Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Stuxnet worm may be the most sophisticated software ever written

quora.com

Post reply on HN
Print view View original

201–210 of 507 posts

Re: The Stuxnet worm may be the most sophisticated software ever written

#201

Post by vertexFarm »

um_ya wrote: post #109
steego wrote: post #85

Earlier quoted context omitted.

You know what's worse than the instant obliteration of millions of people? The slow obliteration and starving of millions of people. Imagine Venezuela, but much much worse. Picture a society that doesn't know how to create institutions, conduct trade and collaborate with the people around them without the aid of a computers. Now, I don't know if disabling their computers would result in an incredibly dysfunctional so…

Actually, in a capitalist country it might be easier to survive such an attack. If there is demand for a product or service, people and businesses will find a way to meet that demand. Millions of people working independently to satisfy their local market demand. It would probably hurt centralized socialist or communist countries more since it severs their control, surveillance, and communication mechanisms.

Capitalist countries still centralize their control, surveillance, and communication into few hands with little diversity. The market forces you describe only apply to the early days of capitalism. Most capitalist societies are long past that, at a stage where the strong early players have re-written the rules and formed quasi-state monopolies.

Just look at how many communications companies the US has. And the government had to step in and break that up because there used to be just one. Even now they are quietly conglomerating back together, and there are no significantly different options available. It's still very vulnerable to an attack or flaw due to lack of diversity.

Re: The Stuxnet worm may be the most sophisticated software ever written

#202

Post by wepple »

Yajirobe wrote: post #56

I have a question. Since the worm travels from USB to USB, does that mean that it infected thousands (or more) of regular people USBs but did nothing, until it found itself in a purity facility? Or was the worm somehow directly sent (physically or digitally) to the facility?

Yeah, most worms like this have detective capability to work out whether they’re on the systems that they’re wanting to be on. If not, they’ll either try to clean up and vanish or just serve for further propagation.

Stuxnet was discovered because it accidentally spread too far, and ended up on a malware analysts desk.

There was a targeted supplier, an upstream vendor as the insertion point, but it spread outside of that chain.

Re: The Stuxnet worm may be the most sophisticated software ever written

#203

Post by _2d30 »

m0skit0 wrote: post #110
threeseed wrote: post #73

Earlier quoted context omitted.

"Russia has hacked into many of our government entities and domestic companies in the energy, nuclear, commercial facilities, water, aviation and critical manufacturing sectors" https://www.forbes.com/sites/jamesconca/2018/03/16/russia-ha... The same was also reported by MI5, Europol and of course within Ukraine.

Forbes, definitely an objective and impartial source about Russia.

Is there a reason to believe it's not? I'm not familiar with any particular Russian bias from Forbes.

Re: The Stuxnet worm may be the most sophisticated software ever written

#204

Post by hunterjrj »

ufmace wrote: post #145

IMO, the sophistication of the final worm that made it out to security researchers doesn't have anything on the process that must have been used to develop it. Take the normal iterative development process, except that: You don't know anything at all about the design of your targeted system and networks. Even getting a little information about it requires writing sophisticated malware, using various spy capers to get…

>You don't know anything at all about the design of your targeted system and networks.

>They must have spent years devising ways to get in, slowly gathering info about their target, figuring out a way to achieve the assigned goal of screwing things up without getting detected.

I'd speculate that given who the intended targets were (Iran, North Korea) and who would have an interest in disrupting their enrichment operations (Israel, US), and given the level of intelligence gathering activity that both of these nation can (and ostensibly do) engage in, that the team tasked with creating this virus had plenty of information to go on from the start.

Centrifuge models with firmware revision, network topologies, deployed server configuration, etc were likely known in advance.

Re: The Stuxnet worm may be the most sophisticated software ever written

#205

Post by vertexFarm »

ythn wrote: post #122
steego wrote: post #85

Earlier quoted context omitted.

You know what's worse than the instant obliteration of millions of people? The slow obliteration and starving of millions of people. Imagine Venezuela, but much much worse. Picture a society that doesn't know how to create institutions, conduct trade and collaborate with the people around them without the aid of a computers. Now, I don't know if disabling their computers would result in an incredibly dysfunctional so…

> You know what's worse than the instant obliteration of millions of people? The slow obliteration and starving of millions of people Yeah, I'm going to have to sort of disagree with you there. Once you are dead, you are dead. If you are starving, things can still change and you can still have free agency.

Well it's about statistics rather than what an individual might possibly be able to accomplish.

Sure, maybe you'll find a way to survive a famine, but on average most will die because the math just doesn't add up. Not enough food for everyone. And it ends up killing far more than bombs and bullets, even nukes. Disease and famine are far worse than WMD when the numbers are in.

Re: The Stuxnet worm may be the most sophisticated software ever written

#206

Post by bingojess »

ssijak wrote: post #54

And then people make a fuss about Russia "hacking" the election with some dumb Facebook ads which cost less than maxed out Ford Mustang. When on the other hand we have the state-sponsored military grade/purpose viruses used to attack other nations/regions (Flume attacked a large number of targets and countries) and nobody blinks an eye.

Engineering an election to install a malleable leader in a rival country is the holy grail if you ask me. Developing the cyber equivalent of WMDs to get what you want is a relatively blunt tool, just like how North Korea is doing but they use nukes

Re: The Stuxnet worm may be the most sophisticated software ever written

#207

Post by wepple »

Piskvorrr wrote: post #38
bflesch wrote: post #23

Would it have been easier or harder to implement Stuxnet if the target networks were running some sort of linux? Or if it would've been a mac-only facility? I'm curious.

Smaller platforms (which Linux and Mac OS are, compared to Windows) draw less interest (both in exploits and scrutiny against exploits), and fragmented platforms (Linux) are harder to code for (SystemV? systemd? something else entirely?). I guess that it would have required more effort - but at this level of involvement, I would say that the result would have been achieved regardless.

The stuxnet dev team managed to get their hands on the exact same centrifuges as used in Natanz, so getting replica Linux control systems would’ve been a walk in the park.

Also, “less interest” is irrelevant when we are talking about nation states picking a specific target and throwing considerable engineering resource at exploitation.

Re: The Stuxnet worm may be the most sophisticated software ever written

#208

Post by vardump »

LeonM wrote: post #134
cptskippy wrote: post #116

> This driver was digitally signed by Realtek, which means that the authors of the worm were somehow able to break into the most secure location in a huge Taiwanese company, and steal the most secret key that this company owns, without Realtek finding out about it. > Later, whoever wrote that driver started signing it with secret keys from JMicron, another big Taiwanese company. Yet again, the authors had to figure o…

That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet th…

> That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too.

No, you could unfortunately get around that very easily (or rather, ignore recommendations) at least a few years ago. So I bet there are a lot of certificates and private keys lying around on disks, build servers, version control systems and probably even on developer USB sticks.

The cert and key just needs to be something signtool can access. Signtool doesn't care whether it's relatively unprotected key in system software based key store or on a HSM.

Windows 10 1607+ enforces a much stricter standard, especially if you want your driver to work in Secure Boot mode. There are also stricter requirements for driver testing and static analysis, although those depend on the driver type. Microsoft requires and checks testing tool output as a part of the driver submission before finally signing it with their cert.

Tip: If you run Windows 10 and value security (and system stability), use Secure Boot.

(I've developed Windows kernel drivers.)

Re: The Stuxnet worm may be the most sophisticated software ever written

#209

Post by mygo »

erkkie wrote: post #159
titzer wrote: post #144

Earlier quoted context omitted.

> I'd bet that they somehow had access to the HSM, to have it sign the driver for them. Or were able to duplicate the HSM before it was delivered. You know, like how the NSA intercepted shipments of internet routers in transit and inserted backdoors.

You don't ship HSM's with keys (you initialise them on-device yourself) nor can you read read keys out from one (at least in theory).

if the goal is to gain access to HSM’s signing functionality and you don’t need to know the HSM’s keys to gain access to its signing functionality then something else is being guarded that is essentially the key.. For example be it a machine locked in a room, then the room key is the key. Or maybe someone’s retina, or a sign-off from someone with clearance, etc. (at least in theory)

That’s a general theory though, but I’d think the same fundamentals apply

Also this only serves to prove that some powerful entity that operates on secrecy, like a government or mega corp, is likely who executed this. I’d like to fantasize some suave, determined black market salesman with a rough childhood and his band of cyber criminals broke into both of these facilities, but seeing how difficult it is to accomplish something like this, it seems more likely that someone just let them in through the front door.

Post reply on HN