The Stuxnet worm may be the most sophisticated software ever written

In order for stuxnet to be effective, it was necessary to employ expertise in:

- Uranium enrichment methods and processes

- Capital equipment control systems and their development environments

- Theory of operation of centrifuge machines

- Corporate espionage of some sort

- Organizational management skills that can pull all that together

- and deep understanding of the operating systems referenced above

Windows has to cover a huge area and a lot of "known" unknowns and be able to recover (somewhat) reliably. Stuff breaks, you get weird error messages, that driver for your Wi-Fi never really worked right, but at the end of the day you have a computer that works pretty well, and that's quite remarkable. The same is of course true of Linux and other operating systems.

Stuxnet is a hyper-specialized piece of software (malware) that cannot fail or it loses it's purpose. The authors clearly knew they had to have multiple fallbacks for every step of the process, but I find it very impressive that it reached it's end goal successfully and without being discovered. A lot of software (including malware) break because of regular software bugs, environments that differ from the expected, interference by the user, the list goes on. For Stuxnet to have avoided all of those, that is quite sophisticated.

It's the most sophisticated piece of malware, that's for sure (at least counting the ones we know of).

But calling it the most sophisticated piece of software is too big of a stretch.

That said, other answers to this question include what we would traditionally consider as contestants (like Linux kernel), it just happens that the submitter decided to submit this specific answer. I don't know was this the top answer before it exploded here, but it sure is now.

Google Search was originally written by two guys in graduate school and has been refined and rewritten many times since then. I'm sure the code base is complicated and undoubtedly some of the greatest minds in software engineering and computer science have used it. The same goes for Linux, which was written by one guy and grew from there.

On the other hand, Stuxnet isn't something that a few brilliant graduate students could have put together. To even get this thing off the ground, you need people with backgrounds in nuclear physics and/or chemistry, operating systems specialists, people with knowledge of industrial equipment, networking experts, an espionage network and competent management to pull it all together. Plus, you need to keep the whole project secret. Oh, and funding. Lot's of funding.

I'd call that sophistication in that you can't even think about starting to tackle this problem if you're just two guys in a garage.

It’s sort of like comparing a skyscraper to an iPhone. Sure the skyscraper requires a lot more manual labor, but the iPhone is more sophisticated. It took ~80 years from when the Empire State Building was built to when the iPhone was built. The iPhone is more sophisticated but it’d still take more time and resources to make another Empire State Building.

Sorry if that’s a poor analogy- it’s the best I got right now.

Stuxnet installed itself without cooperation, hid itself perfectly and still completed its objective flawlessly against a hostile user base.

For example - it might take years of research to develop a formula for calculating something, but the final code can be very simple one-liner.

the responsible party(ies) did not access to resources , man power or infra at google or even at an enterprise scale.

Not to be rude, but it really doesn't sound like you read the article.

Especially when you claim that Windows is more sophisticated. Stuxnet had to get past all of Windows security, and did so by using not just one or two or three never-before-known flaws, but a bunch of them.

What I see here is that the word "sophistication" is misunderstood by a lot of people.

Stuxnet took control of multiple layers of complex production environments. There are numerous "0day" kits in the code.

It's not like an effort like a search engine or most other organized software projects, because there are logistical dependencies of the worm itself in those exploits. If it was a US-israel effort (I think it almost definitely was, but who cares) then consider how much discipline and effort it takes to keep TWO govt groups of hackers coordinated enough to keep those exploits fresh, whilst simultaneously building a dependable worm.

Another thing, a lot of the actual machinery and shit isn't very well known, and this is worth mentioning because it's not like you can go spin up an emulator for this shit to test out your massively devastating two-country worm on.

Stuxnet of course made the best of this by using lots of different exploits in different situations, giving it the biggest attack surface it could, that's low hanging fruit anyways.

I think stuxnet doesn't impress people because maybe they think it's just a bunch of bugs in old shitty software, but it's so much more than that. It's bugs in software that only a few hundred or maybe a few thousand people have ever seen, much less pentested, on machinery that's rare and sometimes even unique to the location, the infrastructure of the place is based on rough intel at best, and oh by the way, your spy hackers need to coordinate with this other group on the other side of the planet.

Start brainstorming how you'd pull it off, and I think it'll become more imrpressive as you do.

Personally, I think it's the most incredible display of skill and prowess in malware thus far. The years I've spent disassembling, reversing, tracing, filtering, researching... A lifetime of hacking doesn't even knock the dust off of a project like that.

I wrote the quoted article about Stuxnet. And I've helped write multiple operating systems.

Your argument not an argument. It's just a random assertion with no technical knowledge of either Stuxnet or how to write an operating system.

Stuxnet specifically took advantage of Windows's lack of sophistication in order to replicate.

It's never been at 100% anyway. Read the book "Command and Control" if you are not convinced.

Why does that 1% make such a big difference?

But now, everyone's wiser, so the game just got more complex.

https://www.forbes.com/sites/jamesconca/2018/03/16/russia-ha...

The same was also reported by MI5, Europol and of course within Ukraine.

In response, the US introduced an integer overflow bug that was uptime dependent, and took something like 6 months to hit. The bug simultaneously cranked up the pumps and closed all the valves in the network.

It was known that the Soviet economy would crash in under a year without the ability to cheaply move natural gas, so they couldn’t test long enough to find this.

A year or so later, the DoD’s seismographs detected the largest non-nuclear explosion in human history.

The main impact wasn’t the explosion or the short-term economic damage. The main impact was that the USSR stopped trusting stolen software, which set them way further back, economically and militarily.

Arguably, that ~one line of code was infinitely more sophisticated than stuxnet.

I find it very satisfying to understand a problem so well, up to the point you can find a simple and elegant solution to it. It makes the solution easier to reason about with other team members, and easier for the team to maintain it later. I see this as making your domain expertise available as a framework for the other team members.

This is my idea of sophistication in the software development world.

1. Get the code to work 2. Clean up the code 3. Simplify the code

1 is self explanatory. 2 involves removing any logical redundancy, separating and cleaning the logic into methods, etc. 3 involves simplifying logic and logical mechanisms.

Most developers only do step 1 and maybe step 2. Step 3 is where beauty comes in.

If I could organize my thoughts around this concept, it would probably make a pretty good article. I don't know who the source is but a good quote goes something like this, "real genius isn't solving the complex, it's solving the complex in a simple way."

It would be impressive if it was the work of a teenager but it's not.

Whilst I enjoyed the multiple viewpoints it provides (some claim that Stuxnet was actually quite sloppily written, depending on numerous factors), it happened to be one of those books which wrote 100 pages worth of information in 400 pages instead and dragged every little point on. YMMV.

For those not aware of Mistfall: typical viruses simply append their code to the target. To avoid detection, polymorphism was introduced: viruses generate permutations of decryption logic for the actual static but encrypted virus body. The next step was metamorphism: the virus body itself got permuted. Mistfall was one step further: it disassembled the host, merged in its own permuted body and rebuilt the host. Here is an article by the author himself [1]. This was in 2000.

In general, before hacking and cybercrime became a commercial activity, there was a lively virus writing scene, where highly skilled people played the cat and mouse game with anti virus producers, created magazines with the sources of their creations and wrote articles.

Too bad that z0mbie disappeared. Sometimes when news about elite Russian hackers hits the news I wonder if it's him.

[1]: http://z0mbie.daemonlab.org/autorev.txt

These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel.

So it's highly unlikely that the stuxnet developers had possession of the key. I'd bet that they somehow had access to the HSM, to have it sign the driver for them.

Companies of this size are audited regularly, so access to the HSM is expected to be strictly controlled.

So yes, it is a pretty secure location, and a highly guarded secret. The fact that they pulled it of to break into not one, but two of those secrets is extremely impressive on it's own.

If you manufacture hardware and distribute drivers you are an even bigger target than a telco.

Personally I doubt that retrieving this key involved required some act of super ninja skills espionage. I suspect somebody high up in the US government simply picked up the phone and called somebody high up in the Taiwanese government. The reality is Taiwan's security at the end of the day is wholly dependent upon US defense. There are no other options, there are no other cards in their hand. They absolutely need the US military to secure the continued existence of their nation.

This is the lesson of Stuxnet: "private" actors aren't. At the end of the day the US government has demonstrated again and again that it can compel cooperation from virtually every technology firm in the "free world." It's not a card to be played lightly but it's absolutely there. Thanks to Snowden we know the NSA regularly compromises Cisco telecom equipment created for export [1][2] and that the US government is working closely with all the major tech firms[3].

And this is why the US does not want China exporting Chinese phones, electronics, telcom kit, chips and social software. There's absolutely no problem when "private companies" in the US, Korea, Japan and Taiwan export this equipment and technology because these companies are squarely under the thumb of the US. Now that China is getting in on the game everybody is freaking the fuck out precisely because they understand perfectly what it means for "private companies" in China to have a significant chunk of the market.

Of course the Chinese also understand exactly what's going on here and this is why they've established the Great Firewall and why they're absolutely determined to homegrow all their technology needs. Right now China imports an absolutely extraordinary amount of chips and it is probably their greatest security weakness [4].

So this is what it comes down to: every large corporation that matters is likely a phone call and/or secret warrant away from literally giving its private keys to some government actor, likely the US or China. Any data stored by these corporate systems should be considered readable and writable by the government. Any service secured by these corporate systems should be considered accessible and ultimately under the control of these governments. These corporations will not risk either their continued existence or the possibility of fat government contracts in order to protect their customers from these governments. Individuals who depend upon these corporations are therefore completely at the mercy of these government actors.

All of this is a long way of saying that security of digital assets cannot be outsourced.

[1] https://arstechnica.com/information-technology/2016/08/cisco...

[2] https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...

[3] https://en.wikipedia.org/wiki/PRISM_(surveillance_program)

[4] http://nationalinterest.org/feature/how-china-will-benefit-a...

>They must have spent years devising ways to get in, slowly gathering info about their target, figuring out a way to achieve the assigned goal of screwing things up without getting detected.

I'd speculate that given who the intended targets were (Iran, North Korea) and who would have an interest in disrupting their enrichment operations (Israel, US), and given the level of intelligence gathering activity that both of these nation can (and ostensibly do) engage in, that the team tasked with creating this virus had plenty of information to go on from the start.

Centrifuge models with firmware revision, network topologies, deployed server configuration, etc were likely known in advance.

https://arstechnica.com/information-technology/2012/06/flame...

This isn't stealing a cert or burning four zero-days. This is dropping a zero-day cryptographical attack, which hasn't been reverse engineered yet.

[0]: https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp...

What keeps this cooperation secret? It would only take one weak link at any one of those companies to reveal -- accidentally or otherwise -- that they were coerced into providing their signing keys. As soon as that got out, speculation runs amok: Are all products from said company compromised? This would be ruinous to a company, so no one in charge would agree to that without something significant -- which would be even harder to hide from the public -- in return. Then, who asked for the key and why? Could that be traced back to the (presumably) agency in question? That weak link was weak once, there's nothing to assume that he/she won't be weak again, etc., etc.

The sophistication of this software is that it did all this undetected.

It’s not really a secret anymore.

I find that misconception worse!

The simplest approach though is if you're running Chrome, and I exploit Chrome, I'm now running as Chrome and could persist in memory at least until you shut down.

Stuxnet was discovered because it accidentally spread too far, and ended up on a malware analysts desk.

There was a targeted supplier, an upstream vendor as the insertion point, but it spread outside of that chain.

Also, read this: https://www.theguardian.com/world/2012/jan/11/iran-nuclear-c...

So, when China or Russia are building windows exploits, they just demand Microsoft hand over source?

Also, the idea that “locked down” Linux would do any better than windows is ridiculous. The Linux codebase is enormous and complex and full of bugs. At least if you’d said some type of high security microkernel, you could put forward forward some logical arguments.

On the other hand, if you or your organization is the victim of a targeted hack, it makes no difference what OS you're running. Any sufficiently motivated and skilled attacker will eventually find a way to exploit it.

As long as new software continues to be released, there will always be bugs. There is no security panacea.

But it is widely believed that Stuxnet was initiated from the US, and Microsoft is a US company, so...

* Somebody periodically in person checking what happening and cross-checking results with operator

* Have alternative monitoring system, even amateur arduino system with rs-422/485 network and independent sensors, can become impenetrable wall for Stuxnet type worms.

Stuxnet is considerably more sophisticated and technologically more brazen, but won’t get the same reporting. But it’s also worth it to consider whether the lack of awareness/awe over Stuxnet vis a vis Russian election tampering is simply due to technology illiteracy, or whether media is not considering the notability of the means, just the effect of the ends.

What we just saw was a public alpha. There will be a beta and a final version of this system. The rewards are too great for every state-level actor to ignore and fail to develop election manipulation tools using any new technology they can get their hands on. Big data may have doomed democratic process in an irreversible way. The next couple of decades will be telling.

Like Watergate, but by a foreign actor.