-2

Stuxnet was a clever worm that aimed to malfunction programmable logic controllers on nuclear networks (Iran was the most affected). Nuclear networks were private networks, not supported on Internet Protocol (for security reasons). Stuxnet would infect computers that has IP. Whoever plugged in a USB, that would be infected with Stuxnet also. The aim was to get an someone from the nuclear plant to plug in the USB in their computer, then into the nuclear network and hence the nuclear network was infected. (Read more about it here)

My question is, how does one make a worm to send packets to execute bytes on a computer without the legitimate user downloading the Stuxnet? What kind of service, what port, what type of connection, how is it exploited? How is this even achieved.

For example, Stuxnet was just sent all over the internet and run on any computer it reached, but the legitimate user of the computers never actually ran it themselves. Normally, any thing to run on one's device needs to be downloaded. Trojan Horse virus needs to be downloaded, but this worm does not?

I notice this is pretty advanced stuff, but I can't just get my head around how this works

closed as too broad by schroeder, Mark, Rory Alsop Apr 11 '15 at 8:54

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Paragraphs 1, and 4 for starters: en.wikipedia.org/wiki/Computer_worm – schroeder Apr 11 '15 at 4:46
  • 1
    Deleting and recreating your question in hopes of wiping the close votes will only put you on the radar as someone who tries to circumvent the controls of this forum. I am trying to help you form a better question. – schroeder Apr 11 '15 at 4:48
  • Paragraph 1: "relying on security failures on the target computer". Paragraph 4: "taking advantage of the rootkit and backdoor installed by [other programs]" - you connect to the open service, exploit, run. – schroeder Apr 11 '15 at 5:11
  • There are a thousand vulnerabilities that could be used in a thousand services - what you are asking, then, is the very basics in "remote exploitation". You connect to a vulnerable service in whatever way it is vulnerable, and trigger an exploit. Each vulnerability will have a unique way to connect and exploit. – schroeder Apr 11 '15 at 5:18
  • 2
    Browse exploit-db.com for specifics on 1000's of exploits. – schroeder Apr 11 '15 at 5:19
4

how does one make a worm to send packets to execute bytes on a computer without the legitimate user downloading the Stuxnet?

It has been widely publicised that Stuxnet used at least four 0day vulnerabilities in Windows to circumvent measures which otherwise might have prevented arbitrary code being executed without the user's knowledge. These were basically unknown vulnerabilities to Microsoft and the general community until Stuxnet was discovered and analysed.

Here's the 0day vulnerabilities attributed to Stuxnet:

allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer

CVE-2010-2568

when printer sharing is enabled, does not properly validate spooler access permissions, which allows remote attackers to create files in a system directory, and consequently execute arbitrary code

CVE-2010-2729

do not properly manage a window class, which allows local users to gain privileges by creating a window, then using (1) the SetWindowLongPtr function to modify the popup menu structure, or (2) the SwitchWndProc function with a switch window information pointer

CVE-2010-2744

does not properly determine the security context of scheduled tasks, which allows local users to gain privileges via a crafted application

CVE-2010-3338

Using these vulnerabilities Stuxnet could execute code on a remote machine, elevate its privileges, then repeat the cycle over and over. This is the basically how any worm operates.

In addition Stuxnet utilised two stolen certificates to sign drivers that Windows would trust, enabling it to gain access into the Kernel.

How is this even achieved.

You couldn't use the same vulnerabilities to build a worm like Stuxnet today, you'd have to find new vulnerabilities. As you can imagine these kinds of vulnerabilities are extremely rare and valuable to an attacker.

Trojan Horse virus needs to be downloaded, but this worm does not?

It comes down to economics, if every malware creator had access to these kinds of vulnerabilities then I'm sure they would build worms instead of Trojans. On the other hand a Trojan might be cheaper and just as effective depending on the scenario.

If you're just trying to spread adware then it'd be a waste to use such a valuable vulnerability when you can get a significant number of people to willingly install your malware just by showing them a banner ad saying "Double your RAM today!".

However, if your goal is to infiltrate the nuclear facilities of a foreign country then popup ads won't cut it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.