For those not familiar with Stuxnet, it’s a discovered cyber-weapon from 2010 which “reportedly destroyed almost one-fifth of Iran's nuclear centrifuges. ” and “ neither the United States nor Israel has openly admitted responsibility” but likely were the developers [1]

[1-Wikipedia Entry](https://en.wikipedia.org/wiki/Stuxnet)

[2-“Countdown To Zero Day” book if you liked the Wikipedia entry](https://www.audible.com/pd/Countdown-to-Zero-Day-Audiobook/B...)

[3-“Zero Days” movie](https://www.imdb.com/title/tt5446858/)

Pretty amazing to have been pulled off seemingly so successfully.

Very successful in doing what was intended. Less successful in limiting collateral damage; the collateral damage of which was earlier than intended discovery (or discovery at all).

What lessons have they learned, though, so what's out there now, with 10 years more learning, and now AI assistance?

Scary thought. We're all pwnt.

or the (possibly Iranian) sec people they handed the flash drives from the parking lot to?

This is why I jokingly always suggested to people the safest public charger to use was the one the NSA brings to DEFCON/Shmoocon/etc. The NSA ain't burning an exploit on a bunch of nerds. ;)

  g_dwCentrifugeDestroyed++;

Secrecy aside, there may be some other issues with copywriting a product (allegedly) made by a government.

SSDT should probably have a lock. The chance of a race is ~low (higher under heavy sustained workloads) but it's too important to leave to chance.

I'd probably do a rebuild of the directory lists in a separate buffer instead of working in place to avoid alignment fuckups.

Yes I used LLMs, just like I did for all of the other vulns I've found or refined. As you can see from the source, this shit is tedious as hell. Doesn't change the value of knowing what to look/ask for.

Give one of those open models a fresh windows box (not a VM) and tell it to fuck something up, it's fun.

You don't need exploratory docs, try asking one for complete function signatures of all the Windows APIs used, it's going to spit the docs out.

See also: https://www.schneier.com/blog/archives/2015/03/cisco_shippin...

    RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet");

    The original name given by VirusBlokAda was "Rootkit.Tmphider;"[41]
    Symantec, however, called it "W32.Temphid", later changing it to "W32.Stuxnet".[42]
    Its current name is derived from a combination of keywords found in the software (".stub" and "mrxnet.sys").[43][44]

Not one literal string as it appears several times in this purported "reconstruction". Including as the name for a registry key, in the hex code at the end of an EXE header stub ("REALTEK",0x00,"Stuxnet"), and in a frigging autorun.inf as the program name.

Even if Wikipedia is wrong and that string should appear somewhere in the original binary, whatever LLM they used has really been overdoing it beyond the bounds of realism: "Hey look, it's the REAL STUXNET, you've all read about it, here is the 100% real authentic reverse-engineered source code!"

        "instance of ActiveScriptEventConsumer as $Consumer\n"
        "{\n"
        "    Name = \"StuxnetConsumer\";\n"
        "    ScriptingEngine = \"VBScript\";\n"
        "    ScriptText = \"CreateObject(\\\"WScript.Shell\\\").Run \\\"%SystemRoot%\\\\system32\\\\winsta.exe\\\", 0, False\";\n"
        "};\n"

https://medium.com/@arpit.writes/stuxnet-and-the-birth-of-di...