The Incredible Stuxnet Cyberweapon Explained by a Retired Windows Engineer

[@midnightterrors5909]

Dave, my work deals with a large amount of "Air gapped" systems. This video does an amazing job at educating even the lay man on how closed networks can be infiltrated. Your video is already being passed around and we are going to have a quick huddle on your video as well as the social engineering side of gaining access. As always, its a pleasure to learn from you.

[@davidmartensson273]

The strength of the air gap is only as string as the glue you use to block of any ports or connection slots.

[@Julkkis1980]

Air Gap and onion architecture. But unfortunstely people are really stupid

[@ACCPhil]

Me too. The thing is that, while access to the secure network is highly restricted and (for people) subject to security clearance, most of the development and testing of software that runs there happens in less secure environments. And while there is a small set of people who can make changes in the secure network, there is a far larger set of people who are producing code and configuration stuff which will be applied in there. Although I still think the more likely risk is incompetence rather than malice.

[@markmuir7338]

StuxNet was the turning point for me: until then I was a firm believer in “Don’t attribute to malice what can be explained by incompetence”. After that I switched to “Where there’s a will, there’s a way”.

[@johnclawed]

Incompetence is still at the root of it, because some management type at Microsoft ordered "autorun" to be included in Win95. It was one of many incredibly stupid high-level design decisions that give Windows and Microsoft the reputation they have.

[@cgungryfcdjs1352]

incompetence still gives a lot more way

[@dashippo]

Both can and are true at the same time

[@ralphybean]

Thanks Dave. Most videos on this subject are 45min plus. Yours is clear and precise

[@675Danny]

​@DavesGarageplease put a link to your other channel. Thanks

[@enricodeanna9518]

@@675Danny what? He has another channel?

[@fonkbadonk5370]

I've been a PLC dev for ~20 years, especially working with Siemens S7-300 PLCs. What struck me even almost a bit more than the PC-side of the worm is, that you need absolute full VERY detailed knowledge about how the PLC's internal adressing and code was done. You can't just "search" for frequency converters - you need to know exactly at which bit what exact data is expected/delivered, as there are no standards towards that at all. It's all the dev's choice, and there are no "discovery services". PLCs are, internally, ancient technology. Considering that even in "normal" private companies, these infos are heavily guarded, it's almost unbelievable that anyone unauthorized could get their hands on SUCH a deep level of internal stuff. They basically MUST have had an actual dev in their pockets - one that also managed to sneak this data out.

[@TheFrewah]

That’s horrible! I guess most programming is done using some kind of script language and maybe some compiled code that essentially run these scripts? One would hope someone makes some kind of stub code to help developers

[@ReaKtionary]

This is only mostly true, I think I work mostly with Allen Bradley / Rockwell / Logix500,5000. But a handful of system 7s are around here too. While the PLC code Is absolutely up to the developer, many of our machines are from the same handful of manufacturers and while they do many different things, they follow conventions. Once you know who built the equipment I believe you can brute force the addresses and get lucky. Even still, the VSDs themselves speed references and parameters are all at the same addresses between models.

[@ReaKtionary]

@@TheFrewah IEC standards define languages which run PLC code though the names of instructions are up to the manufacturer. Most code, I'd say, is either Ladder Diagram, Function Block, or less commonly Structured Text (like Pascal). You can indeed find examples in every language on how to do whatever it is you need your machine to do. The manufacturers themselves have documentation on how to perform a number of tasks and even (Rockwell, at least) Add-on-Instructions where all you need to do is plug in input addresses and output locations and the logic is already written. (Not a super huge fan, myself but it does speed up implementation and time is money)

[@TheFrewah]

@@ReaKtionary That’s nice. I sometimes find things that you can connect to a Raspberry Pi but not any kind of documentation.

[@WOFFY-qc9te]

Stuxnet was frighteningly impressive and well executed however Pandoras box is open so we await round two.

[@rjy8960]

I was working with PLC systems at the time that Stuxnet was exposed and have always held it as a pinnacle of software engineering in its purpose and execution. It still amazes me to the is day.

[@nickissoooobeast]

@fmfbrestel Stuxnet source code is widely used as a model for worms that copycat and get sold on the darkweb. Also, about a decade ago Stuxnet tried (and failed) to infiltrate North Korea's uranium enrichment program.

[@tomhanksact]

@fmfbrestel What are they building, Nitro Zeus?

[@ian562ADF52E]

Golden robot, liblzma backdoor, eternal blue/romance/champion Bruh nation states are impressive lol

[@Misanthrope84]

​@fmfbrestel I'll give you a hint: their latest creation was the beeper operation in Lebanon.

[@6thdayblue59]

Hi Dave, I came across this and started watching. Frankly after a minute I didn’t have a clue what you were talking about, so I looked at the comments. Clearly you are fantastically brilliant man, and all I saw were positive comments and respect. So from someone who once owned a ZX Sprectrum, (yes I’m that old) I think you are so well respected and admired for your content and clearly you are the man to follow for computer stuff. Peace be with you Dave x

[@thomaspripley]

For those interested in going deeper, I highly recommend Kim Zetter's book "Countdown to Zero Day." I read it in 2014, it's gripping and full of extreme details! Dave did a great job covering it in short format though!

[@cgungryfcdjs1352]

@AKFishnFool lol

[@MartinPiper6502]

Many years ago I used to work for a company selling "enterprise security" software that would help to block USB devices, stop them from exposing storage/network/etc. It would only approve certain devices and also provided encrypted device storage. We noticed some USB devices (like cameras or thumb drives) would, when first plugged in, present themselves as a CD device with autorun and something to install their drivers. Then when plugged in again they would appear as their proper camera/storage device.

[@johnclawed]

So it had 2 states, but where was the state recorded? I would assume the PC recognized that thumb drive, because the opposite seems impossible.

[@jamesbond_007]

Love the "The Friendly Giant" reference at the end! At least some PBS stations aired this show during the late 1960s; the theme tune is highly memorable, so it instantly identifies the show in question.

[@millwrightrick1]

Every kid in Canada during the 60s got the Friendly Giant reference.

[@willmcbride4435]

I was delighted to see the title of this video. Stuxnet is super interesting and I love your style, Dave. I expected a great presentation and I was not at all disappointed. At the time, I worked in industrial controls with Siemens PLCs and drives. Super impressive from an engineering perspective.

[@ObrtASCENTvl.ZlatanOmerovic]

I've been following the subject of Stuxnet closely since mid-2016 when the "Zero Days" documentary was released, and some time after VICE did a short documentary on it too. I read the W32.Stuxnet Dossier by Symantec Security Response Team at least 5 times so far, and I'm still amazed at the level of sophistication and attack vectors used to achieve their goals - for each attack vector: the infamous 4 Zero Days for the Win32, the low-level obfuscation overloads like memcpy, and the hacks around Siemens PLC APIs. Stuxnet was Trinity/Gadget test of the 21st century. Even Michael Hayden (former CIA & NSA director) put it that way.

[@cgungryfcdjs1352]

yeah vice is for retards

[@alexdi1367]

Love the summary (and I think you could absolutely blow your channel up with more on this topic), but from you, I'd be more interested in a technical deep dive.

[@DaveChurchill]

Wasn't expecting a Friendly Giant reference! Thanks for the great video Dave

[@lens1736]

Don't know if you are a grandfather or not, but if you tell bedtime stories, me at 68 YO would even like to listen in. Love your ability to tell a story. I've watched several videos on Stuxnet, but you succinctly bring it to life. thanks. Keep telling stories.

[@raygunsforronnie847]

"Mommy! Grandpa is telling scary stories again!"

[@BlackHoleForge]

Storytime with Dave is awesome.

[@markgriz]

He should make a childrens book version

[@tinad8561]

“Careful engineering, quality assurance, and… legal input.” Isn’t that like the construction contractor’s triangle (fast, cheap, correct), you can only pick two?

[@CarlTSpeak]

It was found because the driver of the latest and greatest version was blue screening machines so I think you can drop the 'correct' part for that one. 😊

[@tuvoca825]

From "better, faster, cheaper" in the space industry. Or "bueno, bonito, barrato" (good, pretty, cheap) from the days of merchants in old world Spain.

[@cyclops74air11]

That's why you're talking about state actors and not contractors well pointed out and that's the reason

[@photorealm]

I wonder how many people have made an amazing achievement like Stuxnet but can't tell a single person how cool it was and they will never be acknowledged for their accomplishment.

[@20chocsaday]

Many of the people who worked on the deciphering programme went to their graves with sealed lips. They kept the secret that they had been among the thousands who worked at Blechley Park from their spouses for at least 30 years. Being able to read Morse Code was something that could trip them up.

[@sulrich70]

I am sure they got medals for their work

[@JiffyBeene]

8. Well 9 if you include [REDACTED]

[@BitTwisted1]

I remember doing a siemens PLC and Scada training course a few years before this all kicked off. When covering the passwords the 'unofficial advice' was leave them all as default because you'll never get it working otherwise...

[@grottyboots]

I took some Siemens courses on how to program Step 7 PLC for use in CNCs. This was before Stuxnet. I was suprised that we were told, by actual Siemens employees, to never change the WinNT login name/password. I forget those credentials now, but i do recall the password was a whole 8 characters long. I wonder if Siemens has changed that password and that no-changee policy. Cheers!

[@oliverw.douglas285]

That was a very thorough overview of Stuxnet. I had no idea the level of damage, so-called 'isolated' systems could 'weather'. Considering how far technology has evolved since then, it begs the question is anything truly safe, from a determine foe?

[@paultapping9510]

​@msromike123 so in real, measurable terms, no. It does not matter if the theoretical work has been finished if none of it has or will be implemented.

[@mikeygduv]

I have seen many articles and videos on this subject. This is by far one of the best, concise, informative and entertaining wrapped into one!

[@Julkkis1980]

That was a correct and precise description of Stuxnet that i thought i woild never hear. Great Job. Greetings from an IT security professial that used to Works on nuclear industry

[@randallgreen4084]

Morning Dave, more great content, as always.

[@NetBandit70]

GOOD MORNING SIR

[@mattfojtik7130]

Could you talk more about your time working on autorun? Were the developers aware at the time of the huge security risk that feature could pose? Was it a tradeoff between usability for regular users and security, or was security an afterthought?

[@DaedalusRaistlin]

I believe Windows 95 was the first to have autorun, and security was basically not much of a concern - there were no admin users, regular users could do everything. And needed to, with the heavy support for DOS. Usability I would think was a primary concern at the time, people had to get used to a whole new desktop paradigm coming from Windows 3. Having things automatically start up when you put the CD in makes the computer a lot more user friendly, instead of having to navigate to My Computer, the appropriate drive, and then find whatever program starts up the menu interface. A lot of CDs of the time had menu interfaces to be a friendlier way of installing or launching apps. Some were custom apps, others launched your web browser to a file on the CD. I would think security just wasn't as important considering users had full system access already.

[@DaedalusRaistlin]

@singleproppilot Sure, that's why power users learned to hold shift to stop the autorun. They were trying to make it more accessible than DOS though, which pretty much isn't.

[@larrydvorshockii5935]

As a computer idiot, I still found this fascinating & interesting. Could understand the general gist of the story, but the delving into the technical sides is WAY above my paygrade!!!!! But I still enjoyed it, thanx Dave.

[@gdauch]

This is why I am subbed to this channel. Dave does THE BEST job of 'explaining it to me like I am a 5 year old' and yet still keeping it technical enough to be largely accurate, if not still absolutely accurate, to the real event or action(s) taking place.

[@andersjjensen]

If you're capable of understanding ANYTHING Dave says you're not a computer idiot.

[@funkyfp]

Enjoyed listening to the talk and made me remember a question I had asked my professor in class many years ago regarding whether it could be possible for malicious intended code that when writing data would (days of floppy drives) use an incorrect voltage level of the drive to store data initially but in time ensure the data would be lost (the malicious intent). The question was asked as a curiosity and was rejected by the professor, but listening to you talk of Stuxnet made me realize abuses of motors and other hardware is very real to the unsuspecting.

[@Kyzyl_Tuva]

Great topic Dave. Stuxnet was a brilliant piece of work and you did a great job of explaining it at a high level.

[@Frog3136]

Another master-class video on complex topics - thank you for doing these types of videos. I've sent them to my team consinstantly to learn.

[@captainsensible298]

I've heard that an updated version of this code was spread to the Fukushima Daiichi plant showing the plant operators normal system parameters while the reactor was driven critical.

[@instantkevlar4763]

Thank you. Very interesting. Had read a lot of news about it but had not bothered to look into the technical details.

[@erikl1003]

I like that you leave me a little extra time at the end of the video so I can get my phone back out and SMASH THAT LIKE BUTTON at my leisure.

[@BRBTechTalk]

I am a long time computer user that started with computers in the late '90s I remember hearing about this malware. I agree it was a well thought out attack and I too kind of admire the thought and work that went into the malicious software.

[@williammurdock3028]

I think my favorite Windows feature that shocked even the LAN admins was Remote Shutdown. Had the need to remotely shutdown servers in other geo areas, worked great.

[@S1eepers]

at my company we dont need stuxnet to ruin the production. we just need the idiots i work with to be near a winCC computer

[@ohmbug10]

An owner of a company I worked at gave me an order to design the machines to be more idiot proof after one of them hurt himself in a ridiculous manner. (He put his foot on his moving machine to tie his boot string. It would have cut his foot in half but we had installed fiber drive gears because of other idiots disabling limit switches and crashing the machine.) I told the boss it would help if he quit hiring bigger idiots.

[@Solnfected]

lol

[@davidwilliams1383]

There's a nut loose on the keyboard....

[@chrissimpson1183]

Any system can be hacked.

[@gregholloway2656]

Great video Dave. The book written about this incident is fascinating. I spent my whole career in automation, so it was an eye opener.

[@garybouwman2157]

Well crafted and delivered talk Dave. Even though I've heard most of it before, you managed to bring some information to the table I had not heard before. Really enjoyed the story.

[@johnandmegh]

Great historical review here - if you end up doing a follow up on the topic at any point, it’d be interesting to know what the internal MS conversations looked like at the time with features like autorun - was there a standard way of doing security risk assessment, how did folks make the judgment calls of low risk vs. informed risk vs. too dangerous to release, etc.

[@20chocsaday]

That's a point. You don't need to run it. But it with want to know what is on the CD. That means it must Open the files. Execute on Open.

[@JohnBabisDJC]

Your videos always educate me . Thank you.

[@nicholasdacek5182]

Dave what always fascinated me about stuxnet - PLC code is custom on every project. Somebody had to either get their hands on the Siemens code, decide which tag was the motor speed reference, and write to it. Or, re-write the PLC code online. Not the easiest thing to do. Siemens just makes it complicated as is.

[@tonywilson4713]

HEY DAVE - Control system engineer here with 30+ years of experience. FYI - I have used several versions of Step 7 over the years as well as several other major systems like Allen Bradley Control Logix, ABB 800xA, Schneider. I'm not a great fan of Step 7 although it does several things superbly. I prefer Allen Bradley Control Logix. I have also done robotics with Fanuc, Kuka and Adept. I also have a lot of experience with motor controls. Like everyone else in the IT industry you actually need to find one of us and have sit down and get your terminology correct and also get some of the details of this particular subject correct. When Stuxnet hit it was a big deal for the company I worked for because we had just done a major upgrade to an off shore oil & gas rig using Siemens Software. FIRST and this is important for this story. What you have called a "frequency converter" IS NOT a frequency converter. If anything its a POWER INVERTER, because its inverts AC into DC and then back into AC. Starting at the basics - the lump of electronics that switches and controls a motor is called a DRIVE because it drives the motor. it doesn't matter what type of control is being used that lump is called a drive. We do use some more specific terms like soft starter, but *in general if it drives a motor then its a drive.* Drives that can vary the speed of a motor are called VSDs (Variable Speed Drives). In the past people did call them Variable Frequency Drives (VFDs) or Variable Voltage Variable Frequency Drives (VVVFs or Triple VFs). But I have never heard either a sales rep or engineer EVER call a motor drive a frequency converter. On the subject of Uranium Enrichment. In 2005 (~5 years) before this happened I was working at the ERA Ranger Uranium Mine. As part of working there we had to do a full ANSTO induction. A normal mine stie induction is 1-2 hours. The ANSTO induction was 2 days and we covered the entire Uranium cycle from in the ground to back in the ground including a fairly detailed description of Uranium enrichment. In 2005 there was a lot of friction regarding what Iran was up to so we asked what Iran was up to. *The give away that they had a weapons program was the number of centrifuges.* In general: Fuel grade for power stations needs around 5 to 8,000 centrifuges. For military fuel grade like that used in submarines needs around 20,000 centrifuges. For weapons grade Uranium you need 40,000 centrifuges or more and we knew Iran had 55,000. Understanding motors and motor controls is how we knew they had 55,000 centrifuges. In GENERAL and there's a lot of variation in motors but basically: Normal 3phase induction motors generally operate up to 1500 rpm at 50Hz High 3phase speed induction motors operate up to 3,000 rpm at 100Hz or higher. The permanent magnet servo motors used in robotics and CNC machining centres operate up to 6,000 rpm and maybe more depending on the motor size. The SPINDLE MOTORS used in CNC machining spindles (hence why they are called spindle motors) can (depending on the size of the motor) go in excess of 30,000 rpm. Most VSDs can outputs more than the standard 50Hz and can generally go to 200Hz although I have used ones capable of 400Hz. Spindle motors go much faster and that's why they need specialised drives with much higher frequencies. There are also some very specialised ultra high speed motors that can go in excess of 100,000rpm. But those are very small motors with rare earth permanent magnets and most often used in the computer industry in disk drives. VERY IMPORTANT - There is nothing classified or spectacularly special about spindle motors or the VSDs they use other than they go a lot faster than normal motors. 1,000s are sold every month across the world as part of the machine tool industry. The thing is Iran DID NOT (in 2005) have a machine tool industry so when they bought enough motors and VSDs for 55,000 gas centrifuges people who understood Uranium enrichment knew EXACTLY what they were up to. As to what Stuxnet did inside the S7 PLCs we were advised on that because of the system our company had done. Luckily there was nothing in what we did that Stuxnet targeted. Our project was a SCADA system not a PLC system. So it was in another part of the Siemens Suite of software packages. What it did was very interesting. The S7 like most modern PLCs is a multitasking operating system. We tend to write our systems as a main cyclic task with a number of timed tasks that operate via interrupts. We do that because things like PID close loop functions work best when the operate at a consistent time interval. So we tend to put those in separate tasks running off timed interrupts. What Stuxnet did was not only insert an additional task that took control of the commands to the VSDs but that inserted task DID NOT appear in the task list. So the engineers could NOT FIND IT and could not understand why their code was not working. If you want to discuss this further I'd like to do a podcast with you. You know how this thing ran around the world and on all that stuff your 100% correct. I know what it did inside the PLCs. I also know how it found the specific laptop or desk top it was looking for. The most disturbing thing about Stuxnet wasn't what it did but it laid out the basic blueprint for what can be done to everyone's basic infrastructure. Basically everyone now has a blueprint from which to develop their own cyber weapons. Its sort of like inventing the machine gun in 1750 and then leaving them all over the place for other people to copy or derive new machine guns from. Sooner or later I expect Stuxnet clones and derived descendants to appear and do some real damage.

[@ronblack7870]

your rant mostly repeats what he said . and no standard frequency is 60 hz not 50 hz. this is a us based sight. and everyone here calls them VFD not VSD so you stupid bitching about nomeclature adds nothing to his explanation . oh and some reactors use unenriched uranium like candu reactors in canada. they don't need enrichment.

[@Username8281]

I love this conversation. keep it going

[@oldtechnology]

Yes.😂

[@WOFFY-qc9te]

@@ronblack7870 Dave gave an excellent description of Stuxnet events however Tonywilson (without malice) added to the discourse some pertinent informed facts to which Dave ( being a professional engineer and mature adult ) would not take offence. Just to be clear I found Tony's contribution / flex aligned well with my understanding of SCADA MCS operations most interesting especially as the early (now obsolete) gaseous diffusion centrifuges were prototyped at a plant familiar to me. To describe Tony's comment as a rant is unfair bordering on ignorance especially as your opening salvo was in error because the majority of countries operate a grid at 50 Hz (or if you are in Japan 50 & 60 Hz ? ). You are also misinformed about the nomenclature. VFDs provide a high performance with precise control over motor (prime mover) speed and torque so better process control. VSDs have greater speed control but may not offer the same level of performance consistency as VFDs. VSD came before VFDs as they were of mechanical origin, a clue is in the name. I will mention in response to Tony's statement " But I have never heard either a sales rep or engineer EVER call a motor drive a frequency converter." in the 60's computer system used dynomotors as frequency converters and in Japan they are used to correct 50 to 60 Hz, aircraft use them to generated 400hz but they are electromechanical fixed frequency so Tony's is technically correct and not as old as I. Further ; Dave's channel is not limited to the United States and since he is after votes and likes may be irritated that you have the impertinence to say it is US a based sight (your spelling) implying his content is country specific. Do not propose to tell Tony, I or other seasoned system and electrical engineers what terminology we choose to use to describe motor control systems when your comment has clearly shown your are not qualified to do so. Your may think (incorrectly) a comment attacking Tony has in some way come to the Dave's defence but If you must, please proffer a cogent argument without being rude.

[@tonywilson4713]

@@ronblack7870 Typical American you think the entire world is 60HZ when in fact MOST is 50Hz. And anyone who knows anything about the nuclear industry knows about the CANDU reactors. So take you're attitude and take a hike.

[@johnnie135]

I remember hearing and learning everything that I could about this attack. I remember I was sitting in first class on an airplane and I was talking to one of the Canadian major banks chief of security and he had no idea about this kind of attack. I know they are not running centrifuges, but this got on my radar and I'm just a day trader. I wonder if the guy is still head of security? This is the best detailed explanation that I've heard about the entire attack.

[@manufaleschini]

As a softeare engineer I highly admire the technical implementation of Stuxnet. It was a masterpiece. The use of it is another discussion.

[@2009raindrop]

Thank you Dave. Before watching this video I had only heard bits and pieces about this engineering marvel so it was great the hear the additional details you provided. I think about Stuxnet every time I see a thumb drive.

[@DugWagner]

I'm so glad I watched this. I finally have a small glimmer of understanding this incredible work of genius. You did a great job of making this understandable!

[@michaelangellotti5741]

That CBC ending continues to make me smile every time I see it.

[@JohnWallace74]

Good video. I used to be responsible for maintaining systems that printed The government student loans statements. The government had very strict requirements. Some of which made no sense like installing certificates for government internet access even when systems never connected to the internet as they were on a very restricted network with little access to anything. I retired a couple years ago, and I am happy to not have to deal with the daily grind of illogical security requirements from people who didn’t understand computer security at a low level…

[@saygoodnighttoghosts]

Thanks Dave! I was aware of this exploit before, but much preferred your approach in explaining the intricacies involved. Look forward to more.

[@ianpendlebury9503]

A very polished presentation. It talks about a world that I have not inhabited, but highlights the hazards that face an increasingly computerised world . Thanks.

[@magicdonutman2851]

One of my favorite channels on KZbin!

[@armchair_mechanic]

Love the Friendly Giant reference at the end of the video.

[@capiberra4118]

Great explanation, thanks! (Loved the “Friendly Giant” reference in the outro.)

[@EricAdli-l2t]

Windows 98 still run and operate westport RTG and 2 TEU crane from ship to trucks. The entire facility run with 3G signal for wireless mounted terminal (ms-dos) to operate. The entire ports environment is closed environment without internet access. Back in 2002. Dunno what infrastructure change now.

[@jimosborne2]

Dave, let’s give credit to Frontline, Nova and Zero Days among others for their groundbreaking work on Stuxnet. As you hinted at, it’s clear who developed it,who deployed it and why. Anyone who thinks that the worlds more powerful countries will develop norms or rules- well, I have an oil pipeline for sale for you in the North Sea.

[@SuperGirl-tf2wn]

It's incredible how this was crafted and executed. Makes me wonder who specifically (team) engineered this and what else they could truly do.

[@careycummings9999]

I like the homage to The Friendly Giant at the end, well done. Stuxnet is only the beginning of what will surely be an escalation of infrastructure based attacks. I'm glad I don't live near a chemical or nuclear plant, or downstream from a hydro dam. The possibilities are quite terrifying. Oh well, this is the world we made, now we have to live in it.

[@WooShell]

Autorun.inf had been widely criticized for its potential to abuse ever since its introduction in Windows 95. Yet, 15 years and four major releases later, its security implications were still not being addressed, which allowed something like Stuxnet to even happen. Yet, Microsoft emerged from the whole desaster largely unpunished.

[@WooShell]

@msromike123 Stuxnet did almost no damage to the Iranian nuclear project, and caused a lot of damage to millions of other computers worldwide.

[@WooShell]

@msromike123 since you consider infected systems not to be damage, there's no point in arguing any further. you very obviously have no clue about IT operations, security or costs. We're talking about *millions* of infected systems outside the target plant. If it takes only one hour to reinstall or otherwise disinfect each system, this means millions of wasted IT staff man-hours and thus wasted personnel costs. Totally worth it, right?

[@QwazyWabbit]

Autoruns had to be one of the worst design decisions ever made in Windows. Disabling it is one of the first things I do to a fresh Windows installation or new computer. Having worked on PLC projects and Step7 software at the time I was highly impressed with the Symantec Stuxnet dossier.

[@DaedalusRaistlin]

I think a lot of those design decisions came about because it made it easier for users new to the OS, which was a big concern when the OS was first released. Sure, advanced users would probably disable it, but it was helpful for people unfamiliar with computers or Windows. Most of the design decisions back then didn't consider security, Windows 95 barely even supported multiple user accounts. Keeping such a feature once security began to be important was not a great idea, however.

[@QwazyWabbit]

@msromike123 Once installed at Natanz from a USB drive and executed by Autoruns, it wormed through the entire network of computers running the facility. That’s why autoruns was not subsequently required.

[@user-dx3sp1yy5l]

P LL llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll pl​@@DaedalusRaistlin

[@emagotis]

Bravo for explaining a technical and complicated piece of software so clearly yet thoroughly. I was fascinated by all the facts, and also how you shed light on the political implications. Lastly, and quite literally, you also uploaded a high-quality video with superb lighting, incredible resolution, and high frame rate. Thank you for all the effort you put into this and for giving it away for free!

[@nathanpotter1334]

Just imagine if there is a zero day inside win recall... now that its dependent on the file explorer and required, that could be just as devastating.

[@sumo-ninja]

​@msromike123if you think TPMs are at all secure you're in trouble

[@sumo-ninja]

@msromike123 oh I see what you're saying my bad... With win recall there's a whole new level of spyware that's being forced onto every win11 user. It's absolutely insane that it's mandatory. OPs talking about a zero day when there's really no need. Once an attacker gains access to the PC win recall gives them everything they want basically

[@Fourthirtydriver]

A superb explanation and presentation! Kudos!

[@mikeburch2998]

This was a great video. Thank you and to those who created Stuxnet.

[@Dangling-Pointer]

I like how you discussed the moral and ethical dimensions as well. Often overlooked.

[@Egilhelmson]

Iran has been effectively at war with Israel and the USA and vice versa. This removes the ethical/moral question, since the targets would be targets regardless. If the virus reprogrammed the nuclear weapons to randomly go off in the silos, that would be different. Actual civilians living near the weapons would be killed when this new virus detonated the devices.

[@Dangling-Pointer]

@@Egilhelmson I fail to see how those countries being at war removes morals and ethics from the question. In fact, there’s a whole body of law attempting to govern just that. Unless you’re saying that more generally, in war, morals and ethics don’t apply? I guess it’s a valid point, and not an uncommon one (Machiavelli).

[@RichPober]

Excellent explanation - I covered it today in a live tutor-led OT cybersecurity course and Siemens PLC Step 7 software exercise. It really brough my understanding to life.

[@xxxx8380]

I love hearing this story to this day, thanks dave

[@MikeyK65]

Thanks Dave, that was a lot easier to digest than the Symantec 68 page document!!!

[@haydn9196]

Please do more of these breakdowns!

[@jmdjasonday]

A very detailed and succinct, yet easy to digest explanation. Thank you.

[@Taffeyboy]

Thanks for making an incredibly interesting operation understandable.

[@Hr1s7i]

4:20 There are a number of layers when it comes to industrial communications. If you operate on high level where you can have encryption, your com lines can be fairly safe, but on any of the lower levels, it's literally bare bits flying around with no encryption what so ever, due to latency being a major issue in industrial environment, not to mention packet complexity being the enemy, as it increases prices of equipment and cost of operations. Also, it's obvious this was a high level tool, as they designed it with the topology of the environment it'll operate in in mind. Insider information is crucial with this one, as trying to sabotage the industrial plant would hardly be possible if the engineers there knew the first thing about air gapping their systems and isolating all the layers of the plant from each other. Yet, it would introduce some latency in operations, but that is not a problem when using modern fuzzy logic capable controllers. The robustness will allow the controller to be independent for some time, compensating for the network taking it's sweet time encrypting/decrypting data. The way I see it, they didn't even consider that someone might be enacting sabotage through the internal data channels.

[@jackpisso1761]

Excellent video, Dave! Congratulations!

[@Bryghtpath]

Stuxnet redefined "plug and play" with a twist of international cyber warfare, turning malware into a pitch for the zero-day startup scene.

[@martyb3783]

This is a great video! Very interesting. The level of sophistication is astounding.

[@brunovandooren3762]

I work on similar systems. One thing we have in place is the airgapped systems also have their own active directory, don't have trusts, have no wireless or bluetooth or such, have removable storage disabled, and no computers are user accessible. I'm not saying it would be impossible but it would require physical intrusion

[@ernestvdw4186]

And just incredible that the whole industry worldwide relies and runs on Windows. Manufactures of equipement with control, all windows based. I used to work in an industry with DIGITAL VAX infrastructure. Never had 3 monthly security patches like now a days.

[@ronblack7870]

well the vax never got big enough or did anywhere near what windows does.

[@oglaucio]

Forget the complexity and how sophisticated this was....my mind is blown by the 500kb payload.. can't have a "hello world" done nowadays without downloading 200mb of dependencies and blowing 1gb of ram while running it. Thank you for the detailed video. This was fascinating!

[@andersjjensen]

"Hello world" in assembly on UNIX/Linux is less than 500 bytes on disk and significantly less in memory once the linker is done realising there is no linking to be done and only the two mandatory segments (BSS and TXT) exist.

[@oglaucio]

@@andersjjensen Yes that is pretty minimal. I was not talking about those languages. Mostly more "modern" ones.

[@cgungryfcdjs1352]

i mean that seems HUGE to me you act like its small?

[@joshuapatrick682]

I think the overarching moral of this story is that if you’re a national actor with intent to undermine international orders don’t use computers that run operating systems built by those you consider your enemy. Seems obvious, but it wasn’t. The real question I have is whether or not the OS architecture was designed intentionally for just such a purpose.

[@VincentRiquer]

Nowadays companies tend to disable mass storage support through GPO unless especially required. And some go through loads of viruses scanning before allowing a device to be plugged in. But this wouldn't have changed anything in this case as the use of the USB key would probably have been seen as legit, through social engineering or supply chain infiltration. And digging autorun would have not saved them due to the first 0 day mentioned... I really like this deep analysis of that malware, thank you

[@haikaido]

I would love to hear more cyber security stories!

[@jhors7777]

Well, researched and presented, thank you!

[@remot3kontrol]

Impressive video. Loved every second.

[@Alcyeragraeth]

Great explanation as always. Also, I really want your spiral lamp.

[@20chocsaday]

It's his Random Number generator. It turns at a slightly uneven speed and a ray of light is reflected off it. The detector it lands on gives a 1 and that was produces the value, somewhere.

[@paulgandy8400]

Outstanding commentary thanks

[@zereprd3911]

Excellent overview! Thank you.

[@MicesOnIces]

Was VERY happy when the title to this video popped up in my feed ... Time for an afternoon cup of tea (UK based)

[@rjy8960]

Same here :) Chin chin!

[@MicesOnIces]

@fire_stick Yorkshire - proper

[@rjy8960]

@fire_stick Same here :) Always take them when travelling. An Englishman needs his proper tea, not that forrin rubbish.

[@theNeWo1]

My quick research found stuxnet was around 500 kb in size. What it achieved in such a small size is amazing.

[@mskellyrlv]

Outstanding presentation!

[@indnwkybrd]

Dave's intro always makes me wonder. When you retire from Microsoft & you're walking out on your last day to retire at 50... do they actually stop you at the door & say: "Wait a sec - please show us your ID badge. For security reasons, we can't let you leave the building until we put a RETIRED stamp on it." ;)

[@MOSMASTERING]

Ive always found this story absolutely fascinating. This was a fantastic presentation of it, Im happy to sit through the story again when Dave tells it.

[@davidpriest5253]

Conficker - another autorun beauty which caused me a lot of stress. Cheers Dave.