hackertube.io

27C3: Adventures in analyzing Stuxnet (Bruce Dang from Microsoft)

basti0007 · talk · Watch on YouTube

Security & hacking

What it is

Bruce Dang of Microsoft gives a 27C3 talk on how the Stuxnet vulnerabilities were found and analyzed. He walks through the techniques used to triage them and the details of each zero-day exploit, down to the opcode level.

Why Hacker News recommends it

HN recommends it as the definitive technical deep dive into Stuxnet's zero-days from someone who analyzed it first-hand.

  • 8 people recommended it
  • 7 different months
  • 4 strong recommendations
  • first 2011, last 2024

What HN commenters said

  1. “I watched an excellent video explaining the 0-day vulnerabilities that stuxnet used”

    Explains Stuxnet's zero-day vulnerabilities.

    spudlyo, 2011-02 · Strong recommendation · in “Black ops: how HBGary wrote backdoors for the government”

  2. “It's well worth watching anyway, lots of good info on the various exploits used by stuxnet, down to the opcode level.”

    Opcode-level detail on Stuxnet exploits, with humor.

    JonnieCache, 2011-05 · Strong recommendation · in “Did the US write Stuxnet? Deputy Defense Secretary won't deny it”

  3. “I was on the edge of my seat!”

    Microsoft team analysis of how Stuxnet worked.

    tbrock, 2013-02 · Strong recommendation · in “Stuxnet Missing Link Found, Resolves Some Mysteries Around the Cyberweapon”

  4. “For an amazing technical deep dive into each 0-day Stuxnet vulnerability watch this talk with Bruce Dang from Microsoft[1].”

    Technical deep dive into each Stuxnet zero-day.

    nodesocket, 2021-06 · Strong recommendation · in “Microsoft Patches Six Zero-Day Security Holes”

  5. “a Microsoft employee broke down each of the exploits that Stuxnet used at a conference recently”

    Microsoft employee breaks down each Stuxnet exploit.

    dmix, 2011-02 · Recommendation · in “Stuxnet is now on GitHub”

  6. “detailed analysis of stuxnet”

    Detailed, long analysis of Stuxnet.

    phlux, 2011-06 · Recommendation · in “Stuxnet Virus Weapon Now Being Sold On The Black Market”

  7. “If you haven't watched the tech talks on stuxnet and duqu, please do - super interesting.”

    Tech talks on Stuxnet and Duqu design.

    samstave, 2016-02 · Recommendation · in “Unilateral Israeli changes to Stuxnet caused its exposure, angering US”

  8. “even back then, the analysis was pretty thorough”

    Thorough analysis showing Stuxnet relied on Microsoft zero-days.

    akira2501, 2024-01 · Recommendation · in “Engineer Used Water Pump to Get $1B Stuxnet Malware into Iranian Nuclear Plant”

Excerpts from Hacker News comments, linked to the originals. Summaries and labels were written by a language model from those comments.

Topics: stuxnet, zero-day, malware analysis, reverse engineering, windows vulnerabilities

Also recommended by the same people