,v 1.74 2019/09/11 15:46:30 christos Exp $
   $File: readelf.c,v 1.178 2021/06/30 10:08:48 christos Exp $
   $File: softmagic.c,v 1.315 2021/09/03 13:17:52 christos Exp $
   $File: file.c,v 1.190 2021/09/24 14:14:26 christos Exp $
  ...
 
  WHAT(1)                     General Commands Manual                    WHAT(1)
  
  NAME
       what - show what versions of object modules were used to construct a file
  
  SYNOPSIS
       what [-qs] [file ...]
  
  DESCRIPTION
       The what utility searches each specified file for sequences of the form
       "@(#)" as inserted by the SCCS source code control system.  It prints the
       remainder of the string following this marker, up to a NUL character,
       newline, double quote, `>' character, or backslash.
  
       The following options are available:
  
       -q      Only output the match text, rather than formatting it.
  
       -s      Stop searching each file after the first match.
  
  EXIT STATUS
       Exit status is 0 if any matches were found, otherwise 1.
  
  SEE ALSO
       ident(1), strings(1)
  
  STANDARDS
       The what utility conforms to IEEE Std 1003.1-2001 ("POSIX.1").  The -q
       option is a non-standard FreeBSD extension which may not be available on
       other operating systems.
  
  HISTORY
       The what command appeared in 4.0BSD.
  
  BUGS
       This is a rewrite of the SCCS command of the same name, and behavior may
       not be identical.
  
  macOS 26.4                     December 14, 2006                    macOS 26.4

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#102
post #33

Earlier quoted context omitted.

>in 2006 was still using svn Perhaps you meant cvs? Subversion was released in 2004 and git appeared in 2005.

We used cvs, but did switch to svn before/around 2006, but I could be mixing that up. We did not switch to git even by 2012 when I left. The reference to the 70s and 80s code didn’t imply it was version controlled before svn/cvs though if that’s what you meant, but by that time it was and still had old timestamps commented in the text files.

I just wanted to say that "still using svn in 2006" sounds odd when talking about version control system that existed just for several years and what turned out to be its replacement was 1 year old.

gcc, for example, transitioned to subversion in 2006 and switched to git only in 2019 [0]

[0] https://gcc.gnu.org/wiki/GitConversion

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#103
post #68

Interesting that this was discovered after embarking on a journey to understand how widespread the use of Lua is, in the exploits realm .. I also wonder why they opted to make this an injectable worm and not just a side-loaded 'feature' of the OS?

What would the difference be? They would have the same effect.

Easier to deliver as an OS bundle, no worm required.

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#104
post #13

sabotaging science must be the most morally corrupt thing you can do as a civilisation

Spying on and sabotaging weapons development of foreign adversaries is a completely normal government function

I hope one day, it will no longer be normal - it will be wild.

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#105
post #98

For posterity, there was a subthread about how the main submission was some kind of AI generated article. This appears to have been deleted. (Or some HN magic happened where threads are merged? I don't know.) At any rate, the original link was https://hackingpassion.com/fast16-pre-stuxnet-cyber-sabotage... https://archive.ph/7VpWv Which while apparently being AI generated, does have some additional information over t…

The subthread is here in this discussion, auto-collapsed: https://news.ycombinator.com/item?id=47913855#47914315

Re: Fast16: High-precision software sabotage 5 years before Stuxnet

#107
post #49

Earlier quoted context omitted.

Does that mean that three-letter agencies were/are able to recruit from the fields for each type of malware? For example, fast16 might actually be written by someone who used to write scientific calculation software, while Stunex was written by someone who used to work for Siemens?

Don't think of it as a materials simulation engineer being recruited and trained on how to write complex malware. Rather this was developed by a team of 6-8 people. Maybe two or three of them working on the implant, another engineer handling the exploits and propagation, and yet another building the LP and communications channels. They are supported by a scientist with deep knowledge of the process they are messing a…

Yeah I think this makes more sense. After all they need some domain knowledge but the key is to write and deliver that payload.
Post reply on HN