Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Four Takeaways From The Stuxnet-Duqu Connection

Lessons learned from the latest findings in the Stuxnet and Duqu attacks

Kaspersky Lab revealed last week that commonalities in the drivers used by the information-stealing program Duqu and the Stuxnet attack on Iran's nuclear processing capabilities suggest the two programs were created by the same platform.

The platform, dubbed "Tilded" (pronounced "tilda-dee") due to its use of the characters "~d" in file names, appears to have created versions of the programs dating back to 2008, suggesting that early versions of Duqu might have been created to gather intelligence needed for the Stuxnet operation.

"The differences are so minute that you can interchange the Duqu driver for the Stuxnet driver, and the programs will still load," says Roel Schouwenberg, a senior researcher with Kaspersky. "It is obvious that they are coming from the same factory."

After much debate in the security community, the conclusion that the two attacks are connected and likely to have been launched by the same group offers some interesting conclusions, security experts say.

1. Nation-states are active in cyber.
Prior to Stuxnet and Duqu, security professionals always believed that national governments were conducting active operations on the Internet. Now it's obvious: The resources necessary to test Stuxnet against Iranian industrial systems would require a massive investment. While it's possible that a non-nation-state actor was behind Stuxnet, it's not very plausible, says Kaspersky's Schouwenberg.

"At least one of the actors would have to have the hardware to set up a testing environment," he says. "And that extremely limits the possible actors to a handful, and they are all nation-states."

For companies, especially those in defense or critical infrastructure, the lesson is that cost might not matter and that their connections to a particular nation might put them in jeopardy.

Yet not everyone is convinced that the actors behind the Stuxnet attack and the Duqu espionage network could belong to the same group. The platform might be the same, but it could be provided by a third-party contractor to different government agencies or even different nations, says Don Jackson, a senior security researcher at managed security provider Dell Secureworks.

"It's possible that they are completely different operations that may be overseen by different groups in different countries," Jackson says.

2.'Certificates are not a problem for attackers.
Malicious software is increasingly using stolen signatures to appear more legitimate and evade security software. While less than 2 percent of malware currently uses a signature, attacks launched by nation-states will likely be among them. Duqu and Stuxnet both used drivers signed by the same Realteck Semiconductor certificate, among others, according to Kaspersky.

Companies need to better protect their code-signing signatures. In addition, security software needs to treat digital signatures with a hefty dose of skepticism, Kaspersky's Schouwenberg says.

[New Kaspersky Lab research nails down the platform used for Stuxnet, Duqu, and other targeted attacks, but not all researchers are sold that the exploits are interrelated. See Same Toolkit Spawned Stuxnet, Duqu And Other Campaigns.]

"Now, just because a file is signed by, say, VeriSign, does not mean that we can trust the file," he says. "It definitely makes our life harder."

3. Attribution is still hard.
While researchers are fairly certain that a state actor is responsible for Stuxnet and Duqu, naming the culprit is not easy. Because of the target of Stuxnet -- Iran's nuclear processing capability -- security experts believe that the United States, and possibly with the aid of Israel, could have created and deployed Stuxnet, but nothing is certain.

"It would not be unheard of for the U.S. and the U.K., France, Germany, and Israel to share code that will eventually go public because it is released in an attack," Dell Secureworks' Jackson says.

Cybercriminal groups frequently share or sell platforms for malware creation. Nations could also do that, as well, he says. The security researcher, for example, has found significant similarities between the German surveillance Trojan, R2D2, and the loader code that links Stuxnet and Duqu, suggesting that Germany could be in possession of the framework used to create Stuxnet and Duqu.

"Hackers in one country can borrow from hackers in another country all the time," Jackson says.

4. Finding attacks will only get harder.
Security researchers found Stuxnet only because the attackers made it viral -- that is, gave it the ability to propagate on its own -- to make it likely that the code could infect industrial-control systems not connected to the Internet. On the other hand, it took nearly four years to discover the Duqu malware because the attack is highly targeted. Moreover, without the knowledge of Stuxnet, Duqu could have been written off as a simple cybercriminal attack.

If future attacks are highly targeted, like Duqu, then they could pass unnoticed, says Liam O Murchu, manager of operations for Symantec.

"We have not seen a lot of samples of Duqu," he says. "It is quite possible, and highly likely, that some component we have not seen yet was used to gather information for the Stuxnet attack."

The amount of media attention focused on Stuxnet and Duqu and other Tilded creations will make it even more likely that the group will try some fundamental changes to the code to attempt to escape detection. So companies will have to be more alert.

"In 2010, they changed the loader quite a bit, and one of the reasons as to get around antivirus or security in general," Schouwenberg says. "Especially with all the media attention, they will rewrite it again. And there is no telling what they will do next."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.