Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Stuxnet worm may be the most sophisticated software ever written

quora.com

Post reply on HN
Print view View original

321–330 of 507 posts

Re: The Stuxnet worm may be the most sophisticated software ever written

#321

Post by bleke »

trisimix wrote: post #193

So what if I run my top secret weapons grade uranium producing plant on a sanely secure operating system, like linux.

You can run whatever system (L4 with formal verification and written in super secure language...) as long as there no redundant checks you are already doomed from start. Stuxnet is nice example why critical system must have at least:

* Somebody periodically in person checking what happening and cross-checking results with operator

* Have alternative monitoring system, even amateur arduino system with rs-422/485 network and independent sensors, can become impenetrable wall for Stuxnet type worms.

Re: The Stuxnet worm may be the most sophisticated software ever written

#322

Post by stochastic_monk »

gadders wrote: post #4
stochastic_monk wrote: post #2

And to think that a combination of decades of diplomatic work and years of one of the most sophisticated cyberattacks were entirely thrown away by capricious, corrupt politicians.

The JCPOA?

Exactly.

Re: The Stuxnet worm may be the most sophisticated software ever written

#323

Post by gboudrias »

donald_fump wrote: post #303
coldtea wrote: post #292

Earlier quoted context omitted.

The sophistication of a piece of code is not merely an attribute of its complexity. Else a program with tons of accidental complexity (a badly written program by an intern) would be equally good with a program with huge essential complexity (a 10 line program that takes tons of domain and/or programming knowledge to write)...

youre right. upvoted

There was a way to make your point politely and be taken seriously. This was not the way.

Re: The Stuxnet worm may be the most sophisticated software ever written

#324

Post by 27182818284 »

eberkund wrote: post #276
11thEarlOfMar wrote: post #266

Earlier quoted context omitted.

In my view, the sophistication is implied by the breadth of expertise required to put the whole thing together. Google Search and the OS landscape are for sure broad and sophisticated. However, their development was accomplished by computer scientists. In order for stuxnet to be effective, it was necessary to employ expertise in: - Uranium enrichment methods and processes - Capital equipment control systems and their…

But do those things really contribute to the sophistication of the software? For example imagine some code written with no understanding of uranium enrichment: const int CENTRIFUGE_RPM = 500; And then some other code written with a deep understanding of uranium enrichment: const int CENTRIFUGE_RPM = 1203; Can you really say that the second bit of code is more "complex"? Same goes for stolen driver signing keys and so…

> const int CENTRIFUGE_RPM = 1203;

As the linked article points out, it wasn't just raising the speed, it was raising it in a subtle enough way to ruin the process while other experts routinely monitored the system

Re: The Stuxnet worm may be the most sophisticated software ever written

#325

Post by marnett »

Lambdanaut wrote: post #312
donald_fump wrote: post #270

Earlier quoted context omitted.

i think for something to be sophisticated we are looking at how complex it is. this worm does nothing new in that regard (taking advantage of 0days, hiding, covering tracks etc.) it is no more sophisticated than a regular worm. quora is a fucking joke.

I think for something to be sophisticated we are looking at the metric that differentiates fine wines and cheeses from plebeian non-fine wine and cheeses. If we can just capture that essence, we will wield the power of sophistication in our hands.

Oh, in that case it's just placebo, price, and primed expectations.

Re: The Stuxnet worm may be the most sophisticated software ever written

#326

Post by chadash »

perlgeek wrote: post #236

I'd argue that Google Search is much more sophisticated than Stuxnet. Windows is much more sophisticated. Linux is more sophisticated than Stuxnet. The list goes on. We tend to ignore the sophistication of things we are familiar with, and hype those that surprise. But that's not a fair measure of anything.

I say this without having seen the code base for either, but I'd be surprised if Stuxnet's code base was anywhere near as large or with as many moving pieces. Still, it's incredible to imagine the knowledge base that needed to go into Stuxnet to get things off the ground.

Google Search was originally written by two guys in graduate school and has been refined and rewritten many times since then. I'm sure the code base is complicated and undoubtedly some of the greatest minds in software engineering and computer science have used it. The same goes for Linux, which was written by one guy and grew from there.

On the other hand, Stuxnet isn't something that a few brilliant graduate students could have put together. To even get this thing off the ground, you need people with backgrounds in nuclear physics and/or chemistry, operating systems specialists, people with knowledge of industrial equipment, networking experts, an espionage network and competent management to pull it all together. Plus, you need to keep the whole project secret. Oh, and funding. Lot's of funding.

I'd call that sophistication in that you can't even think about starting to tackle this problem if you're just two guys in a garage.

Re: The Stuxnet worm may be the most sophisticated software ever written

#327

Post by chx »

superflyguy wrote: post #227
indescions_2018 wrote: post #113

Stuxnet changed history. Any "game of chicken" style equilibria is broken if the probability a nuclear actor's command and control drops below 100%. If there is even a 1% chance that when a Big Red Button is pushed the missiles fail to launch the game becomes unwinnable. Simulations of imperfect information in dynamic brinkmanship where both players are known to have advanced cyber capabilities results in a single dr…

That's all very well but theory and maths aren't too relevant when the man behind the button is an illiterate cretin.

The launch is a two person process and while in theory the second person is only there to verify the identity of the President this has never been put to the test and there truly is no way to tell what would Mattis do in a situation like this.

Re: The Stuxnet worm may be the most sophisticated software ever written

#328

Post by jcoffland »

Lambdanaut wrote: post #312
donald_fump wrote: post #270

Earlier quoted context omitted.

i think for something to be sophisticated we are looking at how complex it is. this worm does nothing new in that regard (taking advantage of 0days, hiding, covering tracks etc.) it is no more sophisticated than a regular worm. quora is a fucking joke.

I think for something to be sophisticated we are looking at the metric that differentiates fine wines and cheeses from plebeian non-fine wine and cheeses. If we can just capture that essence, we will wield the power of sophistication in our hands.

You mean how much money is charged?

Re: The Stuxnet worm may be the most sophisticated software ever written

#329

Post by Splines »

phyller wrote: post #306
11thEarlOfMar wrote: post #266

Earlier quoted context omitted.

In my view, the sophistication is implied by the breadth of expertise required to put the whole thing together. Google Search and the OS landscape are for sure broad and sophisticated. However, their development was accomplished by computer scientists. In order for stuxnet to be effective, it was necessary to employ expertise in: - Uranium enrichment methods and processes - Capital equipment control systems and their…

Wouldn't the people who know the physical things just write requirements for those farther on down the chain? The threat analysts say, we need to destroy Iran's ability to make nuclear weapons. The nuclear weapons specialists say, the part where we can best do that is by somehow breaking their centrifuges. The centrifuge technician they call up says, "well, x RPMs will really ruin those things. And it would be hard t…

The key part is that you have to bring all of those all together. In hindsight it might be straightforward but if you had a blank slate, how would you approach the problem of "stop Iran from refining Uranium"?

Re: The Stuxnet worm may be the most sophisticated software ever written

#330

Post by blattimwind »

michaelt wrote: post #148
LeonM wrote: post #134

Earlier quoted context omitted.

That's not how it works. You need the private key to sign the drivers. This is not a file that developers of those companies have access too. These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel. So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet th…

IDK, pre-windows-10 didn't you just need a ~$200 [1] code signing certificate? Do people usually buy HSMs to store those? [1] https://www.sslshopper.com/microsoft-authenticode-certificat...

> Do people usually buy HSMs to store those?

At the time Stuxnet was around, no, not really.

Post reply on HN