Langner's Stuxnet Deep Dive

Ralph Langner provides the most detailed presentation of the Stuxnet S7 code. He goes through the key Function Codes and Data Blocks in detail and shows how it matches to the Natanz facility. You see Ralph's teams comments throughout the Stuxnet code, and the level of detailed analysis.
This performance from S4x12 is a great example of the technical detail we look for in a Stage 2: Technical Deep Dive Session. The beauty of Ralph's presentation is he also makes the key points understandable for a less technical viewer.
This video from S4x12 was viewed 38K times on Vimeo before we moved it to this KZbin Channel.

[@BillKinsman]

This is the most fascinating piece of code that I have ever heard of. The authors had access to the most detailed information that there is and so much confidential information from so many vendors that it has to be state-sponsored.

[@S4Events]

Glad you enjoyed it!

[@notme4526]

It's all but been directly admitted by our security community because there clearance won't allow them to admit it publicly, though a lot of people involved or that over seen it basically admitted too it years ago. Even Obama got shocked on stage an said he couldn't speak about it when he was asked, notice he didn't say they weren't involved lol so he didn't lie, just that he could speak about it. On top of the fact that only governments would want to do this, any financially motivated group would have no interest in attacking Iran or investing the money to reverse the Siemens hardware, there was little to no research on this hardware back when stuxnet was used unlike now where there is much more public analysis and research of these products available online.

[@jacobreuter]

Absolutely my favorite explanation. I was looking for a deeper dig into the code such as this instead of the super dramatized videos with edits.

[@S4Events]

Yes. We point to this as an example of a great S4 Stage 2: Technical Deep Dive session for new Stage 2 speakers. Lots of technical meat that drives to a point. It has had over 50K views on KZbin, and for the first five years was on Vimeo. BTW, 60 Minutes came down to film footage of Ralph giving this session.

[@ArztvomDienst]

"Countdown to ZeroDay" made me come here. Fascinating talk!

[@BillKinsman]

Absolutely, the Field Engineer's worst nightmare! Trying to figure out why the rotors were failing must have been keeping some people awake at night.

[@spacegerrit9499]

Engineers got killed, reprimanded by management, fired and whatnot. Stuxnet had a huge impact on, not just machinery, but peoples lives.

[@CristobalRuiz]

I wonder who gave thumbs down? This is a great presentation.

[@shreddagorge]

Maybe some Iranians... ;-)

[@PIFFthePUFF420]

Maybe Mossad doesn't like you exposing their work

[@tobalaba]

Mossad, NSA, or Langner competitors.

[@ig_jr4843]

Thanks for sharing this outstanding presentation!

[@invntiv]

Very fascinating talk from one of the few people who were embroiled in understanding the stuxnet attack. Would love to here from Andrew Chien from Symantec as well. Langber, Chien, and many other involved were featured the brilliant 2016 documentary "Zero Day" by Alex Gibney. I urge those interested in forensics, security, or really any other STEM field to check it out

[@invntiv]

*** Eric Chien from Symantec

[@asswhole4195]

Check out the book "Countdown to Zeroday"

[@tammyroyce8013]

Batch files are most commonly known to be in the system part C

[@GeorgeTsiros]

I like how the decompiled code still uses windows type names: BOOL DWORD etc

[@ArztvomDienst]

Love the HB Gary reference! XD

[@chadkrause6574]

It seems very obvious that this was an inside job of some sort. The amount of information required to pull these attacks off is stunning. There had to be a team of people working on this

[@ErebuBat]

Not an inside job, but espionage. This is what the CIA does.... get info like this.

[@spacegerrit9499]

Dutch secret service was involved aswel. Apparantly the physical usb insertation was done by an AIVD mole.

[@Evanderj]

The NSA can get inside practically anywhere in the world remotely. They had full access to the software on the system, the cctv, the whole network including the personal devices of many who worked there- thanks to Mossad for providing info & identities on those individuals. How intelligent and creative the NSA is… is just mind blowing- couple that with virtually unlimited funding.

[@ArztvomDienst]

Siemens was involved, they even build a functional sandbox cascade to recreate the real world conditions of the target, as Ralph says, even with the UF6

[@AdamGreenhill]

Is there a report or a writeup that details this? I would love to read this in PDF format

[@S4Events]

Langner's definitive work on Stuxnet is "To Kill A Centrifuge" www.langner.com/en/wp-content/uploads/2013/11/To-kill-a-centrifuge.pdf

[@AdamGreenhill]

S4 Events thanks!

[@JeandrePetzer]

28:45 Which dots is he talking about here? His laser pointer isnt showing up on the video? The bottom image doesnt have the missing dots that the first two real scada screens had

[@wanderingfido]

I wished someone had asked if they thought it was possible to consider a compromise where the input process image was not made immutable until the driver factory(s) were initialized at install-time. Oh well.

[@tammyroyce8013]

How about stuxnet. And I I came out and I put and I open changed in Google speaker system that has been changed in the program itself because the program itself is actually written Google docs system to be exact

[@tammyroyce8013]

The configuration system of the batch file

[@allurbase]

the numbers in red are censores for the video?? huh

[@douro20]

So when will we have Felix Lindner's talk?

[@S4Events]

Felix was ill and sent hadez in his place. We are putting up two talks a week, so sometime in the next few weeks.

[@angelabetts7359]

My master sent me here. ;)

[@bizzybgful]

I know

[@discernunos2017]

did they punish you for being a human too

[@iGrave]

44:30. Unfortunately there are "valid" reasons inputs could be writable. When testing code, it's common practice to put simulation routines to emulate plant equipment. It doesn't have to be complicated, oftentimes it's just reflecting an output "run" signal to a "running" input. For various reasons, it's desirable to write as close to raw input as possible. To be clear this code should 'never' make it to production, and if forgotten would typically be removed during commissioning. It's only something you'd ever see during dev, or perhaps for a digital twin/training rig. But hell. This sort of intentional exploit is just straight up not something I've never seen considered Even to this day. Spoken as a process control engineer with about 10 years experience across various industries.

[@iGrave]

Couple follow-ups from the q and a. I'm assuming old-mate at 55:10 ish is referring to what I mentioned above. I agree with the host here, I have never come across a situation where writing to the input tables is required *in production*. And for my example above, I have to doubt there is a solution the vendor could implement to allow us engineers for our sim purposes. I will disagree with the host about the authors of Stuxnet having an exact physical replica. Again, machines operate in predictable ways, which allows us to write sim code. If you see a run signal, put in some small delay, then reflect it back to the running input. The run speed feedback can ramp to the run speed setpoint according to some ramping rules. How machines and processes interact is more complicated, but I'm sure someone with a strong understanding of how a centrifuge cascade works could predict how the target plant would respond. Having a physical reproduction certainly wouldn't hurt though :)

[@VacuumFluctuation]

It's wired to see even after 6 years S4 Events could not upload a proper FHD video of such a presentation as if it just does not matter.... Not sure what to call it - Arrogance or Carelessness?

[@S4Events]

I'm sorry about that. We did not record it that way back in 2012, so this is the best quality we have. Back then it was 60 people in a small room with a single, simple camera. Now the Main Stage is a 4 camera shoot with a lot more emphasis on staging and other elements for the video. I too regret we don't have a higher quality video. So of your two choices, carelessness back during the recording is the answer.

[@VacuumFluctuation]

@@S4EventsI was so disappointed 5 days ago, i hope we had tech to upgrade the video atleast to 480p. But I do understand your response. Thanks for the reply.

[@alexbenzie6585]

Why would it be arrogance you mug

[@lagimmediafiles6478]

The Code is C++? Or Java Script?

[@lagimmediafiles6478]

@Eduardo Souza whats that?

[@hyperfine3633]

I thought it was largely written in C (with some assembly bit-fiddling)? Surely it would be almost impossible to keep track of a program this large writing just in an assembly language. Edit: Just seen the part about the C-style pseudo code. This is probably what I've seen before so I assumed it was mostly C code.

[@moose43h]

@Eduardo Souza no it was written in c and c++

[@aslannoah9835]

@@moose43h The language is called SCL or Structured Text(ST). It is a PASCAL based language that's used for programming Programmable Logic Controllers

[@OTbase]

Folks, the high level code samples are translations from SCL to a C-like language in order to understand how the code is structured and what they intend to achieve. Those snippets were created manually and usually required a couple of days of work per SCL module (or function block/FB in Siemens parlance).

[@24thelder72]

Shoot Don't Tell Us Nuclear Power Generation Use Read/Write Logic In Their Control System Design For Cooling. kdagPlymouthUK. Please Stay Blessed. GodBless S4.

[@elimgarak3597]

6:48 geez, I guess Amazon and Google should stop using Apache, Spark, Nginx, Postgres, MongoDB, Linux, Bash, and other non-professional open source tools then. Boomer comment on an otherwise very cool talk.

[@josefaschwanden1502]

How tf are these tools not professional?

[@elimgarak3597]

@@josefaschwanden1502 I know right? I don't know why the speaker would imply that a tool is not professional because it is open source. BTW, I hope they upstreamed their enhancements with a pull request. Otherwise, a very dick move.

[@josefaschwanden1502]

@@elimgarak3597 he didnt imply that open source means bad quality, but that this specific open source project was. Atleast thats how i understood it.

[@urnan7499]

He never implied that open source means bad quality. He's referring to the open source decompiler that he used to decompile StuxNet. Professional anti virus companies use commercial tools like IDA Pro to decompile executables.

[@elimgarak3597]

@@urnan7499 "we had to make a couple of enhancements BECAUSE it is open source and not really professionally mantained". Ofc he is implying open source means bad quality, that is clear as water.

[@tammyroyce8013]

Did you check under stuxnet. EXE

[@tammyroyce8013]

Stuxnet.exe Stuxnet.ini Stuxnet.rar