Wednesday, October 19, 2011

  • Wednesday, October 19, 2011
  • Elder of Ziyon
From eWeek:
A new worm targeting industrial control system manufacturers has a strong resemblance to Stuxnet, leading researchers to dub it "Son of Stuxnet"

Symantec researchers have discovered a new worm in the wild that has the potential to attack and cripple industrial control systems, much like Stuxnet did.

The new worm, dubbed Duqu, shares a lot of the code with Stuxnet, leading Symantec researchers to believe it was either created by the same team or by another group with access to the Stuxnet source code, Symantec researchers said in a 46-page whitepaper released Oct. 18. Unlike Stuxnet, which was designed to attack a very specific type of computer system, Duqu does not have appear to have a clear target.

Discovered a little over a year ago, Stuxnet is considered one of the most sophisticated pieces of malware ever developed. It compromised several industrial control systems at Iran's Natanz nuclear facility. Observers believe Iran's nuclear program had been set back years by the malware. Despite the fact that researchers around the world have analyzed Stuxnet, the source code is "not out there," according to Mikko Hypponen, chief research officer of F-Secure, noting that "only the original authors have it."

"Duqu is essentially the precursor to a future Stuxnet-like attack," Symantec Security Response researchers wrote on the Symantec Connect blog. The researchers did not speculate on its origins.

Considering the time and resources required to develop tools like this, Lookingglass’ CTO Jason Lewis told eWEEK that a nation state was the likely author.

Duqu's primary purpose at the moment appears to be intelligence-gathering from industrial control system manufacturers, according to Symantec. ...

"The key thing missing here, unlike Stuxnet, is we don't know what they are looking for," Symantec said.

At the moment, Duqu only creates a back door on infected systems and connects with a command-and-control server somewhere in India, according to Symantec. The backdoor is open precisely for 36 days, after which the malware self-destructs.

The C&C server appears to not have sent any instructions yet, Symantec said. The short 36 day lifecycle implies there is a specific target, according to Lewis.

According to McAfee's analysis of the worm, the malware installs drivers and encrypted DLLS that can act as keyloggers on the system to monitor all processes and messages. It also has no mechanism to replicate itself.

McAfee researchers Guilherme Venere and Peter Szor are fairly confident that Duqu was created by the same developers responsible for Stuxnet. They based their conclusions on the fact that both viruses utilize similar encryption keys and techniques, injection code and fraudulent digital certificates which had been issued to companies in Taiwan. The digital certificate keys appear to be real, which also make the programs look legitimate.
I don't know how difficult it is to modify Stuxnet to do other things, but the description here isn't making much sense to me. I cannot see the value of using already-known exploits to try to gather new infomation when everyone with any concept of computer security would have already put up defenses against it.

On the other hand, Symantec says that this code uses a new stolen digital certificate from Taiwan that had not been breached before, and that the code seems to have been written in December 2010. A normal hacker is not usually able to steal digital certificates - that requires real-world espionage.

(h/t CHA, Zach)

EoZTV Podcast

Podcast URL

Subscribe in podnovaSubscribe with FeedlyAdd to netvibes
addtomyyahoo4Subscribe with SubToMe

follow me

search eoz

Loading...

Recent posts from other blogs

comments

Speaking

Follow by Email

Contact

elder -at- elderofziyon dot com

translate

E-Book

For $18 donation








Sample Text

EoZ's Most Popular Posts Ever

Hasbys!

Elder of Ziyon - حـكـيـم صـهـيـون

Elder of Ziyon - حـكـيـم صـهـيـون
This blog may be a labor of love for me, but it takes a lot of effort, time and money. For over 11 years and over 23,000 articles I have been providing accurate, original news that would have remained unnoticed. I've written hundreds of scoops and sometimes my reporting ends up making a real difference. I appreciate any donations you can give to keep this blog going.

Donate!

Monthly subscription:
Payment options

One time donation:

Tweets

Compliments

The Jerusalem Report:"A seemingly indefatigable one-man operation, armed only with a computer, chutzpa and stamina."

Algemeiner: "Fiercely intelligent and erudite"

Omri: "Elder is one of the best established and most respected members of the jblogosphere..."
Atheist Jew:"Elder of Ziyon probably had the greatest impression on me..."
Soccer Dad: "He undertakes the important task of making sure that his readers learn from history."
AbbaGav: "A truly exceptional blog..."
Judeopundit: "[A] venerable blog-pioneer and beloved patriarchal figure...his blog is indispensable."
Oleh Musings: "The most comprehensive Zionist blog I have seen."
Carl in Jerusalem: "...probably the most under-recognized blog in the JBlogsphere as far as I am concerned."
Aussie Dave: "King of the auto-translation."
The Israel Situation:The Elder manages to write so many great, investigative posts that I am often looking to him for important news on the PalArab (his term for Palestinian Arab) side of things."
Tikun Olam: "Either you are carelessly ignorant or a willful liar and distorter of the truth. Either way, it makes you one mean SOB."
Mondoweiss commenter: "For virulent pro-Zionism (and plain straightforward lies of course) there is nothing much to beat it."
Didi Remez: "Leading wingnut"

Interesting Blogs

Categories

Abbas liar Academic fraud administrivia al-Qaeda algeria American Jews Amnesty analysis anti-semitism apartheid arab refugees Arafat archaeology art ASHREI B'tselem bahrain bbc BDS BDSFail Bedouin Beitunia beoz book review breaking the silence Cardozo Chanukah Christians conspiracy theories Cyprus Daphne Anson Davis report DCI-P double standards Egypt Elder gets results ElderToons Electronic Intifada EoZNews eoztv Erekat EU Euro-Mid Observer Fake Civilians 2014 Fatah featured fisking flotilla free gaza freedom of press palestinian style future martyr gaza Gaza Platform George Galloway gideon levy gilad shalit gisha Goldstone Report Good news Grapel Guardian gunness hamas Hamas war crimes hasbara Hasby 2014 Hasby 2016 Hebron helen thomas hezbollah history Hizballah Holocaust denial honor killing HRW Human Rights Humanitarian crisis humor Hypocrisy ICRC Ilan Pappe impossible peace incitement international law intransigence iran Iraq Islamism Israel Loves America Israeli culture Israeli high-tech J Street jabalya jeremy bowen Jerusalem jewish fiction Jewish Voice for Peace jihad jimmy carter John Kerry jokes jonathan cook Jordan Juan Cole Judea-Samaria Kairos Karl Vick ken roth khalid amayreh Khaybar Lebanon leftists Linkdump lumish mahmoud zahar Malaysia max blumenthal McGraw-Hill media bias Methodist Miftah Mohammed Assaf Mondoweiss moonbats music Muslim Brotherhood Nakba Natural gas Nazi NGO NIF norpac NYT Occupation offbeat oxfam PA corruption PalArab lies Palestine Papers pallywood pchr PCUSA Peter Beinart poll Poster Preoccupied Prisoners propaganda Proud to be Zionist purimshpiel Qaradawi Qassam calendar Rafah Ray Hanania real liberals reference Richard Falk rogel alpher roger cohen roger waters Saudi Arabia saudi vice self-death self-death palestinians sex crimes SFSU shechita sheikh tamimi Shujaiyeh SodaStream South Africa Speech stamps Syria Tarabin Temple Mount Terrorism This is Zionism Thomas Friedman Tunisia Turkey UCI UK UN unesco unhrc United Arab Emirates Unity unrwa UNRWA hate unrwa reports UNRWA-USA Vic Rosenthal Washington wikileaks work accident X-washing Yemen zahran zionist attack zoo Zvi

Blog Archive

subscribe via email