Stuxnet Authors Made Several Basic Errors

The complaining is simply that the authors did not hide the payload. Consensus seems to be that it would have bought them an additional few months. However, the virus worked and hiding the payload would have added to its complexity. So, kudos to its authors.

Whatever people say about the theoretically optimal nature of the virus, the fact is that it's practically the only example we have of governmental-level sabotage through black-hat arts.

This is direct action. It isn't script kiddies, it isn't Anonymous, it isn't a random 1337_h4xr pulling off some minor corporate sting. It's the real deal, it's programmers putting their lifeblood into an endeavor that changed the fate of nations.

So whatever flaws that happened to exist don't change the inherent absolute confidence of the maneuver, nor does it change the precision you praise in your post.

But it also means that it can't be perfect. Anything that's so grounded in reality will not be perfect. That's the rules of playing the big games--you can't please everyone, you can't perform to the theoretical maximum that the weak articles that call it "nothing special after all" espouse.

Because that theoretical maximum was out of the reach of stuxnet's writers from the beginning, and they fucking dealt with it. People writing articles now have had nothing to do with crippling Iran's nuclear capability, if even for a moment, and the hogwash in the blogosphere that exists is so much shallow posturing.

Its array of attacks is quite impressive; its attempts at hiding itself, much less so. As Nate Lawson points out (http://rdist.root.org/2011/01/17/stuxnet-is-embarrassing-not...), more advanced techniques for hiding the payload are known. (E.g. instead of storing PAYLOAD, store AES(key, checksum(PAYLOAD) || PAYLOAD), where key is dependent on the hardware - an analyst would then have to bruteforce the key, at least. Bonus points for making the calculation of key expensive, etc.)

It's been called many things. Security people have self-esteem problems, so if they see something being praised, they start convulsing at the sight of this injustice and must immediately blog about it and argue on forums.

As someone who has actually read the code, my opinion is that yes it was special, but not because it was brilliant. It took a lot of resources, and although there was clearly a relatively high degree of skill involved for at least parts of it (finding 0days), there were not really any new techniques. So, I personally find it impressive because of the sheer amount of work that went into it.

I think it is more the principal of it that is noteworthy - if someone tried to make a movie plot about that a few years ago, we would have scoffed.

The reason that it was obviously a nation-state is because the number of people that worked on it, the amount of time they spent on it, and what the group would stand to gain (nothing), would not have been funded by any other entity. I won't go so far as to say it would be impossible to do by someone else, but that is improbable and really would not make much sense at all. Combine that with various external clues, and it is really obvious.

One must be careful about admitting to possessing skills that could be used in the creation of digital "weapons..." But yes, it's not all that uncommon to meet career generalists that have gathered both the breadth and depth of knowledge necessary to write something like Stuxnet.

> However, he also said that there was very little chance that one person could have put the entire attack together alone.

I think to make his case that more than one person was involved, he left some important points off his list: 1) finding four 0-days to exploit and gain escalation of privilege on XP/2000 and Vista/7 machines (how long would it take you to do that?) and 2) Knowing HOW to program the PLCs so that they screw up the centrifuges without being detected.

Sorry if your comment was entirely a joke. Too early; not sure.

No, it is the opposite of hand-wavy. It is a guy getting up on stage and performing an actual technical analysis in front of his peers, rather than posting an anonymous message board post insulting someone they presumably don't know.

How about "not disclosing the manner in which it disrupted the target, thus leaving precisely the same avenue of attack open at multiple sites in the future"? The fact that this is plastered all over the newspaper would, were this a professional intelligence operation, be a major flaw in the operation. So much so that I don't think that's what it is.

The goal was not to destroy centrifuges per se; the goal was to delay the enrichment program. More delay is better. By failing to cloak the payload, Stuxnet's creators ensured they'd get less delay.