> It's possibly the most sophisticated hacking campaign when social and technical aspects combined.

It’s the most sophisticated one _we know of_

And it's 10 year old now...

Frankly I expect basically all computers are compromised at this point.

And I expect all food is unhealthy, so all I eat is pancakes.

> - They've stolen Realtek's driver signing keys.

I have been to Realtek's offices in Hsinchu many times. While the other efforts may have taken major resources I don't think getting their private keys would have been hard at all. Especially back then. IMHO the building and some people could be easily compromised and I suspect they didn't really care much about security.

The hardware-software combination that was used to compromise the Iranian nuclear facilities was amazingly old and primitive, though. It truly was a weak link that I cannot fathom how this wasn't upgraded looong before. I mean, I guess it just didn't matter that much, after all, it's only a uranium enrichment facility, after all. What could possibly go wrong?

You're overestimating SCADA systems (and industrial control systems in particular) about their pace of evolution.

Some ideas about the reason they had this particular hardware and software combination:

- The SCADA hardware they got was not compatible with newer software which runs on more modern OSes.

- The SCADA software didn't have any newer version which runs on newer OSes (Windows 7 and further versions are more restrictive in terms of direct HW access).

- Since there are sanctions it was the only hardware and software combo they were able to legally obtain.

Industrial control is like automotive industry. Everything is improved in minuscule steps and by encapsulating everything in more modern carriers. A good example is MODBUS. They still carry the same data, the old way. Only thing is it's either encapsulated in USB or TCP/IP. Why? Because it works and allows perfect backward compatibility.

Since neither the hardware and the software has to run latest version of Doom (metaphorically), if the application is reliable, it's left as is. Even if it runs on DOS 6.22.

Fun fact: There's an auto repair shop in Poland which runs its main application on a C64 [0].

[0]: https://www.popularmechanics.com/technology/gadgets/a23139/c...

Morality aside, the whole system was a work of art.

If anyone is interested in this, or wanna refresh your memory, you should watch the docufilm Zero Days (2016) by Alex Gibney (most of his ‘movies’ are quite interesting)

https://www.imdb.com/title/tt5446858/

Book?

Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon - by Kim Zetter [0]

[0]: https://www.goodreads.com/book/show/18465875-countdown-to-ze...