Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Four Takeaways From The Stuxnet-Duqu Connection

Lessons learned from the latest findings in the Stuxnet and Duqu attacks

Kaspersky Lab revealed last week that commonalities in the drivers used by the information-stealing program Duqu and the Stuxnet attack on Iran's nuclear processing capabilities suggest the two programs were created by the same platform.

The platform, dubbed "Tilded" (pronounced "tilda-dee") due to its use of the characters "~d" in file names, appears to have created versions of the programs dating back to 2008, suggesting that early versions of Duqu might have been created to gather intelligence needed for the Stuxnet operation.

"The differences are so minute that you can interchange the Duqu driver for the Stuxnet driver, and the programs will still load," says Roel Schouwenberg, a senior researcher with Kaspersky. "It is obvious that they are coming from the same factory."

After much debate in the security community, the conclusion that the two attacks are connected and likely to have been launched by the same group offers some interesting conclusions, security experts say.

1. Nation-states are active in cyber.
Prior to Stuxnet and Duqu, security professionals always believed that national governments were conducting active operations on the Internet. Now it's obvious: The resources necessary to test Stuxnet against Iranian industrial systems would require a massive investment. While it's possible that a non-nation-state actor was behind Stuxnet, it's not very plausible, says Kaspersky's Schouwenberg.

"At least one of the actors would have to have the hardware to set up a testing environment," he says. "And that extremely limits the possible actors to a handful, and they are all nation-states."

For companies, especially those in defense or critical infrastructure, the lesson is that cost might not matter and that their connections to a particular nation might put them in jeopardy.

Yet not everyone is convinced that the actors behind the Stuxnet attack and the Duqu espionage network could belong to the same group. The platform might be the same, but it could be provided by a third-party contractor to different government agencies or even different nations, says Don Jackson, a senior security researcher at managed security provider Dell Secureworks.

"It's possible that they are completely different operations that may be overseen by different groups in different countries," Jackson says.

2.'Certificates are not a problem for attackers.
Malicious software is increasingly using stolen signatures to appear more legitimate and evade security software. While less than 2 percent of malware currently uses a signature, attacks launched by nation-states will likely be among them. Duqu and Stuxnet both used drivers signed by the same Realteck Semiconductor certificate, among others, according to Kaspersky.

Companies need to better protect their code-signing signatures. In addition, security software needs to treat digital signatures with a hefty dose of skepticism, Kaspersky's Schouwenberg says.

[New Kaspersky Lab research nails down the platform used for Stuxnet, Duqu, and other targeted attacks, but not all researchers are sold that the exploits are interrelated. See Same Toolkit Spawned Stuxnet, Duqu And Other Campaigns.]

"Now, just because a file is signed by, say, VeriSign, does not mean that we can trust the file," he says. "It definitely makes our life harder."

3. Attribution is still hard.
While researchers are fairly certain that a state actor is responsible for Stuxnet and Duqu, naming the culprit is not easy. Because of the target of Stuxnet -- Iran's nuclear processing capability -- security experts believe that the United States, and possibly with the aid of Israel, could have created and deployed Stuxnet, but nothing is certain.

"It would not be unheard of for the U.S. and the U.K., France, Germany, and Israel to share code that will eventually go public because it is released in an attack," Dell Secureworks' Jackson says.

Cybercriminal groups frequently share or sell platforms for malware creation. Nations could also do that, as well, he says. The security researcher, for example, has found significant similarities between the German surveillance Trojan, R2D2, and the loader code that links Stuxnet and Duqu, suggesting that Germany could be in possession of the framework used to create Stuxnet and Duqu.

"Hackers in one country can borrow from hackers in another country all the time," Jackson says.

4. Finding attacks will only get harder.
Security researchers found Stuxnet only because the attackers made it viral -- that is, gave it the ability to propagate on its own -- to make it likely that the code could infect industrial-control systems not connected to the Internet. On the other hand, it took nearly four years to discover the Duqu malware because the attack is highly targeted. Moreover, without the knowledge of Stuxnet, Duqu could have been written off as a simple cybercriminal attack.

If future attacks are highly targeted, like Duqu, then they could pass unnoticed, says Liam O Murchu, manager of operations for Symantec.

"We have not seen a lot of samples of Duqu," he says. "It is quite possible, and highly likely, that some component we have not seen yet was used to gather information for the Stuxnet attack."

The amount of media attention focused on Stuxnet and Duqu and other Tilded creations will make it even more likely that the group will try some fundamental changes to the code to attempt to escape detection. So companies will have to be more alert.

"In 2010, they changed the loader quite a bit, and one of the reasons as to get around antivirus or security in general," Schouwenberg says. "Especially with all the media attention, they will rewrite it again. And there is no telling what they will do next."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system...
PUBLISHED: 2021-03-07
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_...