Vulnerabilities / Threats
1/3/2012
05:26 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Four Takeaways From The Stuxnet-Duqu Connection

Lessons learned from the latest findings in the Stuxnet and Duqu attacks

Kaspersky Lab revealed last week that commonalities in the drivers used by the information-stealing program Duqu and the Stuxnet attack on Iran's nuclear processing capabilities suggest the two programs were created by the same platform.

The platform, dubbed "Tilded" (pronounced "tilda-dee") due to its use of the characters "~d" in file names, appears to have created versions of the programs dating back to 2008, suggesting that early versions of Duqu might have been created to gather intelligence needed for the Stuxnet operation.

"The differences are so minute that you can interchange the Duqu driver for the Stuxnet driver, and the programs will still load," says Roel Schouwenberg, a senior researcher with Kaspersky. "It is obvious that they are coming from the same factory."

After much debate in the security community, the conclusion that the two attacks are connected and likely to have been launched by the same group offers some interesting conclusions, security experts say.

1. Nation-states are active in cyber.
Prior to Stuxnet and Duqu, security professionals always believed that national governments were conducting active operations on the Internet. Now it's obvious: The resources necessary to test Stuxnet against Iranian industrial systems would require a massive investment. While it's possible that a non-nation-state actor was behind Stuxnet, it's not very plausible, says Kaspersky's Schouwenberg.

"At least one of the actors would have to have the hardware to set up a testing environment," he says. "And that extremely limits the possible actors to a handful, and they are all nation-states."

For companies, especially those in defense or critical infrastructure, the lesson is that cost might not matter and that their connections to a particular nation might put them in jeopardy.

Yet not everyone is convinced that the actors behind the Stuxnet attack and the Duqu espionage network could belong to the same group. The platform might be the same, but it could be provided by a third-party contractor to different government agencies or even different nations, says Don Jackson, a senior security researcher at managed security provider Dell Secureworks.

"It's possible that they are completely different operations that may be overseen by different groups in different countries," Jackson says.

2.'Certificates are not a problem for attackers.
Malicious software is increasingly using stolen signatures to appear more legitimate and evade security software. While less than 2 percent of malware currently uses a signature, attacks launched by nation-states will likely be among them. Duqu and Stuxnet both used drivers signed by the same Realteck Semiconductor certificate, among others, according to Kaspersky.

Companies need to better protect their code-signing signatures. In addition, security software needs to treat digital signatures with a hefty dose of skepticism, Kaspersky's Schouwenberg says.

[New Kaspersky Lab research nails down the platform used for Stuxnet, Duqu, and other targeted attacks, but not all researchers are sold that the exploits are interrelated. See Same Toolkit Spawned Stuxnet, Duqu And Other Campaigns.]

"Now, just because a file is signed by, say, VeriSign, does not mean that we can trust the file," he says. "It definitely makes our life harder."

3. Attribution is still hard.
While researchers are fairly certain that a state actor is responsible for Stuxnet and Duqu, naming the culprit is not easy. Because of the target of Stuxnet -- Iran's nuclear processing capability -- security experts believe that the United States, and possibly with the aid of Israel, could have created and deployed Stuxnet, but nothing is certain.

"It would not be unheard of for the U.S. and the U.K., France, Germany, and Israel to share code that will eventually go public because it is released in an attack," Dell Secureworks' Jackson says.

Cybercriminal groups frequently share or sell platforms for malware creation. Nations could also do that, as well, he says. The security researcher, for example, has found significant similarities between the German surveillance Trojan, R2D2, and the loader code that links Stuxnet and Duqu, suggesting that Germany could be in possession of the framework used to create Stuxnet and Duqu.

"Hackers in one country can borrow from hackers in another country all the time," Jackson says.

4. Finding attacks will only get harder.
Security researchers found Stuxnet only because the attackers made it viral -- that is, gave it the ability to propagate on its own -- to make it likely that the code could infect industrial-control systems not connected to the Internet. On the other hand, it took nearly four years to discover the Duqu malware because the attack is highly targeted. Moreover, without the knowledge of Stuxnet, Duqu could have been written off as a simple cybercriminal attack.

If future attacks are highly targeted, like Duqu, then they could pass unnoticed, says Liam O Murchu, manager of operations for Symantec.

"We have not seen a lot of samples of Duqu," he says. "It is quite possible, and highly likely, that some component we have not seen yet was used to gather information for the Stuxnet attack."

The amount of media attention focused on Stuxnet and Duqu and other Tilded creations will make it even more likely that the group will try some fundamental changes to the code to attempt to escape detection. So companies will have to be more alert.

"In 2010, they changed the loader quite a bit, and one of the reasons as to get around antivirus or security in general," Schouwenberg says. "Especially with all the media attention, they will rewrite it again. And there is no telling what they will do next."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web