Reconstructed Stuxnet source code posted on GitHub

Hacker News is buzzing about a GitHub repository whose author has posted reconstructed source code for Stuxnet — the very worm that in 2010 became the first known cyberweapon capable of inflicting physical damage on industrial systems.

The author stresses that this is not ready-to-run malware but the product of reverse-engineering the original binary samples, carried out by the global security research community. The code, he says, is intended solely for academic study, malware-analysis practice, and the development of defensive signatures. The project is distributed under the GPL (the description mentions both GPLv3 and AGPL-3.0) and, as noted, runs only on Windows XP and Windows 7.

What's inside

The repository is organized into modules familiar to anyone who has read the classic reports on this attack. It covers the dropper/loader, a privilege-escalation module exploiting a vulnerability in Win32k.sys, the malicious replacement of the s7otbxsx.dll library to intercept communication between Step 7 and Siemens controllers, and the rootkit drivers MRxCls and MRxNet, which hide files, processes, and registry keys by hooking the SSDT.

The description reproduces the logic of the attack in detail: the worm spread via USB drives (LNK exploits), network shares, and P2P; it checked the environment for Siemens software (WinCC, Step 7) and specific PLCs (S7-315, S7-417); and, having found a target, it injected malicious code into the OB1/OB35 blocks. As a result, the frequency converters would spin the centrifuge rotors at abnormal speeds — to the point of mechanical failure.

Instructions and caveats

The author lists the build requirements (Visual Studio, mingw-w64, WDK 7600) and stresses that the code is meant for static analysis in an isolated virtual machine with no internet access, not for “live” use. The recommended tools are IDA Pro, Ghidra, x64dbg, ProcMon, and Wireshark. The acknowledgments list the classic sources on the subject — reports by Symantec, Kaspersky Lab, and ESET.

The post predictably sparked debate: 109 points and three and a half dozen comments on Hacker News. Just how closely the “reconstruction” matches the original, and whether part of the code is a cosmetic rewrite of long-published research, is a question each reader answers for themselves, disassembler in hand.

Source: Hacker News