Remember that there's really no "official" source for any of these infection figures. Often, when you trace them down, they lead to antivirus and malware firms, and their sources are anecdotal. The vested interests in promoting the epidemic nature of the worm are obvious.
Likewise with the notion of how hard this piece of malware was to create. A better metric, one you aren't seeing, is how hard this worm was to create compared to other worms. Most other worms aren't even "criminal", per se; they're pranks and dick-swinging. Apart from the SCADA components, is Stuxnet more complex than any prior worm? I think that question is very much up in the air. And by whose estimate did it take 6+ people to write?
You will be well served by skepticism when evaluating these stories. A similar conspiratorial pall could have cast Slammer or Conficker in the same cloak-and-dagger role (look how Mark Bowden, a reporter of no small repute, managed to write Conficker up).
Four zero-day vulnerabilities + one (zero-day?) in controller software + (at least) two valid stolen certificates for signed drivers -- that, afaics, is pretty hard compared to other worms; definitely not in dick-swinging league.
Indeed, there is solid evidence that stuxnet is quite unusual compared to other worms and likely was developed using different processes and with greater resources than previous worms. Beyond that pretty much everything else is rampant speculation.
The press sensationalism is, as always, exhausting, so it's great to read Schneier's balanced account. I am dying to know, for real, who set all of this up. Meeting the team who put it together would be a blast, too.
Wow, talk about bad and good luck at the same time:
"En route to the target, the Israeli strike squadron crossed the gulf of Aqaba at an altitude of only 100 feet and in complete radio silence to avoid detection. In a potentially disastrous stroke of bad luck, the Israeli warplanes flew, unknowingly, directly over the yacht of King Hussein of Jordan, who was vacationing in the Gulf at the time. Taking into account the location, bearing, and armament of the Israeli planes Hussein quickly deduced the Iraqi reactor to be the most probable target. Hussein immediately contacted his government and ordered a warning to be sent to the Iraqis. However, due to a communication failure the message was never received and the Israeli strike team entered Iraqi air space undetected."
6 comments
[ 3.3 ms ] story [ 24.1 ms ] threadLikewise with the notion of how hard this piece of malware was to create. A better metric, one you aren't seeing, is how hard this worm was to create compared to other worms. Most other worms aren't even "criminal", per se; they're pranks and dick-swinging. Apart from the SCADA components, is Stuxnet more complex than any prior worm? I think that question is very much up in the air. And by whose estimate did it take 6+ people to write?
You will be well served by skepticism when evaluating these stories. A similar conspiratorial pall could have cast Slammer or Conficker in the same cloak-and-dagger role (look how Mark Bowden, a reporter of no small repute, managed to write Conficker up).
http://en.wikipedia.org/wiki/Operation_Opera
The press sensationalism is, as always, exhausting, so it's great to read Schneier's balanced account. I am dying to know, for real, who set all of this up. Meeting the team who put it together would be a blast, too.
"En route to the target, the Israeli strike squadron crossed the gulf of Aqaba at an altitude of only 100 feet and in complete radio silence to avoid detection. In a potentially disastrous stroke of bad luck, the Israeli warplanes flew, unknowingly, directly over the yacht of King Hussein of Jordan, who was vacationing in the Gulf at the time. Taking into account the location, bearing, and armament of the Israeli planes Hussein quickly deduced the Iraqi reactor to be the most probable target. Hussein immediately contacted his government and ordered a warning to be sent to the Iraqis. However, due to a communication failure the message was never received and the Israeli strike team entered Iraqi air space undetected."