Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as it’ll either get patched and/or everyone can reverse engineer it to use.

For those not familiar with Stuxnet, it’s a discovered cyber-weapon from 2010 which “reportedly destroyed almost one-fifth of Iran's nuclear centrifuges. ” and “ neither the United States nor Israel has openly admitted responsibility” but likely were the developers [1]

[1-Wikipedia Entry](https://en.wikipedia.org/wiki/Stuxnet)

[2-“Countdown To Zero Day” book if you liked the Wikipedia entry](https://www.audible.com/pd/Countdown-to-Zero-Day-Audiobook/B...)

[3-“Zero Days” movie](https://www.imdb.com/title/tt5446858/)

▲

BLKNSLVR 2 hours ago | parent | next [-]

Important to note that the system(s) it infected were non-trivially air-gapped, so it had to do the entirety of it's infectious work without command and control servers or receiving any additional input. It had to be an entirely autonomous process from infection to propagation to execution.

Pretty amazing to have been pulled off seemingly so successfully.

▲

theturtletalks 26 minutes ago | parent | next [-]

Yes they actually flooded the market with USB drives with Stuxnet. But it was actually too good and started infecting non-target computers. That’s what got a malware researcher to dig in and he saw multiple zero days being used and deduced it was a Mossad and US operation.

▲

stingraycharles an hour ago | parent | prev [-]

Wasn’t it actually not as successful as it could have been? I recall something about it spreading to more machines than it should have, which caused it to be detected earlier than it should have.

	▲	an hour ago \| parent [-]
		[deleted]

▲

tehjoker 2 hours ago | parent | prev | next [-]

Where did the binaries come from? Did Iran release them?

	▲	nirav72 an hour ago \| parent \| next [-]
		From what I recall reading, stuxnet itself was found in the wild. Even though it was certainly created for a specific target. That’s how security researchers were able to study it fairly quickly. So the binaries were already out there to pull from other infected systems.
	▲	DANmode an hour ago \| parent \| prev [-]
		Are you referring to the government of Iran, or the (possibly Iranian) sec people they handed the flash drives from the parking lot to?

▲

fathermarz 2 hours ago | parent | prev [-]

This is amazingly awesome. Very intriguing and what a great idea in the first place. One of the most important pieces of modern software IMO.