Stuxnet Questions and Answers(f-secure.com)
f-secure.com
Stuxnet Questions and Answers
http://www.f-secure.com/weblog/archives/00002040.html
14 comments
"Q: How could governments get something so complex right?
A: Trick question. Nice. Next question."
That one caught me off guard.
That one caught me off guard.
I could see a lot of nefarious individuals learning from this and using it to cause tragedies for short-term gain (i.e. shorting a stock). It does seem quite stupid to open up the door on something that could cause so much harm.
the possibility of it sinking BP's Deepwater Rig was interesting, not something I had considered before reading it in the Q&A
Without Autorun enabled, how does code get executed on a usb drive?
Even when autorun is disabled, Windows will parse through the autorun.inf file. This should have been patched with KB967715.
U3 enabled devices have been known to override the default settings in order to emulate CD-ROM drives.
Double clicking the flash-drive icon can also force execution of binaries, but I am unsure of how that works and if it is related to the user's autorun settings or not.
U3 enabled devices have been known to override the default settings in order to emulate CD-ROM drives.
Double clicking the flash-drive icon can also force execution of binaries, but I am unsure of how that works and if it is related to the user's autorun settings or not.
http://www.microsoft.com/technet/security/bulletin/ms10-046....
"The vulnerability could allow remote code execution if the icon of a specially crafted shortcut is displayed."
"The vulnerability could allow remote code execution if the icon of a specially crafted shortcut is displayed."
One interesting question is:
*
Q: Was Stuxnet written by a government?
A: That's what it would look like, yes.
While it is pretty difficult to answer what a piece of code written by a government would look like, a useful piece of information is also that the code targeted 4 different 0-day bugs [1].
If we consider previous reports on 0-day pricing [2], this alone could put the cost fo the worm at over $200000 making it more likely to be built by a well funded adversary.
[1] http://en.wikipedia.org/wiki/Zero-day_attack [2] http://weis2007.econinfosec.org/papers/29.pdf
[1] http://en.wikipedia.org/wiki/Zero-day_attack [2] http://weis2007.econinfosec.org/papers/29.pdf
A talented individual or small team, government funded or not, is going to be able to research vulnerabilities on their own.
It really doesn't matter if they bought the 0days or researched them themselves - either way they either spent the cash or gave up the opportunity to earn the cash from them, which is equivalent. They still put ~$200,000 worth of resources into the worm.
Agreed, but I think the best evidence of large sponsorship is in that factory system recognition and parameter modification code. We don't really understand the sophistication until it actually chooses to execute, but access to those kind of specifications would require some fairly extensive research resources, someone that an individual or small team would have trouble getting alone.
yes, but a talented individual would probably sell those vulnerabilities since they worth so much, rather then use them for some obscure, probably not money earning, goal.
That's just moving one layer of indirection. If vulnerabilities are worth money, presumably so they can be exploited, then why isn't it possible for someone to be motivated to use vulnerabilities and also having the talent to discover them?
You're making the assumption that a government would not pay for the development and exploitation of those vulnerabilities, which is de facto false considering the current "cyberdefense" capabilities of developed countries.
If it's indeed created by Israeli Intelligence, then at least R&D costs will be close to nothing.
Israeli military has mandatory service. 18-21 years old programmers/hackers work day and night almost for free.
I think there's some very experienced, very talented people working on this. Security is one area where I believe that the older you are and the more hours you've clocked and exploits you've thoroughly understood, the better you are.
Our defense budget is 7% of our GDP, which is the 5th highest rate in the world (according to wiki). I would hardly call that free. Also, there is a shortage of tech talent here and the salaries are quite high. So there are also hidden costs with the military getting people to work for "free".
First it's 8.5% of GDP in 2009, but in absolute numbers it's only $14.3B (including US aid, which has to be spent in US).
This peanuts for being a regional superpower.
About half of the budget goes to salaries of officers, permanent servicemen and civilian contractors.
The danger there is the "common thinking" that this puts it squarely in the realm of governments.
However, at such a price point you're still well within the remit of organised gangs; they, for example, will spend a fortune on viruses and other malware - it's big big business.
However, at such a price point you're still well within the remit of organised gangs; they, for example, will spend a fortune on viruses and other malware - it's big big business.
Wait, since when have governments been better at writing code than small groups of talented amateurs? Have I fallen through a portal into mirror-universe HN?
One of the arguments for it being a government is the unusual size and complexity of the code. A large piece of code speaks against a small group. It also speaks against a group with an ethos of producing something simple and elegant, which talented amateurs would be likely to feel.
This is the stuff of movies, but do you think its very wise to write this kind of software for a government? Perhaps if you can somehow stay anonymous..
Eh? The implication/speculation is that a government wanted to create and spread a worm.
Yes but would you like to be the programmer that wrote it? You would also be a witness. Again, movie stuff.. :)
You're assuming that a bunch of suits pulled some hackers out of their parent's basement and told them to write a virus.
I can only comment on the US Government's NSA, which has thousands of highly trained and highly intellectual programmers already under their employ. These are people that do their job to protect and assist in the affairs of the government. Probably already under highly classified labels. For some, it is just another job assignment.
However, I am also speculating. The truth: No one capable of telling the truth knows.
I can only comment on the US Government's NSA, which has thousands of highly trained and highly intellectual programmers already under their employ. These are people that do their job to protect and assist in the affairs of the government. Probably already under highly classified labels. For some, it is just another job assignment.
However, I am also speculating. The truth: No one capable of telling the truth knows.
This reads like a section from a sci-fi novel. Once more reality is catching up with cyberpunk.
I'd love to know what it's supposed to do when it reaches its target. Surely the creator would have had to have some sort of blueprints for the target system to successfully set it up to create more than collateral damage.
I'd love to know what it's supposed to do when it reaches its target. Surely the creator would have had to have some sort of blueprints for the target system to successfully set it up to create more than collateral damage.
I'm very curious about what it's supposed to do as well. I work with SCADA systems, and I can confirm that it would be difficult/impossible to tell without knowing exactly what system it's targeting. SCADA systems are often controlled by writing to "points," which typically have numeric addresses. So point 35 might control the valve position in one installation, but it could control something totally different in another. You'd need to know the layout of the targeted system to know what parameters are controlled by what points.
I'm under the (mistaken?) impression it uses the SCADA system to actually modify some of the low-level PLC library code. If so, I'd be looking for code likely to be used (by the actual plant PLC program) to stabilize a very high speed centrifuge (servo routines maybe), and introduce slight instabilities, or even better, excite a resonance.
"Hey, the VFDs are programmed to skip through this frequency band during the accel ramp to 25k RPM, but every once in a while they hickup and then the bearings rub. What's up with that?"
"Hey, the VFDs are programmed to skip through this frequency band during the accel ramp to 25k RPM, but every once in a while they hickup and then the bearings rub. What's up with that?"
Q: What does it do with Simatic?
A: It modifies commands sent from the Windows computer to the PLC. One running on the PLC, it looks for a specific factory environment. If this is not found, it does nothing.
So it seems that there is one factory layout Stuxnet is looking for. I.e. it will know what point 35 is.
So it seems that there is one factory layout Stuxnet is looking for. I.e. it will know what point 35 is.
is it possible to determine which factory environment you're in? maybe it just tries the same combination in each and every one environment it gets to?
Considering the size of the file, (and the fact I have not examined StuxNet), I'd assume that there is a good chance it has enough logic to determine which factory it is in by pure brute force.
If the main fan control gives a fairly standard reading, it shouldn't be too difficult figuring out what the particular factory it has infiltrated has wired that point to, for example.
Also, I haven't heard any definitives on what kind of factory this is targeting. I do know that there aren't many companies that develop and design high tech industrial facilities. Despite StuxNet having infected thousands (millions) of personal PCs, it really is only looking for maybe a few dozen or so in the world that are of the right type. Combine that with a low number of factory designs, and it could very well have a pre-determined database of how its intended targets are wired.
If the main fan control gives a fairly standard reading, it shouldn't be too difficult figuring out what the particular factory it has infiltrated has wired that point to, for example.
Also, I haven't heard any definitives on what kind of factory this is targeting. I do know that there aren't many companies that develop and design high tech industrial facilities. Despite StuxNet having infected thousands (millions) of personal PCs, it really is only looking for maybe a few dozen or so in the world that are of the right type. Combine that with a low number of factory designs, and it could very well have a pre-determined database of how its intended targets are wired.
But messing with various points at different facilities in the same way can still be catastrophic.
Very true. A simple "set everything to zero" approach would probably bring any facility to a halt (if not worse).
Take care. While this does have a lot of clear information about Stuxnet it also has lots of idle speculation and "wink wink" stuff.
Ok, actually I do retract that. It's an excellent overview - I just didn't like the small pieces of speculation they did drop in without marking them as such ;)
It said the registry key Stuxnet plants to indicate whether a system is already infected has the value 19790509. Then it said an Iranian Jewish business man was executed on that date for spying. Also the home directory where the virus was originally compiled was called Myrtus. Which may contain another clue...
I'm not really buying this. You're making a lot of assumptions. That Iran is the target, that the number is a date, that the date refers to that particular event, etc.
The link between the word "Myrtus" and the Old Testament seems really strained. It's the name of a plant. It features prominently in Greek mythology -- maybe the Greeks did it?
The link between the word "Myrtus" and the Old Testament seems really strained. It's the name of a plant. It features prominently in Greek mythology -- maybe the Greeks did it?
I don't think the link between old testament and myrtus is strained.
1) Eshter's born name is Hadassah, which means myrtle (http://en.wikipedia.org/wiki/Esther#Origin_and_meaning)
2) When Eshter asked the king if Jews can kill their enemies, king granted the permission (http://www.biblegateway.com/passage/?search=esther%208:11-8:...)
1) Eshter's born name is Hadassah, which means myrtle (http://en.wikipedia.org/wiki/Esther#Origin_and_meaning)
2) When Eshter asked the king if Jews can kill their enemies, king granted the permission (http://www.biblegateway.com/passage/?search=esther%208:11-8:...)
Esther was also married to a Persian King.
I also vote for a plant, as the second mentioned name is Guava and there is
"The Chilean Guava (Ugni molinae, also called Myrtus ugni or Eugenia ugni)"
see: http://www.strangewonderfulthings.com/206.htm
"The Chilean Guava (Ugni molinae, also called Myrtus ugni or Eugenia ugni)"
see: http://www.strangewonderfulthings.com/206.htm
He doesn't seem to make any assumptions to me. He states the known facts about it, that's all.
Chances are that if you pick a date at random, there will be some heinous crime that the Iranian regime has committed on that day. As to myrtus. Even if we assume that whoever did this knew that myrtus=hadas, very few Israelis who aren't biblical scholars would associate the name Hadas with queen Esther.
I would say that if this is the best we have, then it's pretty certain it's not the Israelis who did this.
I would say that if this is the best we have, then it's pretty certain it's not the Israelis who did this.
Clues can be faked too.
Hm, this is no fun scavenger hunt for hackers. It's serious.
On the other hand, if you solve the puzzle, maybe you can sell your story to Hollywood.
On the other hand, if you solve the puzzle, maybe you can sell your story to Hollywood.
Btw couldn't 19790509 also be 5th Sep 1979 instead of 9th May?
To the best of my knowledge, no. One of the reasons for the ISO date standard being YYYY-MM-DD is that there is no country in which the interpretation of a date given that way is at all ambiguous.
There are countries with DD-MM-YYYY or MM-DD-YYYY, so you really do have to put the year first to avoid ambiguity. However the 79 in 1979 cannot be a month or a day.
There are countries with DD-MM-YYYY or MM-DD-YYYY, so you really do have to put the year first to avoid ambiguity. However the 79 in 1979 cannot be a month or a day.
I've read that there are three stolen Microsoft Authenticode certificates being used by stuxnet authors to sign the malware. I've used these sort of certs myself to sign executables. They require passphrases to use. I could believe that they cracked one passphrase to use one cert, but three? All from different companies too.
It's much more likely that the certificate used were stolen (from Realtek Semiconductor Corp.), than cracked.
Yes, but the point is that in order to use a stolen cert, you need the passcode and the cert. They somehow got three certs and three passcodes from three different companies.
Sometimes companies embed the passcode in the build script to automate the build process. Having to type in the passcode every time to build a release can become a chore.
The F-Secure Q&A is relatively free from speculation. That's unusual for this particular event.
"Siemens announced last year that Simatic can now also control alarm systems, access controls and doors. In theory, this could be used to gain access to top secret locations. Think Tom Cruise and Mission Impossible."
I've been reading pretty much everything I can find about Stuxnet so far, but haven't heard this before. If it's true Stuxnet might really be living up to the hype that it's the "first malware of it's kind."
I've been reading pretty much everything I can find about Stuxnet so far, but haven't heard this before. If it's true Stuxnet might really be living up to the hype that it's the "first malware of it's kind."
This is quite possibly the best Q&A on Stuxnet I have seen. Kudos to F-Secure for not overhyping it.
Other than "jacking in" and other fluff Stuxnet does pretty much exactly the kinds of things that CyberPunk Sci-fi described a decade ago.
I flippin love living in the future.