Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Four Takeaways From The Stuxnet-Duqu Connection

Lessons learned from the latest findings in the Stuxnet and Duqu attacks

Kaspersky Lab revealed last week that commonalities in the drivers used by the information-stealing program Duqu and the Stuxnet attack on Iran's nuclear processing capabilities suggest the two programs were created by the same platform.

The platform, dubbed "Tilded" (pronounced "tilda-dee") due to its use of the characters "~d" in file names, appears to have created versions of the programs dating back to 2008, suggesting that early versions of Duqu might have been created to gather intelligence needed for the Stuxnet operation.

"The differences are so minute that you can interchange the Duqu driver for the Stuxnet driver, and the programs will still load," says Roel Schouwenberg, a senior researcher with Kaspersky. "It is obvious that they are coming from the same factory."

After much debate in the security community, the conclusion that the two attacks are connected and likely to have been launched by the same group offers some interesting conclusions, security experts say.

1. Nation-states are active in cyber.
Prior to Stuxnet and Duqu, security professionals always believed that national governments were conducting active operations on the Internet. Now it's obvious: The resources necessary to test Stuxnet against Iranian industrial systems would require a massive investment. While it's possible that a non-nation-state actor was behind Stuxnet, it's not very plausible, says Kaspersky's Schouwenberg.

"At least one of the actors would have to have the hardware to set up a testing environment," he says. "And that extremely limits the possible actors to a handful, and they are all nation-states."

For companies, especially those in defense or critical infrastructure, the lesson is that cost might not matter and that their connections to a particular nation might put them in jeopardy.

Yet not everyone is convinced that the actors behind the Stuxnet attack and the Duqu espionage network could belong to the same group. The platform might be the same, but it could be provided by a third-party contractor to different government agencies or even different nations, says Don Jackson, a senior security researcher at managed security provider Dell Secureworks.

"It's possible that they are completely different operations that may be overseen by different groups in different countries," Jackson says.

2.'Certificates are not a problem for attackers.
Malicious software is increasingly using stolen signatures to appear more legitimate and evade security software. While less than 2 percent of malware currently uses a signature, attacks launched by nation-states will likely be among them. Duqu and Stuxnet both used drivers signed by the same Realteck Semiconductor certificate, among others, according to Kaspersky.

Companies need to better protect their code-signing signatures. In addition, security software needs to treat digital signatures with a hefty dose of skepticism, Kaspersky's Schouwenberg says.

[New Kaspersky Lab research nails down the platform used for Stuxnet, Duqu, and other targeted attacks, but not all researchers are sold that the exploits are interrelated. See Same Toolkit Spawned Stuxnet, Duqu And Other Campaigns.]

"Now, just because a file is signed by, say, VeriSign, does not mean that we can trust the file," he says. "It definitely makes our life harder."

3. Attribution is still hard.
While researchers are fairly certain that a state actor is responsible for Stuxnet and Duqu, naming the culprit is not easy. Because of the target of Stuxnet -- Iran's nuclear processing capability -- security experts believe that the United States, and possibly with the aid of Israel, could have created and deployed Stuxnet, but nothing is certain.

"It would not be unheard of for the U.S. and the U.K., France, Germany, and Israel to share code that will eventually go public because it is released in an attack," Dell Secureworks' Jackson says.

Cybercriminal groups frequently share or sell platforms for malware creation. Nations could also do that, as well, he says. The security researcher, for example, has found significant similarities between the German surveillance Trojan, R2D2, and the loader code that links Stuxnet and Duqu, suggesting that Germany could be in possession of the framework used to create Stuxnet and Duqu.

"Hackers in one country can borrow from hackers in another country all the time," Jackson says.

4. Finding attacks will only get harder.
Security researchers found Stuxnet only because the attackers made it viral -- that is, gave it the ability to propagate on its own -- to make it likely that the code could infect industrial-control systems not connected to the Internet. On the other hand, it took nearly four years to discover the Duqu malware because the attack is highly targeted. Moreover, without the knowledge of Stuxnet, Duqu could have been written off as a simple cybercriminal attack.

If future attacks are highly targeted, like Duqu, then they could pass unnoticed, says Liam O Murchu, manager of operations for Symantec.

"We have not seen a lot of samples of Duqu," he says. "It is quite possible, and highly likely, that some component we have not seen yet was used to gather information for the Stuxnet attack."

The amount of media attention focused on Stuxnet and Duqu and other Tilded creations will make it even more likely that the group will try some fundamental changes to the code to attempt to escape detection. So companies will have to be more alert.

"In 2010, they changed the loader quite a bit, and one of the reasons as to get around antivirus or security in general," Schouwenberg says. "Especially with all the media attention, they will rewrite it again. And there is no telling what they will do next."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.


Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-15
The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple production systems running these exact default cre...
PUBLISHED: 2020-07-15
IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever you like. As long as the field isn't empty it will be accepted.
PUBLISHED: 2020-07-15
An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.
PUBLISHED: 2020-07-15
In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This...
PUBLISHED: 2020-07-15
An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032.