Male C. Pig a.k.a. Svinopolist (piggymouse) wrote,
Male C. Pig a.k.a. Svinopolist
piggymouse

Stuxnet

Интереснейшее чтение про историю червя Stuxnet от пользователя malaya_zemlya:

Из чтения по ссылкам особенно доставляет FAQ от F-Secure:

Q: Was Stuxnet written by a government?
A: That's what it would look like, yes.

Q: How could governments get something so complex right?
A: Trick question. Nice. Next question.

Q: Was it Israel?
A: We don't know.

Q: Was it Egypt? Saudi Arabia? USA?
A: We don't know.

Q: Was the target Iran?
A: We don't know.

Q: Is it true that there's are biblical references inside Stuxnet?
A: There is a reference to "Myrtus" (which is a myrtle plant). However, this is not "hidden" in the code. It's an artifact left inside the program when it was compiled. Basically this tells us where the author stored the source code in his system. The specific path in Stuxnet is: \myrtus\src\objfre_w2k_x86\i386\guava.pdb. The authors probably did not want us to know they called their project "Myrtus", but thanks to this artifact we do. We have seen such artifacts in other malware as well. The Operation Aurora attack against Google was named Aurora after this path was found inside one of the binaries: \Aurora_Src\AuroraVNC\Avc\Release\AVC.pdb.

Q: So how exactly is "Myrtus" a biblical reference?
A: Uhh… we don't know, really.

Q: Could it mean something else?
A: Yeah: it could mean "My RTUs", not "Myrtus". RTU is an abbreviation for Remote Terminal Units, used in factory systems.

Q: How does Stuxnet know it has already infected a machine?
A: It sets a Registry key with a value "19790509" as an infection marker.

Q: What's the significance of "19790509"?
A: It's a date. 9th of May, 1979.

Q: What happened on 9th of May, 1979?
A: Maybe it's the birthday of the author? Then again, on that date a Jewish-Iranian businessman called Habib Elghanian was executed in Iran. He was accused to be spying for Israel.

Q: Oh.
A: Yeah.

Via ygam, спасибо!

Tags: link, military, technology
Subscribe

  • Here take my picture

    Elegy V: His Picture by Dr John Donne Here take my picture; though I bid farewell Thine, in my heart, where my soul dwells, shall dwell. ’Tis…

  • Pea Brush

    Pea Brush by Robert Frost I walked down alone Sunday after church To the place where John has been cutting trees To see for myself about the…

  • Two poems by e.e.cummings

    Summer Silence Eruptive lightnings flutter to and fro Above the heights of immemorial hills; Thirst-stricken air, dumb-throated, in its woe Limply…

  • Post a new comment

    Error

    Anonymous comments are disabled in this journal

    default userpic

    Your IP address will be recorded 

  • 4 comments