The Stuxnet worm may be the most sophisticated software ever written • Hacker News Board

Re: The Stuxnet worm may be the most sophisticated software ever written

#291

Post by donald_fump » Fri, May 18, 2018, 3:44 PM UTC

lucideer wrote: post #280

eberkund wrote: post #276

Earlier quoted context omitted.

But do those things really contribute to the sophistication of the software? For example imagine some code written with no understanding of uranium enrichment: const int CENTRIFUGE_RPM = 500; And then some other code written with a deep understanding of uranium enrichment: const int CENTRIFUGE_RPM = 1203; Can you really say that the second bit of code is more "complex"? Same goes for stolen driver signing keys and so…

The second piece of code is not more complex, but it is (presumably) a lot more sophisticated. The fact that I had to prefix that with "(presumably)"—i.e. I can't actually tell using my own expertise—is evidence of that.

upvoted thanks

Re: The Stuxnet worm may be the most sophisticated software ever written

#292

Post by coldtea » Fri, May 18, 2018, 3:44 PM UTC

donald_fump wrote: post #289

ktpsns wrote: post #278

Earlier quoted context omitted.

The complexity or quality of a software code does not neccessarily say anything about the complexity of the problem it solves.

so true. upvoted

The sophistication of a piece of code is not merely an attribute of its complexity.

Else a program with tons of accidental complexity (a badly written program by an intern) would be equally good with a program with huge essential complexity (a 10 line program that takes tons of domain and/or programming knowledge to write)...

Re: The Stuxnet worm may be the most sophisticated software ever written

#293

Post by mathnode » Fri, May 18, 2018, 3:45 PM UTC

perlgeek wrote: post #236

I'd argue that Google Search is much more sophisticated than Stuxnet. Windows is much more sophisticated. Linux is more sophisticated than Stuxnet. The list goes on. We tend to ignore the sophistication of things we are familiar with, and hype those that surprise. But that's not a fair measure of anything.

MariaDB and PostgreSQL. Amazing software that is open source for us to dive in and play with. FoundationDB was a recent treat.

Re: The Stuxnet worm may be the most sophisticated software ever written

#294

Post by Lionsion » Fri, May 18, 2018, 3:45 PM UTC

hedora wrote: post #232

fapjacks wrote: post #8

I've been arguing about this for the last three days. Mostly around the reason that "complexity" is not strictly the same thing as "sophistication" when it comes to software. Noobs will conflate the two, but experienced programmers will agree that -- just to illustrate my point -- some code which solves a complex problem in a very clever way while also being very clean and easy to maintain will be considered strictly…

On complexity vs sophistication: During the cold war, a US company noticed the USSR had stolen the plans for a natural gas pipeline system, but not the software. In response, the US introduced an integer overflow bug that was uptime dependent, and took something like 6 months to hit. The bug simultaneously cranked up the pumps and closed all the valves in the network. It was known that the Soviet economy would crash…

> On complexity vs sophistication: During the cold war, a US company noticed the USSR had stolen the plans for a natural gas pipeline system, but not the software.

I think this account might be a bit wrong. The one I read said that the CIA acquired a "shopping list" of Western technology that the USSR wanted to acquire. It included the pipeline control software, so they arranged for a trojaned version to become available to the Soviet shoppers.

Apparently this was a pretty common Soviet activity. Their electronics technology was behind the West's, in general. IIRC, many US semiconductor designs has little cartoons on the dies to taunt the Soviet reverse engineers.

Re: The Stuxnet worm may be the most sophisticated software ever written

#295

Post by yoyar » Fri, May 18, 2018, 3:46 PM UTC

Without a doubt the article is fascinating but without defining what we mean by sophisticated how can we debate this?

Re: The Stuxnet worm may be the most sophisticated software ever written

#296

Post by r3bl » Fri, May 18, 2018, 3:48 PM UTC

at-fates-hands wrote: post #256

r3bl wrote: post #241

Earlier quoted context omitted.

I agree. It's the most sophisticated piece of malware , that's for sure (at least counting the ones we know of). But calling it the most sophisticated piece of software is too big of a stretch. That said, other answers to this question include what we would traditionally consider as contestants (like Linux kernel), it just happens that the submitter decided to submit this specific answer. I don't know was this the to…

> It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of). Isn't Stuxnet a part of a family of similar nation state malware that would also include Flame and Duqu?

They are a family, as in, all of them were almost certainly created by the same group.

Symantec said that Duqu is "near identical" to Stuxnet. As for Flame, Kaspersky[0] initially said that it contains no resemblance to Stuxnet, and then later on discovered that they've even shared a zero day in their early versions.

From my understanding, I don't necessarily consider them as different software, more as a single software + forks by the same group for different purposes and with different zero days.

Stuxnet just happened to be the one that got to be the most popular one, for a number of reasons (most destructive, attacking the most sensitive targets, the one that got out of control and spread outside of Iran uncontrollably, first to be discovered...), so I refer to Stuxnet as the original one and Flame and Duqu as more of forks than completely different pieces of software.

Which one is more sophisticated between the three would be the same as if we tried figuring out which Linux-based OS is the most sophisticated, except that in this scenario, we only have 3 Linux distros (maybe four with Gauss) and they've all been created by the same group. There's really no point in trying to compare their sophistication.

[0] Before people bash on me for using Kaspersky as a source, Kaspersky, Iranian CERT and a university in Bucharest were the ones that initially discovered Flame, and Kaspersky's the group that published the first detailed analysis on Flame.

Re: The Stuxnet worm may be the most sophisticated software ever written

#297

Post by [deleted] » Fri, May 18, 2018, 3:48 PM UTC

coldtea wrote: post #290

eberkund wrote: post #276

Earlier quoted context omitted.

But do those things really contribute to the sophistication of the software? For example imagine some code written with no understanding of uranium enrichment: const int CENTRIFUGE_RPM = 500; And then some other code written with a deep understanding of uranium enrichment: const int CENTRIFUGE_RPM = 1203; Can you really say that the second bit of code is more "complex"? Same goes for stolen driver signing keys and so…

> Can you really say that the second bit of code is more "complex"? Yes. Complexity in the sense discussed is related to the domain knowledge (including CS knowledge) required for the program to be written and work well. Else even a trivial BS program could be very complex, just sprinkle it with gotos and unnecessarily convoluted code...

[deleted]

Re: The Stuxnet worm may be the most sophisticated software ever written

#298

Post by donald_fump » Fri, May 18, 2018, 3:50 PM UTC

coldtea wrote: post #290

eberkund wrote: post #276

Earlier quoted context omitted.

But do those things really contribute to the sophistication of the software? For example imagine some code written with no understanding of uranium enrichment: const int CENTRIFUGE_RPM = 500; And then some other code written with a deep understanding of uranium enrichment: const int CENTRIFUGE_RPM = 1203; Can you really say that the second bit of code is more "complex"? Same goes for stolen driver signing keys and so…

> Can you really say that the second bit of code is more "complex"? Yes. Complexity in the sense discussed is related to the domain knowledge (including CS knowledge) required for the program to be written and work well. Else even a trivial BS program could be very complex, just sprinkle it with gotos and unnecessarily convoluted code...

agreed. upvoted.

Re: The Stuxnet worm may be the most sophisticated software ever written

#299

Post by blattimwind » Fri, May 18, 2018, 3:51 PM UTC

donald_fump wrote: post #291

lucideer wrote: post #280

Earlier quoted context omitted.

The second piece of code is not more complex, but it is (presumably) a lot more sophisticated. The fact that I had to prefix that with "(presumably)"—i.e. I can't actually tell using my own expertise—is evidence of that.

upvoted thanks

Typically, different words refer to different things. Most often, words considered synonyms actually refer to slightly different things.

Re: The Stuxnet worm may be the most sophisticated software ever written

#300

Post by Lionsion » Fri, May 18, 2018, 3:51 PM UTC

vertexFarm wrote: post #225

ssijak wrote: post #54

And then people make a fuss about Russia "hacking" the election with some dumb Facebook ads which cost less than maxed out Ford Mustang. When on the other hand we have the state-sponsored military grade/purpose viruses used to attack other nations/regions (Flume attacked a large number of targets and countries) and nobody blinks an eye.

That kind of complacent pride is very dangerous. Do you think the facebook ads are the only route taken? And do you think that nobody else is going to refine and develop these methods? The whole world saw an opportunity last November. What we just saw was a public alpha. There will be a beta and a final version of this system. The rewards are too great for every state-level actor to ignore and fail to develop electio…

> What we just saw was a public alpha. There will be a beta and a final version of this system. The rewards are too great for every state-level actor to ignore and fail to develop election manipulation tools using any new technology they can get their hands on. Big data may have doomed democratic process in an irreversible way. The next couple of decades will be telling.

What we saw was the first export version for the West. Authoritarian regimes have been honing many of the same propaganda techniques on their own populations for some time.

See:

https://en.wikipedia.org/wiki/Internet_Research_Agency (they were involved in the 2016 election interference, but they've long been doing similar in Russia and Eastern Europe).

https://en.wikipedia.org/wiki/50_Cent_Party (Chinese equivalent)

I think it's important for Westerns to study the details of these propaganda programs, so we can recognize and respond to the export versions.