Is Serco behind Stuxnet?

reply to post by JBA2848


Star and flag for you!

I have just read through the opening post and the first thing that came to my mind was that how relatively easy it was to trace the website / IP's / "Owner" / etc.etc..

I have gone throuh the same procedure many times tracing back the senders of phising email and I am just an average person with average logic.

Why could no government agency with billions of $$$ budget not do this within 5 minutes. Why is this gentleman still roaming the streets?

Need I say more?

reply to post by Returners

Basically my gist is that the command and control servers are meaningless as the command and control servers are too easy to take down, all the feds have to do is make a call to the owner of the ip address and tell them to unplug the computer.

You seem to be knowledgeable in this field and this makes me wonder why they have not taken down the servers yet...... Too many questions here that cannot be logically answered....

Originally posted by Ysterlong
reply to post by Returners

 

Basically my gist is that the command and control servers are meaningless as the command and control servers are too easy to take down, all the feds have to do is make a call to the owner of the ip address and tell them to unplug the computer.

You seem to be knowledgeable in this field and this makes me wonder why they have not taken down the servers yet...... Too many questions here that cannot be logically answered....

It has been taken down, the mal code was ridden of months ago.

I have explained it ALREADY

You cannot spread the botnet by P2P initially because you need a large group to make P2P effective.

Its the same concept as bittorent, in order to download something somebody else must have a piece, if the file is uncommon it could take your computer years to complete it if your computer just ran around asking random computers if they have the second piece. (Of course this does not apply because bittorrent has trackers so you know who has it and where it is instead of going around asking random people)

To spread a P2P botnet you need to set up servers intially to purposely spread it. When these servers get shut down the worm starts spreading by P2P.

Spreading a botnet by P2P is all RANDOM LUCK. If only a handful of computers in the world have Stuxnet working the odds of a computer getting the decryption key from one of these are astronomically low because the initiator part of the worm just contacts computers randomly asking if they have the decryption key for Stuxnet. Thats why a hacker needs to not only write the worm but they need to hack servers to purposely propagate it so that it can get big enough to spread on its own.

These servers are the servers used to intially spread the virus, they have been shutdown ages ago. Any relations or links they have to the originator are most likely non existant since they were most likely hacked in the first place.

let me preface by saying im a sarcastic person in general, no insult intended in following remarks

While I admire your initiative to figure the stuxnet cyberwarefare weapon, I highly doubt that a standard dns lookup is going to yeild any real results. While serco may seem like an evil unhuman corp. they are obviously a scape goat.

This rootkit took 8-10 people 6 months to 1 year of manpower to pull this off, yet they openly let you trace the update feature of their handy rootkit back to a website that is registered, bla ba blah

if this truly was the first recorded cyberwarfare attack im sure they can cover their tracks a little better than that.

Time to wake this thread back up - the MSM is just now giving this story some attention.

This virus is supposed to 'revolutionize warfare' as it is designed to hack nuclear sites, sanitation, water, electrical, containment systems for virus-stock, etc...

The Stuxnet "futbol" sites have been sinkholed by Symantec since July.
Sinkholing basically means taking over old domains to check malware traffic.
www.computersecurityarticles.info...

Originally, the sites pointed elsewhere - Denmark and Malaysia:
findingsfromthefield.com...

So, the suspicious IP is not so suspicious after all - it points straight into Symantec's Dublin lab.

-L

Seems the password for the Siemens controllers that were being attacked by STUXnet. Came directly from the maker of the controllers. Siemens. They have a presentation leaked by Wikileaks that shows they offer sabotage of nuclear infrastructure as part of there services.

page 8
http://__._/spyfiles/docs/siemens/15_siemens-intelligence-platform.html