Vulnerabilities / Threats
12/29/2011
01:22 PM
Connect Directly
RSS
E-Mail
50%
50%

Stuxnet, Duqu Date Back To 2007, Researcher Says

Two pieces of malware likely were developed by the same team on the same platform along with similar variants, according to Kaspersky Lab.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The origins of the dangerous Stuxnet computer virus that targeted Iran's nuclear power program last year could date back as far as 2007, according to new research.

Stuxnet and the related Duqu virus discovered earlier this year share a similar architecture and may have been developed by the same team of developers--along with other pieces of malware--several years ago, according to a security researcher at Kapersky Lab.

Researchers have dubbed the platform "Tilded" because its authors tend to use file names which start with "~d," said Alexander Gostav, head of Kapersky's Global Research and Analysis Team, in a blog post.

[ Improve your security. Learn about the 6 Worst Data Breaches Of 2011 . ]

"There were a number of projects involving programs based on the 'Tilded' platform throughout the period 2007-2011," Gostav said. "Stuxnet and Duqu are two of them--there could have been others, which for now remain unknown."

Researchers discovered the connections between the pieces of malware and their origins by examining their drivers, he said.

Gostav warned that the Tilded platform is continuing to develop and more modifications of the viruses are likely to be a threat in the future.

Stuxnet was first discovered in June 2010 when it attacked software and equipment used by various organizations facilitating and overseeing Iran's nuclear program.

The virus was especially worrisome for researchers because of its unprecedented complexity; it contains more than 4,000 functions, which is comparable to the code in some commercial software.

Researchers at the Budapest University of Technology and Economics' CrySyS lab discovered Duqu this past September, saying the malware appears to have been designed to steal industrial control design documents.

After examining Duqu, researchers at Symantec said it was nearly identical to Stuxnet. Both viruses attack Microsoft Windows systems using a zero-day vulnerability, which tries to exploit application vulnerabilities that haven't been discovered yet.

Superworms like Stuxnet and Duqu--which seem to have been created to target the critical infrastructure and control systems of particular countries--are of great concern for federal cybersecurity officials who are working to prevent such dangerous threats to the U.S. power grid and other essential facilities.

Role-based access control based on least user privilege is one of the most effective ways to prevent the compromise of corporate data. Our new report explains why proper provisioning is a growing challenge, due to the proliferation of "big data," NoSQL databases, and cloud-based data storage. Download the report now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Henry Hertz Hobbit
50%
50%
Henry Hertz Hobbit,
User Rank: Apprentice
12/31/2011 | 4:20:33 AM
re: Stuxnet, Duqu Date Back To 2007, Researcher Says
Similarity alone does not indicate causality. I doubt that I am the only person who has excised the walk-down out of the heap sort and embedded the code for doing the walk-down within the sort itself for more speed. In that case the goal itself forces the similarity. When the devices targeted are the same that can also lead to similar code. In addition to that there is some copy-cat going on in code creation. That is especially true for malware where copyright violation would never be contested. I can see all kinds of options here but if the coders are the same, then that may indicate they were working by the behest of some government on Stuxnet but are doing Duqu on their own. How likely is that? It is more likely that who ever is coding Duqu is just a copy-cat of Stuxnet, and the Stuxnet coders in turn merged the works of several other people or groups of people. You really have to look at the intended targets as one more factor to try to deduce who created the code. In any case, Stuxnet should not have been created, especially if it was done for or by one or more governments. Things like that just lead to a downward spiral once others start to copy them.
Bprince
50%
50%
Bprince,
User Rank: Ninja
12/30/2011 | 6:24:23 PM
re: Stuxnet, Duqu Date Back To 2007, Researcher Says
Very interesting. The plot thickens. Due to the nature of Duqu's targets, it doesn't come as a surprise that it turns out to be connected to Stuxnet.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2942
Published: 2014-09-22
Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which makes it easier for attackers to obtain a privileged terminal session by calculating the superuser code, and then leveraging physical access or terminal access to enter this code.

CVE-2014-5522
Published: 2014-09-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6025. Reason: This candidate is a reservation duplicate of CVE-2014-6025. Notes: All CVE users should reference CVE-2014-6025 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-5523
Published: 2014-09-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5524. Reason: This candidate is a duplicate of CVE-2014-5524. Notes: All CVE users should reference CVE-2014-5524 instead of this candidate. All references and descriptions in this candidate have been removed to prevent acciden...

CVE-2014-5575
Published: 2014-09-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVE-2014-5665
Published: 2014-09-22
The Mzone Login (aka com.mr384.MzoneLogin) application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Best of the Web
Dark Reading Radio