Fast16: High-precision software sabotage 5 years before Stuxnet

(sentinelone.com)

91 points | by dd23 2 hours ago

9 comments

  • Lihh27 1 minute ago
    heh the key move is the worm. you can't catch it by checking on a second box because there is no clean box.
  • codezero 1 hour ago
    My favorite part of this was:

    That kind of notation, called SCCS/RCS, is the equivalent of finding a rotary phone in a modern office. Nobody uses it in 2005 Windows kernel code unless their programming background goes back decades, to government and military computing environments

    The astrophysics lab I worked at in 2006 was still using svn and had a bunch of Fortran with references to systems from the 70s and 80s. The code ran perfectly well thanks to modern optimizing compilers and having moved from Vax to Linux in the 90s, it was a surprisingly seamless transition.

    It reminds me of a conference talk I’ve referenced before “do over or make due” basically implying rewriting large amounts of mostly functioning code was not worth the effort if it could be taped together with modern tools.

    • tptacek 41 minutes ago
      Yeah, I used to be skeptical of the government provenance of things like Stuxnet (I am not any more, I'm fully sold, like everyone else), and notes like this were why. People used RCS well into the 2000s! RCS as a tool had virtues over SVN and CVS.
      • codezero 38 minutes ago
        I do wonder if these breadcrumbs were also left intentionally. “Oh look, we are using old stuff, don’t be afraid!” Or for some other reason. It is a little surprising to pull off such a sophisticated attack and miss details you could find running ‘strings’ unless I’m missing something and this part was encrypted.
        • tptacek 32 minutes ago
          I think that in the time period we're talking about, RCS wasn't really even all that old. Like, RCS is old, sure, but it was also in common use especially by Unix systems people; it's what you might have reached for by default to version your dotfiles, for instance.
          • codezero 18 minutes ago
            Yes, but even back then I was aware of the sections in executables (wasn’t this where it was found?) and any neckbeard from the 70s and 80s might be even more so aware. That said, yeah, sure, it’s a very possible and understandable oversight, but I’m weary because of all the text in viruses and such as indicators. Seems like a pass over ‘strings’ would be obvious. Though. TIL, strings doesn’t necessarily scan the entire executable.
    • drysine 9 minutes ago
      >in 2006 was still using svn

      Subversion was released in 2004 and git appeared in 2005.

      Perhaps you meant cvs? In 2010 it still took me some effort to convince the team to switch to svn.

  • tiagod 56 minutes ago
    This is an amazing find. I'm very curious regarding the specific targets of these rules, and in the exact changes to the results. Wonder if they will only make a difference in simulated conditions super specific to nuclear reactors?
  • trebligdivad 1 hour ago
    Haha it's a fun finding though; The source control comment feels a little off; I'm sure there were SCCS (hmm or did cvs use similar?) still around at that time.
    • tiagod 54 minutes ago
      I believe that comment was specific to it being unusual in Windows software, suggesting the developers were also working in UNIX stuff (where usage SCCS/RCS was common).
  • slim 1 hour ago
    sabotaging science must be the most morally corrupt thing you can do as a civilisation
    • codezero 35 minutes ago
      None of the science being sabotaged was being published in peer reviewed journals was it? (besides the Portuguese hydrodynamic modeling stuff, but it could have been accidental or had other uses)

      And yes, to be clear, I don’t consider it contributing to “science” if it’s not published, reviewed, and reproducible.

    • qingcharles 6 minutes ago
      The first thing I thought of was The 3-Body Problem series. If you've read the books (or watched the shows you'll know what I mean).
    • jabedude 1 hour ago
      Spying on and sabotaging weapons development of foreign adversaries is a completely normal government function
    • throwaway25151 21 minutes ago
      How about killing scientists and engineers? [1]

      [1] https://en.wikipedia.org/wiki/Assassinations_of_Iranian_nucl...

    • _joel 36 minutes ago
      I wonder how many results got nerfed via https://en.wikipedia.org/wiki/Pentium_FDIV_bug before it was known about.
      • codezero 29 minutes ago
        I’d be surprised if it were a lot. At that time (open to corrections) not a lot of scientific research was done on consumer intel platforms.

        Obviously it was found by a mathematician, but I still suspect it wasn’t obvious in published research or that it ended up not causing significant enough deviations to cause research to revisit the calculations.

        My team ran into some interesting but very small deviations when we moved our iterative solar wind model from 32 bit to 64 bit, but the changes weren’t significant enough to revisit or re-do prior research wholesale.

        Like my team in the 2000s I suspect anyone who had data crunched by this bug also revisited it and either concluded it wasn’t significant enough or redid the work and it didn’t change the conclusions.

        I am curious now if this bug was cited in any papers at the time to give a rough idea how aware or affected academics were.

    • Cthulhu_ 1 hour ago
      Nah; it's to prevent a country from developing a superweapon and possibly triggering WW3 / worldwide nuclear annihilation.

      This comment is very exaggerated, I can think of a few more "morally corrupt" things to do.

  • Retr0id 2 hours ago
    The submitted article appears to be an LLM summary of https://www.sentinelone.com/labs/fast16-mystery-shadowbroker...
  • jeremie_strand 31 minutes ago
    [dead]
  • vasco 43 minutes ago
    So that's why China still can't make ballpoint pens? /s