Thursday, October 20, 2011

Does Anyone Want the Source Code to Stuxnet? Come and Get It!!! (update 1)





     c:\windows\inf\oem7A.PNF (main payload)
     c:\windows\inf\oem6C.PNF (log file)






Comments, debates, arguments, or compliments always appreciated!


  1. that's just silly. have you looked much at the hex-rays dump? that's not really usable code. and where do you think the attackers got the "improved"/untraceable digital certificates?

    Nope, Tabet's stuff is much better. And the similarities between Duqu's main module and Stux are too close to be re-written from translations. That can be identified from the compiled code and the compiler flags implemented.

  2. I am anything but an expert on (de)compiling or re-use of code.

    But if your theory is true that someone is re-using this code, this adversary also copied the modus operandi of stealing a code signing certificate of a Taiwanese hardware manufacturer. That's not something you can download of the Internet.

  3. I understand your points, and am just throwing out a theory to spark some good dialogue. There is too much sloppy work in Duqu to make me think it is the same authors as the highly sophisticated Stuxnet. How they got the code is still a mystery, but maybe the same "subcontractor" who was asked to steal the first certs actually obtained an extra one! Thanks again for your input and please share any new findings with the community.

