Skip to content
0:00 / 0:00

#stuxnet#malware#zero-day

27C3: Adventures in analyzing Stuxnet (Bruce Dang from Microsoft)

basti0007

1K subscribers • 1 video on Hallway

YouTube
  • Recommended by 8 people: 8 on Hacker News.
  • A classic. People kept recommending it from 2011 to 2024.
  • Presented by Bruce Dang, security researcher at Microsoft

Advanced. Deep dive for people who know the field.

95K views15 years ago8 recommendations

SecuritySystems programmingExploits and vulnerabilitiesReverse engineeringOperating systems

Bruce Dang explains how Microsoft analyzed the Stuxnet worm, detailing the zero-day vulnerabilities and reverse-engineering techniques used.

Abstract There has been many publications on the topic of Stuxnet and its "sophistication" in the mainstream press. However, there is not a complete publication which explains all of the technical vulnerability details and how they were discovered. In this talk, you will get a first-hand account of the entire story. Description We will discuss various techniques used in analyzing Stuxnet. First, we will share several tricks that were used to quickly identify the vulnerabilities. Second, we describe the thought processes that went into debugging and triaging the vulnerabilities themselves. Finally, we show some tips that you can use if you feel like decompiling stuff for fun :).

Why it's here

8 people recommend this

What people say. Highly recommended as an exceptional, detailed technical deep dive into the Stuxnet exploits and malware analysis.

spudlyoon Hacker News • Recommends

On “Black ops: how HBGary wrote backdoors for the government”

LNK files can point to DLLs that get loaded by Explorer when it draws the icon for the link target. I only know this because I watched an excellent video explaining the 0-day vulnerabilities that stuxnet used by Microsoft leet hax0r Bruce Dang. link to this video

JonnieCacheon Hacker News • Recommends

On “Did the US write Stuxnet? Deputy Defense Secretary won't deny it”

Also, check out this excellent 27C3 presentation from Bruce Dang, a microsoft malware analyst, where he cracks numerous gags about mossad. link to this video It's well worth watching anyway, lots of good info on the various exploits used by stuxnet, down to the opcode level. He's a pretty funny guy as well.

tbrockon Hacker News • Recommends

On “Stuxnet Missing Link Found, Resolves Some Mysteries Around the Cyberweapon”

If anyone hasn't seen this video from the Microsoft team analyzing how this went down, I highly suggest watching. I was on the edge of my seat! link to this video

nodesocketon Hacker News • Recommends

On “Microsoft Patches Six Zero-Day Security Holes”

Are these on the same level as Stuxnet? For an amazing technical deep dive into each 0-day Stuxnet vulnerability watch this talk with Bruce Dang from Microsoft1. I really enjoy his natural speaking style (it's like talking about Stuxnet over beers with him). 1 link to this video

dmixon Hacker News • Recommends

On “Stuxnet is now on GitHub”

For those curious, a Microsoft employee broke down each of the exploits that Stuxnet used at a conference recently: link to this video

phluxon Hacker News • Recommends

On “Stuxnet Virus Weapon Now Being Sold On The Black Market”

Watch these in this order: link - brief overview great animation link - ted talk on stux link to this video detailed analysis of stuxnet the last one is long and Bruce appears to be an arrogant prick, but it is clear - cyber war has been here for a while.

phluxon Hacker News • Recommends

On “LulzSec releases trove of AZ law enforcement documents”

PSY-OP MOTHERFUCKER, CAN YOU HACK IT?! This is NOT script kiddies going at it, this is bio-stux.... See the following: Watch these in this order: link - brief overview great animation link - ted talk on stux link to this video . detailed analysis of stuxnet the last one is long and Bruce appears to be an arrogant prick, but it is clear - cyber war has been here for a while. --- As I have mentioned, cyber war is here - and the legislation is lacking in its awareness - but becuase we have incompetant douches in charge of tech legislation, we will have physical war used as a metaphor to cyber warfare and thus have draconian influences from physical imprisonment being applied to digital situations. Utt…

samstaveon Hacker News • Recommends

On “Unilateral Israeli changes to Stuxnet caused its exposure, angering US”

Stuxnet was such an amazing event. The speculation at first, the quasi confirmation a little later based on certain items in the code. The dissection of it and the tech talks by Microsoft and others on its design and build... And then that it had a successor - and now it comes out that Israel and US squabbling over what team did what which allowed it to be exposed. It is such an amazing cornerstone in the cyberpunk reality of where the world is heading. If you haven't watched the tech talks on stuxnet and duqu, please do - super interesting. link to this video link link

akira2501on Hacker News • Recommends

On “Engineer Used Water Pump to Get $1B Stuxnet Malware into Iranian Nuclear Plant”

Does anyone else remember the 27C3 presentation on this? My take away was that Stuxnet was _largely_ enabled by 0day vulnerabilities in Microsoft's products. The especially damning one was the print spooler script running vulnerability. Anyways, from this perspective, even back then, the analysis was pretty thorough: link to this video

samstaveon Hacker News • Mentions

On “How many people have Q Clearance?”

I recall the two biggest stories about foreign spies in these labs: 1. Chinese blamed for stealing Los Alamos secret by stashing hard drives behind a copy machine and grabbing them later. 2. Chinese engineer at JPL worked there for decades and was thought to be a nice family in Pasadina - but lived in a really super spartan house and the wife was the engineer's handler and their kids were the mules to haul data back to ccp 3. China's trickle hack on Lockheed by phishing employees who had attended defense conferences 4. China hacking Lockheed providers in Taiwan with an air gap and sneaker-net to gain access to Lockheed laptops via USB exploits (this was one of the factors, IIRC why epoxy in…