While malware such as Stuxnet and Duqu have been known for at least six years now, they are still (to the best of my knowledge) considered to be the most advanced malware ever publicly known.

My question is, what exactly makes them so advanced? Different analyses of Duqu that I have read point to a custom, object-oriented C framework compiled using MSVC ~2008 - no fancy tools nor any novel techniques seem to have been used.

I appreciate that they used 0-day exploits and that they were extremely successful in their intended missions, but does using 0-days actually make the software itself advanced?


0days are usually fairly expensive. You have to consider the manpower required to find them. Then to find a specific sequence of 0days required to hop into a specific framework is closer to a permutation than a combination.

Figure each 0day is worth around $500k.

To find people that have those specific kinds of 0days or know how to find them, in sequence, then to write and obfuscate the code, have it self replicate only in the target systems along a limited pathway, and target very specific PLCs while leaving as little trace as possible requires a lot of very specialized skills that are perishable, a team is necessary. A team defined by mastery of digital logic and systems.

And the team has to keep their mouths shut.

It goes from being tens of millions of possible coders worldwide, to a few hundred, maybe a few thousand, fairly quickly.

As far as the software itself being really advanced... That's a matter of relativity. It pretty much all boils down to a handful of operations in assembly anyway.

  • Upvote. I would only add that they spent a lot of focused time, working in specialized teams. This was highly organized. With Duqu gathering information it helped the Stuxnet writers tailor their code with a :failure it not an option" mindset. – SDsolar May 18 '17 at 7:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.