Comment by kibitzor | Hacker News Reader

Comment by kibitzor | Hacker News Reader

Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as it’ll either get patched and/or everyone can reverse engineer it to use.

For those not familiar with Stuxnet, it’s a discovered cyber-weapon from 2010 which “reportedly destroyed almost one-fifth of Iran's nuclear centrifuges. ” and “ neither the United States nor Israel has openly admitted responsibility” but likely were the developers [1]

[1-Wikipedia Entry](https://en.wikipedia.org/wiki/Stuxnet)

[2-“Countdown To Zero Day” book if you liked the Wikipedia entry](https://www.audible.com/pd/Countdown-to-Zero-Day-Audiobook/B...)

[3-“Zero Days” movie](https://www.imdb.com/title/tt5446858/)

Important to note that the system(s) it infected were non-trivially air-gapped, so it had to do the entirety of it's infectious work without command and control servers or receiving any additional input. It had to be an entirely autonomous process from infection to propagation to execution.

Pretty amazing to have been pulled off seemingly so successfully.

Wasn’t it actually not as successful as it could have been? I recall something about it spreading to more machines than it should have, which caused it to be detected earlier than it should have.

Playing with definitions of success in this reply, but, yes, I think the industrial control system detection wasn't quite narrow enough.

Very successful in doing what was intended. Less successful in limiting collateral damage; the collateral damage of which was earlier than intended discovery (or discovery at all).

What lessons have they learned, though, so what's out there now, with 10 years more learning, and now AI assistance?

Scary thought. We're all pwnt.

Yes they actually flooded the market with USB drives with Stuxnet. But it was actually too good and started infecting non-target computers. That’s what got a malware researcher to dig in and he saw multiple zero days being used and deduced it was a Mossad and US operation.

Some of the code needed to be digitally signed to execute on target hardware, so being able to get the actual digital certs meant that Stuxnet could not be a hacker group and could only be some national agency or "Bond villain."

"you can only use a cyber weapon once at full potential, as it’ll either get patched and/or everyone can reverse engineer it to use"

This is why I jokingly always suggested to people the safest public charger to use was the one the NSA brings to DEFCON/Shmoocon/etc. The NSA ain't burning an exploit on a bunch of nerds. ;)

Where did the binaries come from? Did Iran release them?

Are you referring to the government of Iran,

or the (possibly Iranian) sec people they handed the flash drives from the parking lot to?

From what I recall reading, stuxnet itself was found in the wild. Even though it was certainly created for a specific target. That’s how security researchers were able to study it fairly quickly. So the binaries were already out there to pull from other infected systems.

Can confirm. I was working in Azerbaijan with people from Iran at the time and had it infect my pendrive and work PC. No anti-virus picked it up at the time.

Thanks,providing readable code for everyone is inherently a thing of pride.

This is amazingly awesome. Very intriguing and what a great idea in the first place. One of the most important pieces of modern software IMO.

Reply on news.ycombinator.com