New malware appears carrying Stuxnet code

Share this article:

A sibling of one of the most complex and potentially menacing computer worms ever created has impacted roughly five Europe-based manufacturers of industrial control systems, security researchers said Tuesday.

But this malware, dubbed Duqu, is not Stuxnet Part Two, at least not yet.

"It's not doing any type of cyber sabotage like Stuxnet did," Kevin Haley, director of Symantec Security Technology and Response, told SCMagazineUS.com on Tuesday. "It's really at the reconnaissance phase."

According to security firms that examined the code, initially discovered by an unnamed research group that shared the information with the vendors, the threat uses the Stuxnet code, proving the authors of the first-ever malware specifically created to invade industrial control systems, are back at it.

Haley said Symantec researchers examined two variants of Duqu. Once on a machine, the strains download a remote access tool, which allows the malware to take control of the computer and begin communication with a command-and-control hub. In the case of one of the variants studied, it installed an "Infostealer" trojan, designed to record keystrokes and map networks. Duqu is customized to delete itself after 36 days, Haley said.

The exploit code, according to McAfee researchers Guilherme Venere and Peter Szor, mimics Stuxnet in its encryption keys and drivers. Like Stuxnet, the threat uses a driver file signed with a legitimate digital certificate, in this case issued by Taiwan-based C-Media Electronics, according to F-Secure.

"What this means is whoever wrote Stuxnet is back at it again," Haley said. "They're at the phase where they're gathering information. What they're going to do with that information, potentially, is to create the new Stuxnet."

Researchers are still unclear how the malware initially infects a target machine, and how it propagates.

"What it's accomplishing is not sophisticated," Haley said. "It's pretty straightforward. [But] the underlying code itself, some of that code is from Stuxnet, and the Stuxnet code itself is very complex and sophisticated...It's very typical for malware authors to reuse code. This is no different. They felt pretty comfortable the people they were targeting, whatever security they were using, would not discover the code."

Although the origin of Stuxnet, meant to sabotage Iran's nuclear power program by targeting Siemens software, has never been determined, it is widely believed to have originated in the United States or Israel.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

ISSA tackles workforce gap with career lifecycle program

ISSA tackles workforce gap with career lifecycle program ...

On Thursday, the group launched its Cybersecurity Career Lifecycle (CSCL) program.

Amplification DDoS attacks most popular, according to Symantec

Amplification DDoS attacks most popular, according to Symantec

The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August.

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.