Stuxnet was embarrassing, not amazing (2011)

https://rdist.root.org/2011/01/17/stuxnet-is-embarrassing-not-amazing/

by MrXOR • 7 years ago

121 50 7 years ago

rdist.root.org

ahartmetz• 7 years ago

Stuxnet does not use all advanced malware techniques the author can think of

Why use (and give away) any more capabilities than required to do the job?

pizza234• 7 years ago

In fact, there's no need at all. Some of the most complex malway (viruses, to be specific) every written (Zmist, MetaPHOR), which the post author would "appreciate", never had any wide diffusion; Stuxnet accomplished its task.

All in all, the post author just wanted some attention.

rafa1981• 7 years ago

Exactly. If it did the job why showing the enemy (and the world) all your cards, so they can learn your most advanced tricks? It's better to keep some advanced techniques for the next target than to expose them with no need.

saagarjha• 7 years ago

I mean, why obfuscate at all? Their malware did its job; after that what does it matter what happens to it? Is not adding additional obfuscation "run-of-the mill" or "amateur" as the author puts it?

petjuh• 7 years ago

But Stuxnet did use obfuscation. The last payload was decrypted by concatenating two environment variables on the host and Symantec never managed to decrypt that one. Did author not read the Stuxnet report?

zokier• 7 years ago

One thing that I've grown to understand is that the difference between enthusiast and professional is not the quality of goods they produce, but the economy of producing the goods. I feel like that is applicable here.

If we want another example of high-profile security incident that was more embarrassing than impressive, Wannacry fits the bill.

mettamage• 7 years ago

My English is too limited to be a 100% sure about the following:

"economy of producing the goods"

What does this mean? The amount of time it takes to produce another extra good?

E.g.

Enthusiast: 1 good per 5 hours -- quality level 85%

Professional: 1 good per 0.5 hours -- quality level 80%

Or something else?

huffmsa5• 7 years ago

Correct. The professional produces goods which are actually used in real life conditions, with real life delivery dates.

The enthusiast produces goods which look pretty, but often don't work correctly, or need a lot more hours of work to surpass the professional.

icegreentea2• 7 years ago

I think it's a bit more subtle than that. Professionals are able to create output that more precisely solve the problem at hand. That means that they will often create output that does less.

In the context of Stuxnet, the professional identified that the problem at hand was to shutdown the Iranian nuclear enrichment facility. They ended up with a piece of code that executed that, but was not maximally obfuscated, because more obfuscation does not solve the problem at hand.

praptak• 7 years ago

Enthusiast: 4h for the coolest component C, 1h for unnecessary but fun stuff. The rest of components: A, B & D glued from duct tape in 1h.

Quality of C: excellent, quality of the final product: nice demo, but falls apart when exposed to wind.

Professional: 2h for C, 1h for A,B,D each. 1h for testing. Quality of A,B,C and D: good enough. Quality of the final product: gets the job done, withstands winds up to the speeds required in the specs, plus some margin.

chrisweekly• 7 years ago

"economy" here meaning efficiency (repeatability, time cost to produce)

upofadown• 7 years ago

It's hard to be good when you work in complete secrecy. A typical malware creator can talk to anyone in the world. If they talk to white hats they just pretend to be on the side of good. The job of a government spook is much harder because of that lack of communication. You are always on the outside looking in...

manigandham• 7 years ago

The Wired article on Stuxnet remains one of the best long-form stories I've ever read: https://www.wired.com/2011/07/how-digital-detectives-deciphe...

The criticism here seems to be mostly academic about not using the most advanced obfuscation while completely ignoring the actual objective and just how many obstacles were overcome.

The mission used several 0-days and stolen signing keys to get into a secret foreign air-gapped nuclear arms laboratory under a deadline and ruin the machinery while it kept reporting everything was fine. I dont see how this is anything short of amazing.

kqr2• 7 years ago

Kim Zetter's article evolved into the book Countdown to Zero Day

https://smile.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/...

emilga• 7 years ago

Here's a good documentary about Stuxnet as well: https://www.youtube.com/watch?v=TGGxqjpka-U

abbadadda• 7 years ago

Yeah this definitely read to me like a click bait title and article. The shortfalls seem trivial in the grand scheme of what was accomplished.

anaisbetts• 7 years ago

Yep, I worked in Windows Servicing at the time it came out, there were at least 4 separate completely unknown-at-the-time exploits in Stuxnet. They most likely stole the signing certs by dropping USB keys in an office park in Taiwan, all of the stolen certs were from companies which shared a particular parking lot

pharrington• 7 years ago

Yeah, with a headline like that, I was expecting an article about the international implications regarding why/how something like Stuxnet is even created and deployed in the first place. The technical merits of the operation are the absolute last thing to be embarrassed about.

marcoseliziario• 7 years ago

I don't understand.

Do you really think that a military operation that avoided nuclear proliferation without killing a single human life or causing environmental damage is something to be ashamed of?

trash88• 7 years ago

Is anyone actually claiming it was a nuclear arms laboratory?

CapitalistCartr• 7 years ago

This is juvenile Monday-morning quarterbacking. Stuxnet was the first (as far as we know). It was revolutionary at the time.

Of course its authors didn't know how agressive antivirus researchers would be, agressive largely because of the fascinating complexity of the code. Almost all malware gets a cursory glance and thrown in the bitbucket after processing.

The first one of anything is always the crudest. Getting away with industrial, state-sponsored cyber-sabotage is a huge step.

blotter_paper• 7 years ago

The first one of anything is always the crudest. Getting away with industrial, state-sponsored cyber-sabotage is a huge step.

I know the claim is disputed, but if the CIA did cause the Trans-Siberian pipeline to explode in the '80s then that would count as prior art. Even if true it was nowhere near as complicated as Stuxnet, of course.

huffmsa5• 7 years ago

"But this isn't academically good code."

As others have said, the only real metric of whether or not something is good is if it works in live production.

eternalban• 7 years ago

No, that's a metric for "something is working".

Ease of maintaining, extending, or fixing bugs in the same software are not informed by that metric.

chris_wot• 7 years ago

Except in this case, where it was a one-shot, very specific objective. Once this thing was released, it could not have been easily updated.

huffmsa5• 7 years ago

It is though. Bad products eventually fail under their expected operating conditions. That means you didn't actually make something production ready.

It didn't meet the specified requirements. That's a bad product.

If I have a car motor which runs, but throws a piston 20k miles before it should, I didn't build to the production spec.

gzer0• 7 years ago

I will suggest another alternative.

The authors weighed the risk of not being successful vs the risk of someone analyzing the worm. The latter was inevitable but the former would have been disastrous. Those protections would have only slowed down malware analysts. If this was normal malware that would be the goal, exist for as long as possible without being detected. ‘Normal’ malware has a high tolerance for failure.

In this case the goal appears to be ‘break some sensitive equipment before a particular deadline hits’, with a razor thin margin for error. But your points are not lost, good post.

allworknoplay• 7 years ago

Did you really just copy/paste the top reply from the article, without attribution or comment?

voldacar• 7 years ago

I've seen bits and pieces of disassembled stuxnet code around the web, does anyone here know where I could get my hands on the original binaries?

onetimemanytime• 7 years ago

>Stuxnet was embarrassing, not amazing (2011)

Stuxnet worked. Deal with it. Of course, for obvious reasons, it would be traced back to US/Israel and not to a kid in his mom's basement.

heelix• 7 years ago

While some hiding is required to get past the virus scanners... Once it trashed the centrifuges, there is huge value in letting the target know they were pwned. There had to be a huge internal "who's the internal spy/saboteur" hunt that planted it - even if it was accidental - and the weapon grade target of the micro controller to let them know it was no accident.

DuskStar• 7 years ago

I'd think a witch hunt is exactly what you'd want if there were no internal saboteurs, though. Getting the enemy to waste time, effort and loyalty like that would be the perfect cherry on top of the physical disruption.

heavenlyblue• 7 years ago

There are so many system configuration parameters you can collect to encrypt the payload. If you did so, it should not be too hard to enumerate all of them.

Moreover, the virtual machine-based code obfuscation is being regularly pwned by software cracking teams so I can imagine that obfuscation would only postpone the publication of the tool’s code for a week max.

Vaslo• 7 years ago

They literally found a way to trash an enemy’s weapons of mass destruction equipment without bombing cities and hurting people, but somehow that’s an “embarrassment.”

casefields• 7 years ago

Attacking infrastructure is an act of war. In 2011 the Pentagon took this stance on cyber warfare:

“For the first time, the Pentagon has decided that cyber attacks constitute an act of war, reports The Wall Street Journal. The U.S. military drafted a classified 30-page document concluding that the U.S. may respond to cyber attacks from foreign countries with traditional military force, citing the growing threat of hackers on U.S. infrastructure such as subways, electrical grids or nuclear reactors.”

https://www.theatlantic.com/technology/archive/2011/05/penta...

MaupitiBlue• 7 years ago

It delayed nuclear proliferation without harming a single soldier or civilian. If that’s an act of war, then I guess I’m a war monger.

paulie_a• 7 years ago

Yet it worked.

Just like the NSA Cisco exploit chain. According to armchair programmers it was ugly. But it worked it could take over every Cisco router. it doesn't have to always be pretty if it gets the job done.

dblotsky• 7 years ago

We often forget, but even the world’s top professionals get tired, cut corners, and make mistakes.

But also, what substantial gains would have come from adopting the techniques in this article?

nathanvanfleet• 7 years ago

This reeks of "I could have done it better" but if they accomplished it with what they had what can you really say? Nice to know there were myriad of other "better" ways to do this. But it's not an embarrassment.

tobbe2064• 7 years ago

The book recommendation at the end, Surreptitious Software, seems interesting. Does anyone know if it is still relevant, or there are newer more relevant books on the market with the same goal?

hn_throwaway_99• 7 years ago

Random question for HN: How to articles like this get upvoted so much? Virtually all the top comments talk about how this is an amateurish, Monday-morning quarterbacking effort. Is it just spam upvoters?

oxide• 7 years ago

No, it's just the people who vote and the people who comment are very different.

Bendingo• 7 years ago

It's OK if USA/Israel does it, otherwise it's an act of war. More hypocrisy from the "good guys".

arpa• 7 years ago

What did Bulgarian teenagers do in the early 90s? all links to the story are dead.

Stuxnet was embarrassing, not amazing (2011)

Related Stories