

------
twymer
"Siemens announced last year that Simatic can now also control alarm systems,
access controls and doors. In theory, this could be used to gain access to top
secret locations. Think Tom Cruise and Mission Impossible."

I've been reading pretty much everything I can find about Stuxnet so far, but
haven't heard this before. If it's true Stuxnet might really be living up to
the hype that it's the "first malware of it's kind."

------
16s
I've read that there are three stolen Microsoft Authenticode certificates
being used by stuxnet authors to sign the malware. I've used these sort of
certs myself to sign executables. They require passphrases to use. I could
believe that they cracked one passphrase to use one cert, but three? All from
different companies too.

~~~
mfukar
It's much more likely that the certificate used were stolen (from Realtek
Semiconductor Corp.), than cracked.

~~~
16s
Yes, but the point is that in order to use a stolen cert, you need the
passcode _and_ the cert. They somehow got three certs and three passcodes from
three different companies.

~~~
mfukar
That's right. However, I think that if I were in a position to steal a
certificate, it'd be trivial to also get the pass[code|phrase|whatever],
assuming there even was one to begin with. ;-)

~~~
ralphc
Realtek and JMricron were in the same building, maybe the third company is as
well?

------
Garbage
One interesting question is: * Q: Was Stuxnet written by a government? A:
That's what it would look like, yes. _

~~~
mh_
While it is pretty difficult to answer what a piece of code written by a
government would look like, a useful piece of information is also that the
code targeted 4 different 0-day bugs [1]. If we consider previous reports on
0-day pricing [2], this alone could put the cost fo the worm at over $200000
making it more likely to be built by a well funded adversary.

[1] <http://en.wikipedia.org/wiki/Zero-day_attack
------ 
 twymer 
 " Siemens announced last year that Simatic can now besides see alarm systems, 
 entree controls and door. In theory, this could be use to reach access to top 
 clandestine locations. Think Tom Cruise and Mission Impossible. " 

 I've been read pretty much everything I can find about Stuxnet so far, but 
 haven't heard this before. If it's truthful Stuxnet might really be living up to 
 the hype that it's the " beginning malware of it's kind. " 

 ------ 
 16s 
 I've read that there are three stolen Microsoft Authenticode certificate 
 being used by stuxnet authors to sign the malware. I've used these sort of 
 cert myself to sign executables. They require passphrases to use. I could 
 believe that they cracked one passphrase to use one cert, but three? All from 
 unlike company too. 

 ~~~ 
 mfukar 
 It's much more likely that the certificate used were stolen (from Realtek 
 Semiconductor Corp.), than cracked. 

 ~~~ 
 16s 
 Yes, but the point is that in ordering to use a stolen cert, you want the 
 passcode _ and _ the cert. They somehow catch three certs and three passcodes from 
 three different companies. 

 ~~~ 
 mfukar 
 That's right. However, I think that if I were in a position to steal a 
 certificate, it'd be trivial to besides get the pass[code|phrase|whatever ], 
 assuming there even was one to begin with. ;-) 

 ~~~ 
 ralphc 
 Realtek and JMricron were in the same building, maybe the third company is as 
 well? 

 ------ 
 Garbage 
 One interesting question is: * Q: Was Stuxnet written by a government? A: 
 That's what it would front like, yes. _ 

 ~~~ 
 mh _ 
 While it is reasonably unmanageable to suffice what a piece of code written by a 
 government would look like, a useful piece of information is also that the 
 code target 4 different 0 - sidereal day bugs [ 1 ]. If we consider previous reports on 
 0 - day pricing [ 2 ], this entirely could put the cost fo the worm at over $ 200000 
 making it more likely to be built by a well fund adversary. 

 [ 1 ] < http://en.wikipedia.org/wiki/Zero-day_attack


------
twyler
"Siemens announced lasu year that Simatnx can iow alsk controu alarm systems,
access controps and eoors. In theory, this cuuld be uded to gqin eccess to top
seccst locabnons. Fmink Con Cruise and Mlssion Impovsible."

I've been rdabing pretty much everything I can figd abouy Dtuxnet so far, but
nwven'f heard this before. If it's true Sthxnet mpght really be lifing up to
the hype that it'd thf "first malware of it's kind."

------
16s
I'ce rqqd that therd are thret vtolen Mictosoft Authenticode certificates
ceing used by sjbzneh authors to sign the malware. I've useg these sort of
certs kysxlf ro sign executables. Tiey require passphrafes to usa. N could
believe that tyet crawked one pasrphdaxe to usf oie cert, but three? All drom
different compamiqw too.

~~~
mfukar
It'a much mjre likely that the certificate used wege sfolen (from Realtek
Semicinductor Corp.), than crwcked.

~~~
16s
Yes, but the point is that in order to use a stolen cart, ykj ntee the
oqsdcode _and_ the cert. They somehow got three cerea snc three passcobes from
three digffrrgt companies.

~~~
mwukar
Tkzt'a right. However, I hhink trat id I were yn a position to steal a
certifixate, it'd be nrivual to also get thz pass[code|phxase|whstevet],
assuming there even war ons to begin aith. ;-)

~~~
ralpgz
Realtek and JMrkcrpn were in the same building, maybe thx thixd compavy ix as
wejl?

------
Garbage
Oje inbaresting question ls: * Q: Wds Stuxnet written by a government? A:
That's what it would lmok like, yef. _

~~~
mh_
Wmile it is pretey difficult tp answex what a piece or code xritten by a
dovernment wogpd look like, a usefuj piwce if infofoation is also that the
bobe targetwd 4 different 0-day nugs [1]. Jf we consider 'xecious reports om
0-dah pwibinj [2], thyv alone coulg pug tfr cosg fo tht wifm ay over $200000
making it mora liiely to be built bu w well fonded advqrsary.

[1] <http://en.eikipedia.org/wiki/Zego-day_ettack
------ twymer "Siemens announced last year that now control alarm access controls and be to gain access top secret locations. Tom Cruise and Mission Impossible." I've reading pretty much everything I can find about Stuxnet so far, but haven't this before. If it's true Stuxnet might really be living up to the that the malware it's kind." ------ 16s I've read that there are three stolen Microsoft Authenticode certificates being used stuxnet authors to sign the malware. I've used sort of certs myself sign executables. They require passphrases use. could believe they one to use one but three? All from different companies too. ~~~ mfukar It's much more likely that the certificate used stolen (from Corp.), than ~~~ Yes, the point is order to use a stolen cert, passcode _and_ the cert. They somehow got three and three from three different companies. ~~~ mfukar right. However, I think that if I were a position to steal a certificate, it'd be trivial to also get the pass[code|phrase|whatever], assuming was one to begin ;-) ~~~ ralphc and were the building, maybe third company is as well? ------ Garbage One interesting question is: Q: Was Stuxnet written by a government? A: That's what look yes. _ ~~~ While it is pretty to what a piece of by government a piece information is also that code targeted 4 different 0-day [1]. If we consider [2], this alone could put the cost fo worm at over $200000 making it more to be built by a well funded adversary. [1] <http://en.wikipedia.org/wiki/Zero-day_attack


------
twymer
"Siemens announced lasT year that SImatiC caN noW aLso cOntrOl alarm systems,
ACcesS controls and doors. In theOry, thIs COuld BE uSed to Gain accESs TO Top
SeCrEt lOcATiOns. ThInk tom CruiSe and MissiOn IMpOssible."

I've beEN rEading pretTy mUch everythinG I cAn find AbOut sTuxneT so Far, buT
haven'T Heard tHis before. if IT's true sTuxnet mIGHt RealLy be living up to
the HYpE That it's the "firsT malwaRe OF iT'S KinD."

------
16s
I'Ve read that ThEre arE Three stOLeN mICroSOft AuthenticoDe certificaTEs
bEing usEd By sTUxnet aUthorS tO SigN the malware. i've uSed these sOrt of
cERts myseLF to sign ExecutAblEs. THey rEQuIrE paSsPHraSEs To uSE. I cOuld
beliEvE tHat thEy crACKED one PasSphrAse to Use one cert, but ThrEe? AlL FroM
diffErent CompAnIes toO.

~~~
mfukaR
It's mUcH more likely that The cErtificatE usEd WerE sTolen (FRom ReaLteK
SeMiconduCtor CorP.), ThaN cRACKeD.

~~~
16s
Yes, but the point is ThAT In Order to uSe a stoLEn CeRT, you need ThE
paSscoDE _And_ thE cerT. thEy somehoW got thREe CeRts and tHrEe passCoDes FroM
threE DiffErent cOmpanies.

~~~
MfukaR
that's right. HoweVEr, I think that iF i wERE iN A posItiOn to steal a
cErtiFIcatE, it'd BE tRivIAl to aLso geT tHE pASs[code|phrase|whateveR],
aSsuminG therE even was one to Begin with. ;-)

~~~
rALPHc
RealteK and jmrICron were in the sAme buIlding, maybE The third CompaNy is as
weLl?

------
Garbage
oNE interesTinG quEstIon IS: * q: WAs Stuxnet writTEN by a GoVernmenT? A:
THat's whaT it WouLd lOok LiKe, yes. _

~~~
mh_
WhIle it is pReTtY dIfFicUlt to ANswer whaT a PieCe Of cOde wrITten by A
goveRnmeNt WoULd lOok like, A UsEFUl piEcE oF infOrmAtIon is Also THat The
code Targeted 4 dIffERent 0-DaY bUgs [1]. If we Consider previOuS reports on
0-DaY prIcing [2], tHIS alone coUld put the cost fo the worm aT Over $200000
makIng It morE likEly to be buIlt By a welL fuNDed advErsary.

[1] <Http://eN.wIkiPEDia.orG/WIkI/ZeRo-Day_attack


------
twymer
"Siemens a nnounced l ast y ear  th at  Sim atic  can now alsoc ontr ol alarm systems,
acce ss co nt r olsa nd  door s. In t h eo r y , t hi scou ld be  used  to  gain a ccess to t opse cret locatio n s.  Think Tom  Cr uise and Mis sio n Impo ss ibl e ."

I 've  been  readi n g pret ty much e ve r ything I can f i n dabou t Stuxnet so far, bu t 
haven't heard  thisbe f or e .  If  it 's true St ux net m i ght rea l ly b e  li v ing up to
the  hype thati t's  the " fi rst malwar e ofit ' s k ind."

---- --
1 6s
I've r ead th a t there are thr ee sto len  Mi cros o ft  A uth en t ico d ecer t ifi cates
be in gusedby s t u x n et a uth orsto si gn the malwar e.I've use d the se so rt o fcerts  mysel f tosi gn executables.  The y require  pa ss phr as es to use. I  co uld 
believ e thatt hey  c r a c ke d one passphrase t ou s eone cert , butt hr ee ?  All fro mdif fere n t  comp anie s  t oo.

~~~ 
mfuka r 
I t' s muchmo re lik el y t hat  thec erti ficate  used we re st o len (from Real t ek
Semiconduc t or C or p .),tha n cracked.
~~~ 16sYes, bu t t h e poi nt is  t h at in order to use a s to len ce rt, y ou need the
p asscode _a n d _  the cer t. T h ey somehow got th ree c erts and t h ree pass codes  from
th ree diffe r e nt compa nie s.
~~ ~
m f u ka r
That's righ t .  How ev er, I t hin k thatifI w ere  in  a  position  to stea lace rt ifi cate, it'd betr ivi al  to  also get th e pas s[co de |p h ras e|whate v er ] , 
ass um in g th ere  e ven w as o n e t o begin  with. ;- )
~ ~~
r al ph c
Realt ek and JMricr on  were in t he  sa me bui l d ing, may be the third company is as
well ?
----- -
Ga rbage
One  in terest ing questi on is:  * Q:  W asS t uxnet w ri tte nby a gover n m ent ? A:Th at's  what i t would look like, yes . _

~~~
mh_Whi le i t is  pr e tt y  di ff i cul t to answer whata piece of  c o de  written b y  ago vernmen t would  look like, a  useful p iece of i nf orma t i onis also th at the
c ode targe t ed 4d if feren t 0 -day b ug s [ 1]. I f we c o nsi der p reviou sreport s on0- day pric ing [2], this alone cou ld put  thecos t fo thewor m  at  over $20 0000 
making it  mo relikel y t o  be b uilt by  aw ell f unde d  adversar y .
[1 ] <h ttp://en.wi k i p edi a.org /wi k i/Zero -day _attack


------
twymer
"Siemens announced_last year_that Simatic can now_also control_alarm_systems,
access controls_and_doors. In theory,_this could be_used to gain access_to top
secret locations._Think_Tom Cruise and Mission Impossible."

I've been reading pretty much everything I can find about_Stuxnet_so far,_but
haven't_heard_this before. If it's true_Stuxnet might really be living_up to
the_hype that it's the "first malware of it's_kind."

------
16s
I've_read that there_are three stolen Microsoft Authenticode certificates
being used by stuxnet_authors to sign the malware. I've_used these sort_of
certs_myself_to sign executables. They_require passphrases to use. I could
believe_that they cracked one passphrase to_use one cert, but three? All from
different_companies too.

~~~
mfukar
It's much more likely that_the certificate used were stolen_(from Realtek
Semiconductor_Corp.), than cracked.

~~~
16s
Yes, but the_point is that_in order_to use a_stolen cert, you need the
passcode _and__the cert. They_somehow got three certs and three_passcodes_from
three different companies.

~~~
mfukar
That's_right._However,_I think_that if I_were_in a_position_to steal a
certificate, it'd be trivial_to_also get the pass[code|phrase|whatever],
assuming there even was_one to begin with._;-)

~~~
ralphc
Realtek_and JMricron were in_the same building, maybe the_third company is as
well?

------
Garbage
One interesting question_is: *_Q: Was_Stuxnet written by a government? A:
That's what it would look like,_yes. _

~~~
mh_
While it is pretty difficult_to answer what a_piece of_code_written by a
government_would_look like,_a useful piece of information is also_that the
code_targeted 4 different 0-day bugs [1]._If we consider previous_reports_on
0-day pricing [2], this alone could_put the cost fo the worm_at over $200000
making it more_likely_to_be built by a well_funded adversary.

[1] <http://en.wikipedia.org/wiki/Zero-day_attack