Comment by vinayms | Hacker News Reader

Comment by vinayms | Hacker News Reader

I am just your average software dev with zero knowledge of malware creation, speculating here, and might come across as a fool.

The author sensationalizes the effort of the creators, painting a Holywoodesque scenario where they break into every possible software company to steal keys to misrepresent the software, going undetected by every possible security company etc. Since this is a Quora post, I can live with him playing to the gallery.

Given the amount of speculation of involvement of US and Israeli intelligence agencies, and the task this worm was assigned, the real effort might have been just about writing a USB worm that identifies specific machines and handing the USB-0 to a double agent (I stopped watching Homeland after season 5 and am rusty with the jargon). The rest of it would have been simply asking all the associated software and hardware companies, politely, to cooperate.

If any of this is true, stuxnet is anything but sophisticated. Its just lots and lots of specific API calls.

That brings up the question: what is sophistication as applied to software?

That is a huge oversimplification. Do yourself a favor and read this http://www.symantec.com/content/en/us/enterprise/media/secur... or just the 'Executive Summary' if you don't want to read the whole thing

You should read "Countdown to zero day"[0]. Some of the measures that were taken exceeded what anyone in Hollywood could ever imagine.

[0]: https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp...

> The rest of it is all about asking the associated companies, politely, to cooperate.

What keeps this cooperation secret? It would only take one weak link at any one of those companies to reveal -- accidentally or otherwise -- that they were coerced into providing their signing keys. As soon as that got out, speculation runs amok: Are all products from said company compromised? This would be ruinous to a company, so no one in charge would agree to that without something significant -- which would be even harder to hide from the public -- in return. Then, who asked for the key and why? Could that be traced back to the (presumably) agency in question? That weak link was weak once, there's nothing to assume that he/she won't be weak again, etc., etc.

I'm not sure that it would be ruinous. Isn't RSA still trusted? People have a tendency to overlook or even defend broken protocol when it's "the good guys"

“Compromised” in the sense of that company’s trustworthiness, not in the cryptographic sense.

All this speculation is wilder than what I am willing to get into. But I think the fact that the 'leader of the free world' and his buddy will wreck you beyond your worst nightmare if you go rogue should be enough motivation to not to.

They certainly wouldn't be calling lots and lots of API's, as that would likely trigger some antivirus software or at least leave traces in system logs.

The sophistication of this software is that it did all this undetected.

"x86 is a high-level language": https://blog.erratasec.com/2015/03/x86-is-high-level-languag... / https://news.ycombinator.com/item?id=9264195

Everything's an API at the end of the day.

There was an article on here recently about the practical effects of the TLS 1.3 drafts, and how they broke proxies. I can't find it. It was talking about how the proxies choked because so many variable wire bits in TLS 1.2 stayed static for so long they rusted in place in proprietary implementations, and the proxies crashed once the values changed (despite this being a concrete protocol violation). This situation reminds me of that.

I would love to read this if you come across it.

The sophistication is to do all this while remaining completelt undetected in a highly secure environment. Iran didn't find Stuxnet, it was stumbled over by Kaspersky Lab.

Just addressing the last thing you said, I think sophistication has to do with the level of knowledge required to implement. Whether that means knowledge politely asked for or through other means has implications for the difficulty of implementation but perhaps not sophistication of the software.

Reply on news.ycombinator.com