178 points • 6 days ago • Article Link

该仓库提供了一个用于教学与研究的 Stuxnet 蠕虫重构项目。通过对 2010 年发现的原始二进制文件进行逆向工程，项目旨在帮助安全研究人员与学生理解这一复杂威胁的工作原理。作者强调，本代码仅供学术分析和防御性研究使用，严禁用于任何恶意目的。

Stuxnet 专门针对 Siemens Step 7 软件以及 S7-300 和 S7-400 型可编程逻辑控制器（PLC）。其成功依赖于复杂的多阶段攻击流程，传播途径包括 USB 移动存储、网络共享和点对点机制。一旦确认目标环境存在，恶意程序会利用高级 rootkit 技术隐藏自身（包括恶意文件、进程和注册表项），在隐蔽运行的同时干预工业控制流程。

重构代码的技术架构展示了明确的执行流程：先进行环境侦察以确认目标 Siemens 软件的存在，随后拦截工程软件与控制器之间的通信，将恶意代码注入关键的运行模块。被注入的逻辑会篡改电机频率，最终使离心机转子达到足以造成机械故障的转速。项目结构对应这些阶段，详细列出各具体组件，例如初始投放程序（dropper）、权限提升利用模块以及用于隐蔽的内核模式驱动程序。

仓库为有兴趣研究该架构的人提供了构建说明，并细分了诸如 S7 hook 库和文件系统 rootkit 等模块。文档建议在隔离的虚拟环境中进行调试和监控，以保障安全。通过剖析诸如频率篡改逻辑等组件，研究人员可以开发更强的防御手段，例如 YARA 规则或针对性的网络检测签名，从而保护关键基础设施免受类似威胁。

总体而言，此次重构为安全社区保存并传承了这段恶意软件的技术史，补充并建立在 Symantec 、 Kaspersky 和 ESET 等组织此前发布的威胁情报之上。尽管 Stuxnet 的最初作者仍未明朗，该项目旨在服务于未来的防御性教育。我们鼓励用户遵守法律与道德规范，将代码作为加固系统的工具，而非仿制危害的范本。 This repository provides an educational and research-oriented reconstruction of the Stuxnet worm, a piece of malware famously recognized as the first cyber-weapon designed to inflict physical damage on industrial control systems. By reverse-engineering original binaries discovered in 2010, the project aims to help security researchers and students understand the mechanics of this complex threat. The authors emphasize that this code is intended strictly for academic analysis and defensive research, strictly prohibiting any use for malicious activities.

Stuxnet was specifically engineered to target Siemens Step 7 software and S7-300 or S7-400 programmable logic controllers. Its operational success relied on a sophisticated multi-stage approach, including propagation through USB drives, network shares, and peer-to-peer mechanisms. Once it identified a target environment, the malware utilized advanced rootkit capabilities to hide its presence, including malicious files, processes, and registry keys, allowing it to operate covertly while manipulating industrial processes.

The technical architecture of the reconstructed code highlights a precise execution flow, beginning with environment reconnaissance to verify the presence of targeted Siemens software. Upon finding a match, the malware intercepts communication between the engineering software and the controllers, injecting malicious code into critical operational blocks. This injection alters motor frequencies, ultimately driving centrifuge rotors to speeds that cause mechanical failure. The project structure mirrors these stages, detailing the specific components involved, such as the initial dropper, privilege escalation exploits, and the kernel-mode drivers used for stealth.

For those interested in exploring this architecture, the repository provides build instructions and a breakdown of modules like the S7 hook libraries and the file system rootkits. The provided documentation suggests that this material is best utilized in isolated, virtual environments to allow for safe debugging and monitoring. By dissecting components like the frequency-tampering logic, researchers can develop more robust defensive measures, such as YARA rules or specialized network signatures, to protect critical infrastructure from similar threats.

Ultimately, this reconstruction serves as a resource for the security community, building upon the foundational threat intelligence previously published by organizations like Symantec, Kaspersky, and ESET. While the original creators of Stuxnet remain unknown, this project preserves the technical history of the malware for future defensive education. Users are encouraged to maintain compliance with legal and ethical standards, treating the code as a tool to strengthen systems rather than a template for harm.