Hacker News Reader

Comment by russell_h | Hacker News Reader

I'm no security researcher, but it seems to me that there are two interesting parts to Stuxnet:

    1. The infection mechanism it uses to spread (no idea what the technical term is for this)
    2. The payload it uses to damage nuclear reactors

The vulnerabilities exploited by (1) are supposedly already patched, so that isn't going to do anyone much good. And unless anon hopes to take out a nuclear enrichment facility (and since they probably aren't all the same, we're only talking about some portion of those) I don't see what good (2) would do them.

So while this is probably a great way to drum up an 'OMG HACKERZ!!' scare, I just don't see why this is really a big deal. To say nothing of the fact that, being a virus, Stuxnet can't really be all that hard to find a copy of.

Edit: Changed reactors to enrichment facilities in the list and fixed the list formatting.

View on HN

Stuxnet has nothing to do with "nuclear reactors". It targeted uranium enrichment centrifuges.

And the uranium is use for? (weapons aside)

The post he was replying to said

2. The payload it uses to damage nuclear reactors

He was pointing out that it doesn't directly damage them.

I believe the point is that "to damage nuclear reactors" conjures a far different (and more explosive) mental image than "to damage nuclear enrichment facilities", even if the economic impact is the same.

Corrected, my mistake. I even managed to get it right the first time in the paragraph below that, it must be the sleep deprivation catching up with me.

sigh, so in the process of fixing the list formatting and making an edit note I didn't actually fix the text. Time for a nap.

It has nothing to do with nuclear reactors, that is correct.

It has to do with production of fissile material for nuclear bombs being developed by a psychotic islamic fundamentalist state run by a madman.

If someone is writing viruses to destroy clean energy from modern nuclear reactors, that is a bad virus.

But if they are writing viruses to stop radical fundamentalists from building The Bomb, well that is OK by me.

I believe Stuxnet messed with the software that ran some fairly esoteric, though nevertheless commercially produced and sold machinery for enriching uranium. Siemens gear I think.

You're making a huge assumption that all machines are patched.

The problem is that intustrial installations of the type stuxnet targets usually cannot be patched at all because changing anything important in a system like that requires a full reevaluation of compliancee with all current security and other regulations as if the installation were new. And this can easily cost tens or even hundreds of millions in hardware changes if the requirements for new installations have become stricter since when the installation was built (which is quite common for nuclear facilities).

Reply on news.ycombinator.com