New malware appears carrying Stuxnet code

A sibling of one of the most complex and potentially menacing computer worms ever created has impacted roughly five Europe-based manufacturers of industrial control systems, security researchers said Tuesday.

But this malware, dubbed Duqu, is not Stuxnet Part Two, at least not yet.

"It's not doing any type of cyber sabotage like Stuxnet did," Kevin Haley, director of Symantec Security Technology and Response, told SCMagazineUS.com on Tuesday. "It's really at the reconnaissance phase."

According to security firms that examined the code, initially discovered by an unnamed research group that shared the information with the vendors, the threat uses the Stuxnet code, proving the authors of the first-ever malware specifically created to invade industrial control systems, are back at it.

Haley said Symantec researchers examined two variants of Duqu. Once on a machine, the strains download a remote access tool, which allows the malware to take control of the computer and begin communication with a command-and-control hub. In the case of one of the variants studied, it installed an "Infostealer" trojan, designed to record keystrokes and map networks. Duqu is customized to delete itself after 36 days, Haley said.

The exploit code, according to McAfee researchers Guilherme Venere and Peter Szor, mimics Stuxnet in its encryption keys and drivers. Like Stuxnet, the threat uses a driver file signed with a legitimate digital certificate, in this case issued by Taiwan-based C-Media Electronics, according to F-Secure.

"What this means is whoever wrote Stuxnet is back at it again," Haley said. "They're at the phase where they're gathering information. What they're going to do with that information, potentially, is to create the new Stuxnet."

Researchers are still unclear how the malware initially infects a target machine, and how it propagates.

"What it's accomplishing is not sophisticated," Haley said. "It's pretty straightforward. [But] the underlying code itself, some of that code is from Stuxnet, and the Stuxnet code itself is very complex and sophisticated...It's very typical for malware authors to reuse code. This is no different. They felt pretty comfortable the people they were targeting, whatever security they were using, would not discover the code."

Although the origin of Stuxnet, meant to sabotage Iran's nuclear power program by targeting Siemens software, has never been determined, it is widely believed to have originated in the United States or Israel.