Vulnerabilities / Threats
1/3/2012
05:26 PM
Connect Directly
RSS
E-Mail
50%
50%

Four Takeaways From The Stuxnet-Duqu Connection

Lessons learned from the latest findings in the Stuxnet and Duqu attacks

Kaspersky Lab revealed last week that commonalities in the drivers used by the information-stealing program Duqu and the Stuxnet attack on Iran's nuclear processing capabilities suggest the two programs were created by the same platform.

The platform, dubbed "Tilded" (pronounced "tilda-dee") due to its use of the characters "~d" in file names, appears to have created versions of the programs dating back to 2008, suggesting that early versions of Duqu might have been created to gather intelligence needed for the Stuxnet operation.

"The differences are so minute that you can interchange the Duqu driver for the Stuxnet driver, and the programs will still load," says Roel Schouwenberg, a senior researcher with Kaspersky. "It is obvious that they are coming from the same factory."

After much debate in the security community, the conclusion that the two attacks are connected and likely to have been launched by the same group offers some interesting conclusions, security experts say.

1. Nation-states are active in cyber.
Prior to Stuxnet and Duqu, security professionals always believed that national governments were conducting active operations on the Internet. Now it's obvious: The resources necessary to test Stuxnet against Iranian industrial systems would require a massive investment. While it's possible that a non-nation-state actor was behind Stuxnet, it's not very plausible, says Kaspersky's Schouwenberg.

"At least one of the actors would have to have the hardware to set up a testing environment," he says. "And that extremely limits the possible actors to a handful, and they are all nation-states."

For companies, especially those in defense or critical infrastructure, the lesson is that cost might not matter and that their connections to a particular nation might put them in jeopardy.

Yet not everyone is convinced that the actors behind the Stuxnet attack and the Duqu espionage network could belong to the same group. The platform might be the same, but it could be provided by a third-party contractor to different government agencies or even different nations, says Don Jackson, a senior security researcher at managed security provider Dell Secureworks.

"It's possible that they are completely different operations that may be overseen by different groups in different countries," Jackson says.

2.'Certificates are not a problem for attackers.
Malicious software is increasingly using stolen signatures to appear more legitimate and evade security software. While less than 2 percent of malware currently uses a signature, attacks launched by nation-states will likely be among them. Duqu and Stuxnet both used drivers signed by the same Realteck Semiconductor certificate, among others, according to Kaspersky.

Companies need to better protect their code-signing signatures. In addition, security software needs to treat digital signatures with a hefty dose of skepticism, Kaspersky's Schouwenberg says.

[New Kaspersky Lab research nails down the platform used for Stuxnet, Duqu, and other targeted attacks, but not all researchers are sold that the exploits are interrelated. See Same Toolkit Spawned Stuxnet, Duqu And Other Campaigns.]

"Now, just because a file is signed by, say, VeriSign, does not mean that we can trust the file," he says. "It definitely makes our life harder."

3. Attribution is still hard.
While researchers are fairly certain that a state actor is responsible for Stuxnet and Duqu, naming the culprit is not easy. Because of the target of Stuxnet -- Iran's nuclear processing capability -- security experts believe that the United States, and possibly with the aid of Israel, could have created and deployed Stuxnet, but nothing is certain.

"It would not be unheard of for the U.S. and the U.K., France, Germany, and Israel to share code that will eventually go public because it is released in an attack," Dell Secureworks' Jackson says.

Cybercriminal groups frequently share or sell platforms for malware creation. Nations could also do that, as well, he says. The security researcher, for example, has found significant similarities between the German surveillance Trojan, R2D2, and the loader code that links Stuxnet and Duqu, suggesting that Germany could be in possession of the framework used to create Stuxnet and Duqu.

"Hackers in one country can borrow from hackers in another country all the time," Jackson says.

4. Finding attacks will only get harder.
Security researchers found Stuxnet only because the attackers made it viral -- that is, gave it the ability to propagate on its own -- to make it likely that the code could infect industrial-control systems not connected to the Internet. On the other hand, it took nearly four years to discover the Duqu malware because the attack is highly targeted. Moreover, without the knowledge of Stuxnet, Duqu could have been written off as a simple cybercriminal attack.

If future attacks are highly targeted, like Duqu, then they could pass unnoticed, says Liam O Murchu, manager of operations for Symantec.

"We have not seen a lot of samples of Duqu," he says. "It is quite possible, and highly likely, that some component we have not seen yet was used to gather information for the Stuxnet attack."

The amount of media attention focused on Stuxnet and Duqu and other Tilded creations will make it even more likely that the group will try some fundamental changes to the code to attempt to escape detection. So companies will have to be more alert.

"In 2010, they changed the loader quite a bit, and one of the reasons as to get around antivirus or security in general," Schouwenberg says. "Especially with all the media attention, they will rewrite it again. And there is no telling what they will do next."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-4988
Published: 2014-07-09
Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99.1 allows remote attackers to execute arbitrary code via a crafted JLS image file.

CVE-2014-0207
Published: 2014-07-09
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

CVE-2014-0537
Published: 2014-07-09
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via uns...

CVE-2014-0539
Published: 2014-07-09
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via uns...

CVE-2014-3309
Published: 2014-07-09
The NTP implementation in Cisco IOS and IOS XE does not properly support use of the access-group command for a "deny all" configuration, which allows remote attackers to bypass intended restrictions on time synchronization via a standard query, aka Bug ID CSCuj66318.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.