Does everyone agree with that assessment? Surely Linux is more complicated than Stuxnet? Or does that not count as a ‘single piece’?

Sophisticated != complicated

Ok, but I would have presumed linux was also more sophisticated, having been developed over a much longer period of time.

What is it that’s more sophisticated about stuxnet than Linux?

A good rule of thumb to think about it might be, how many people in the world could write code to achieve a particular objective?

If the answer is 100,000's of people (i.e. good programmers), then it's not super-sophisticated, no matter how complicated it may be.

If the answer is 100's of people, then it is super-sophisticated. Stuxnet appears to be the latter, given the advanced techniques, zero-days, and target knowledge it required.

Think of it like the difference between New York City and a nuclear fusion warhead. New York City is incredibly more complicated than a warhead, but a warhead is incredibly more sophsiticated.

Yea, that's what someone wrote on Quora, but Stuxnet isn't the most sophisticated piece of software ever written - let alone that it is not the most sophisticated exploit ever written.

> Stuxnet isn't the most sophisticated piece of software ever written

I think "sophisticated" is in the eye of the beholder.

However you'd like to characterize it, the full scope of the Stuxnet attack seems pretty impressive. Especially the part where the virus simultaneously increases centrifuge speeds while concealing this information from the people monitoring the fuges.

Find me another program that requires knowledge more niche than nuclear refinement processes suitable for the production of weapons, and enough HUMINT to know what to target etc.

Stuxnet is probably not the most sophisticated program ever, but it's probably the most information dense.

> Find me another program that requires knowledge more niche than nuclear refinement processes suitable for the production of weapons, and enough HUMINT to know what to target etc.

How does that add sophistication to the programming?

How doesn't it? Programming doesn't matter, even in a program that is classically sophisticated like a big compiler that's still only an implementation of an algorithm from a book rather than some divine poem that only exists in that compiler

I'd agree if you'd say that the Stuxnet operation was very sophisticated. That is, coming up with a plan, infecting the right machine in the right plant at the right time so an unknowing technician would accidentally become a carrier for it, then finding a way to make him drop by at the target next, learn enough about the target without having access to be able to write code to identify it with confidence among lots of similar machines etc, but most of that is classical intelligence work and has nothing to do with programming, tech, or Stuxnet specifically.

If someone sews on a hidden pocket to a jacket to be used in an extremely complex intelligence operation, that doesn't make it "the most sophisticated seam in history".

> Find me another program that requires knowledge more niche than nuclear refinement processes suitable for the production of weapons

Every piece of software used for these centrifuges in day to day operations? Stuxnet is just a worse version of the normal software operating machinery and it used a non-standard install mechanism.

Having HUMINT to target a specific configuration is not sophisticated either. Those are just activation conditions which are used all over legitimate and illegitimate software.

Extracting secrets from processor caches based on timing is far more sophisticated and it didn’t even require HUMINT.

> Stuxnet is just a worse version of the normal software operating machinery and it used a non-standard install mechanism.

No it's not. Stuxnet was specifically tuned to ruin the centrifuges under the noses of the presumably well-trained operators and scientists using them. If the PLC suddenly stopped or sped up to the point that it triggered some kind of failsafe then the game is up.

> Extracting secrets from processor caches based on timing is far more sophisticated and it didn’t even require HUMINT.

Implementing spectre is really not that hard. Also, the secrets aren't extracted from the caches (in the archetypal spectre implementation at least, the vulnerabilities are popping up all over the place): Spectre is an attack against the branch predictor and speculative execution - the cache is just the side channel to exfiltrate data (specifically having each byte value map to a cacheline which you can then time the latency of).

> suitable for the production of weapons

Where have you seen any evidence that Stuxnet relied on information on production of nuclear weapons?

So you're saying they went to all that effort and then just picked a random number for what to spin the centrifuges up to? All they'd have to do is get a Nuclear Physicist from the weapons program in

No. I’m saying how do infer it was suitable for nuclear weapons production? The International Atomic Agency has the most stringent oversight on the Iranian nuclear program and there has been no evidence of a nuclear weapons program.

It is not inference but deduction and knowledge. Iran has long said that they enrich 20% uranium and can enrich 60% if needed. 20% is the minimum needed for weapons-grade and is 4-6 times what is needed for civilian power. There were talks between the US and Iran in 2010 about lowering the enrichment levels.

20% is for medical isotopes not power. They can also export not just for domestic use. Good thing we don’t base international law on deduction.

You didn't read my comment. I definitely did not write that 20% is for power.

Please enable Javascript and refresh the page to continue

What?! So I can get my computer infected?!

I was eager for some insight into sophisticated software (either deep or funny - I was open for anything); I was greeted with a prompt to enable JavaScript. I still haven't been able to clean all the irony off my monitor.