Timeline for Was API hooking done as needed for Stuxnet to work? I don't think so
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 14, 2012 at 23:35 | comment | added | The Kaykay |
@nikie anyway guess I went off the topic in the above comment. Thanks for the answers and the discussion really really helpful. I think I'll just buy the WinCC software and find the particular DLL that Stuxnet hooks and then run it through dependency walker to see it for myself What APIs does it call. Only CreateFileA or are/is there any other call to CreateFileW. Hope I did not waste time of you people here. Sorry if I did that.
|
|
| Apr 14, 2012 at 23:29 | comment | added | The Kaykay | @nikie It is believed that two teams probably developed Stuxnet. One developed the part which infects systems and propagates to different systems. Second is the part which infects WinCC and the PLCs. The first team seems to know malware development well but the second team seems to know PLC programming well and they also seem to know gas centrifuges too well. The first team hooked-on to only Unicode related functions but the second did not. Why? I don't know the answer. There are many more inconsistencies that I have found and it is difficult for me to put it all here in these small comments. | |
| Apr 14, 2012 at 23:18 | comment | added | The Kaykay |
@nikie Maybe I am arguing too hard like a lawyer here; Sorry for that. But the only reason for my strong scepticism is that Stuxnet plays safe in all the cases where it hooks-on to functions by hooking-on to Unicode-related functions only. For example, LoadLibraryW FindFirstFileW FindNextFileW FindFirstFileExW and many others. But it stands out in the case of CreateFileA Why? Why hook-on to all Unicode functions and hook to CreateFileA when it also internally calls CreateFileW? And I neither believe Stuxnet worked nor deny it. I'm just being the devil's advocate here.
|
|
| Apr 14, 2012 at 20:02 | comment | added | nikie | @TheKaykay: Again, if they had built it unicode-aware, hooking into CreateFileA wouldn't have worked. You know that. I get the impression you don't want to discuss software development, but instead want someone to confirm your theory that Stuxnet could never have worked. But you know it did work. | |
| Apr 14, 2012 at 18:17 | comment | added | The Kaykay | @nikie :-) I guess we both have different entities in mind when we refer to WinCC. I'm referring to WinCC's Step 7 STL Editor an editor used to program PLCs which Stuxnet infects. The major business logic of the entire WinCC as a whole would have had gone very few or no changes, of course, I agree with that. But a PLC program editor will definitely have under gone changes from 95 to 2008. Do you agree? They will have made it compatible with Unicode. | |
| Apr 14, 2012 at 18:06 | comment | added | nikie | @TheKaykay: "Yeah but they do try to do away with the deprecated practices of software development in their newer versions of software". If that was so, then Stuxnet wouldn't work, would it. Obviously they never switched to unicode. And, honestly, I don't see much reason why they should. They have a tested codebase that does what it's supposed to do on the systems where it's installed. Nobody would break that without a clear business reason just because you think it's "deprecated practice". | |
| Apr 14, 2012 at 17:27 | comment | added | The Kaykay | @WyattBarnett I'm looking at the STL Step 7 Editor which is used to program PLCs which gets shipped as part of the entire WinCC package. I doubt a PLC program editor will be written specific to one industrial system. | |
| Apr 14, 2012 at 17:23 | comment | added | Wyatt Barnett | You are looking at industrial software, which tends to get written once against certain hardware and not fixed. And you are looking at a 3rd world country which has older hardware and older OS versions. I would be more surprised if they were running on Win7x64 than if they were running on 98SE. | |
| Apr 14, 2012 at 17:20 | comment | added | The Kaykay | Yeah but they do try to do away with the deprecated practices of software development in their newer versions of software. 95 to 2008 is 13 years. They are releasing the service pack in about a years time, as mentioned above. If they keep all the legacy stuff without phasing out then I think they are too incompetent. | |
| Apr 14, 2012 at 17:04 | comment | added | nikie | @TheKaykay: You have a wrong impression of how software development works. They don't rewrite WinCC from scratch for every new version. They started development in the 90's, and at that time, it was common to write non-unicode software- So they wrote non-unicode software. And that kind of software doesn't get magically unicode-aware just by adding new features or putting a new version label on it. | |
| Apr 14, 2012 at 14:06 | comment | added | The Kaykay | Secondly, perhaps you can be sure that the developers had exact version of WinCC they were targeting. But can you say with the same conviction that Symantec used that exact version in their test-setup they created in their Culver City office? I don't think you can say that with absolute conviction. :-) perhaps I'm wrong... | |
| Apr 14, 2012 at 13:42 | comment | added | The Kaykay |
thank you great answer. Stuxnet looks specifically for WinCC Step 7 version. I checked on the Siemens website and found WinCC S7 SP3 was released in Dec2011, SP2 was released in Sep 2010 . Stuxnet was estimated to have been developed in 2008 by computer experts. I can safely say that the WinCC in operation in Iran is not the one made in 1995? So either WinCC only works with CreateFileA in all the locations or they use some method to invoke CreateFileW whenever needed? Would you agree?
|
|
| Apr 14, 2012 at 13:17 | history | answered | nikie | CC BY-SA 3.0 |