At GitHub posted the Sadpainy/Stuxnet repository - a reconstruction of the Stuxnet source code in C, assembled by reverse parsing the binaries that came to the researchers in 2010. The tree contains a bootloader, privilege escalation modules, interceptor libraries for working with Siemens S7 controllers, rootkit drivers MRxCls.sys and MRxNet.sys, payload logic. Separate file TODO - Missing.txt the author lists what could not be restored. The README includes academic disclaimers, disclaimers, and "as is" code. The post on Show HN received 176 votes.
Where did this code come from?
The original sources of Stuxnet are not and have never been publicly available. Someone else's reading of the compiled code has been posted, rewritten back into C: function names, file breakdown, comments - the version of the repository author, and not what the worm developers typed into the editor.
Hence the first limitation. You cannot cite this code as proof of “Stuxnet worked like this.” For facts, there are public analyzes of samples made by antivirus laboratories and industrial automation specialists: they relied on the binaries themselves and on behavior at the stands, and their conclusions can be double-checked.
Hence the value. The entire chain is assembled in one tree: entry through removable media, fixation in the kernel with signed drivers, interception of the library through which the engineering station speaks to the controller, substitution of data so that the operator sees the norm. Reading this in a row is more convenient than collecting the same steps from a dozen reports of varying degrees of freshness.
What changes in work
If you write ordinary business software, operationally nothing. There is nothing to compile and run: the antivirus will destroy the artifacts, and in a number of jurisdictions, storing a working sample is a conversation with a lawyer, not a security specialist.
Other things are useful. Stuxnet relied on two assumptions that are still true in every company today. First, the driver signature is considered a pass into the kernel—the certificates for that attack were stolen from third-party manufacturers. The modern analogue is signed build artifacts and CI tokens, located in the environment variables of half the team. Second: removable media inside the perimeter is considered its own. The modern analogue is a developer’s laptop with deployment rights and a dozen editor extensions installed “for review.”
If you have production and something from an automated process control system, the repository should be opened together with the person who is responsible for the circuit. The question “show us where our point is, similar to the interception between the engineering station and the controller” gives more than an abstract audit using a checklist.
Separately about the fate of the repository itself: such projects are regularly closed due to complaints, and I cannot predict the timing. If you are going to read, read now, not when you get around to it.
Rule: reconstruction is suitable as an educational text and not suitable as a source of facts. The verifiable statement about the behavior of the malware is taken from parsing the sample, and not from someone else’s rewriting.