This has gotten a lot of attention in last months and people have tried to bring me into the argument because my book states that Stuxnet used 5 zero-days (one patched before Stuxnet launched so only 4 at time of launch). Liam, Eric and I disagree on what constitutes a 0-day.
https://twitter.com/liam_omurchu/status/1397301030107291650
They say a hard-coded password that Siemens placed in its system was a 0-day because Stuxnet exploited it. I use the conventional definition of a 0-day as something the vendor doesn't know about and has therefore had 0-days to patch it....
The hardcoded password was intentionally placed there by Siemens, and even after Stuxnet was discovered exploiting it, Siemens warned customers not to change the password or the system wouldn't work. That's not a 0-day to me. Eric, Liam and I laugh about it and agree to disagree.
The same is true for another Siemens "vuln" that Stuxnet exploited. It was a feature that Siemens intentionally included in the system to make it easier for engineers, not anticipating that someone would use the feature for malicious purposes. Eric considers this a 0-day, I don't
He points to the fact that CVEs were created for these issues and Siemens eliminated both the feature and the hardcoded password under pressure, post-Stuxnet. Eric believes this shows that they were 0-days. Others may agree that if there are CVEs then it's a 0-day. I don't.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
