141–150 of 507 posts
And then people make a fuss about Russia "hacking" the election with some dumb Facebook ads which cost less than maxed out Ford Mustang. When on the other hand we have the state-sponsored military grade/purpose viruses used to attack other nations/regions (Flume attacked a large number of targets and countries) and nobody blinks an eye.
Like Watergate, but by a foreign actor.
The scary thing about this is: Stuxnet is one of the "most sophisticated" pieces of malware we have discovered up until now . Who knows what kinds of software are still out there quietly doing their thing in the shadows.
"Russia has hacked into many of our government entities and domestic companies in the energy, nuclear, commercial facilities, water, aviation and critical manufacturing sectors" https://www.forbes.com/sites/jamesconca/2018/03/16/russia-ha... The same was also reported by MI5, Europol and of course within Ukraine.
Earlier quoted context omitted.
Think of controllers for say a dam, or an autopilot system in a jet.
How would either of these be worse than a nuke going off in Hong Kong or NYC?
> This driver was digitally signed by Realtek, which means that the authors of the worm were somehow able to break into the most secure location in a huge Taiwanese company, and steal the most secret key that this company owns, without Realtek finding out about it. > Later, whoever wrote that driver started signing it with secret keys from JMicron, another big Taiwanese company. Yet again, the authors had to figure o…
That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet th…
Or were able to duplicate the HSM before it was delivered. You know, like how the NSA intercepted shipments of internet routers in transit and inserted backdoors.
You don't know anything at all about the design of your targeted system and networks.
Even getting a little information about it requires writing sophisticated malware, using various spy capers to get the malware near the target systems, and somehow exfiltrating data from airgapped systems over the internet, where the whole mission is blown if anyone detects your data movement.
You may need dozens of iterations of adjusting the software to try and dive a little bit deeper, getting it snuck into the target systems (hopefully by a built-in update over the net), gathering information on the network architecture, then exfiltrating that data back out.
Always a tough balance of spread-happy enough to infect highly protected airgapped systems in a top-secret facility, but not so spread-happy to get out on the open net and infect half of the world, where it will inevitably be discovered eventually. This is probably where they eventually screwed up.
How long to detect that they're using this particular model of PLC with this particular centrifuge, buy your own copy of them, dig up someone who actually knows about these things, collaborate with them to figure out a sneaky way to screw things up just a little bit, build ways to get your virus onto the target system to do its damage, etc.
I'd assume that there was a team somewhere with a big library of zero-day exploits and a bunch of ace developers, but no starting knowledge of the target. Someone gave them the order to figure out a way to hack and screw up the Iranian nuclear program, maybe with the helper that some other org has a guy that can deliver any product near the program. They must have spent years devising ways to get in, slowly gathering info about their target, figuring out a way to achieve the assigned goal of screwing things up without getting detected. Now that would be a hell of a project to work on.
I am just your average software dev with zero knowledge of malware creation, speculating here, and might come across as a fool. The author sensationalizes the effort of the creators, painting a Holywoodesque scenario where they break into every possible software company to steal keys to misrepresent the software, going undetected by every possible security company etc. Since this is a Quora post, I can live with him…
What keeps this cooperation secret? It would only take one weak link at any one of those companies to reveal -- accidentally or otherwise -- that they were coerced into providing their signing keys. As soon as that got out, speculation runs amok: Are all products from said company compromised? This would be ruinous to a company, so no one in charge would agree to that without something significant -- which would be even harder to hide from the public -- in return. Then, who asked for the key and why? Could that be traced back to the (presumably) agency in question? That weak link was weak once, there's nothing to assume that he/she won't be weak again, etc., etc.
Everything else are reported and blocked.
Would it be enough to prevent such worm?
It would be interesting exercise to take an old exploitable OS (Win XP, or 10 years old Linux with known issue) add such layer to it. Put it on internet as honeypot and see what other kind of inflections it might get.
> This driver was digitally signed by Realtek, which means that the authors of the worm were somehow able to break into the most secure location in a huge Taiwanese company, and steal the most secret key that this company owns, without Realtek finding out about it. > Later, whoever wrote that driver started signing it with secret keys from JMicron, another big Taiwanese company. Yet again, the authors had to figure o…
That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet th…
[1] https://www.sslshopper.com/microsoft-authenticode-certificat...
Earlier quoted context omitted.
They mentioned they were Tawainese comapanies. I’d bet it was stolen rather than passed to them by some insider.
The hard part was writing the worm and getting it in to the facility, not getting in to Realtek's network. I would bet.
And then people make a fuss about Russia "hacking" the election with some dumb Facebook ads which cost less than maxed out Ford Mustang. When on the other hand we have the state-sponsored military grade/purpose viruses used to attack other nations/regions (Flume attacked a large number of targets and countries) and nobody blinks an eye.
Those are indicative of the public’s enduring lack of technology literacy, and the media’s desire to have facts and eyeballs meet halfway. Media reports Russian election interference via digital ad spend, astroturfing, and infiltration attempts on state voting systems accurately, but the views to that reporting probably pale in comparison to the oversimplified, tweet-size “Russia hacked the 2016 US election” reportin…