[NSE] Stuxnet detection

[Mak Kolybabi <mak () kolybabi com>]

I've finished the first version of the script, and am submitting it for
(hopefully) inclusion into Nmap. This version successfully detects infected
hosts, or at least the one infected host I had access to. It also did not raise
any false positives on any of the forty other hosts I tested against.

Future versions of this script will include the ability to detect the exact
version of a Stuxnet infection, and offer the option to download a copy of the
executable.

Comments, concerns, criticism, and testing are appreciated.

--
Mak Kolybabi
<mak () kolybabi com>

() ASCII Ribbon Campaign | Against HTML e-mail
/\  www.asciiribbon.org  | Against proprietary extensions

Attachment: stuxnet-detect.nse
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/