Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Stuxnet and Duqu part of larger cybermalware campaign

Worms could be tip of malware iceberg, Kaspersky researchers suggest

Article comments

The Stuxnet worm was built on the same platform used from 2007 onwards to create a family of cyber-weapon-like malware including the recently-discovered Duqu worm, a forensic analysis by Kaspersky Lab researchers has concluded.

In a detailed analysis, Kaspersky’s Alexander Gostev and Igor Soumenkov lay out the evidence for both pieces of malware having been created using a cybermalware kernel they call ‘tilded’ (after the tendency of its programmers to use the ~d characters at the start of filenames).

The clues to the relationship between Stuxnet and Duqu look compelling and have in part been mentioned by the company before. Both share a common design, featuring an identical division of the programs into parts carrying out similar functions.

However, while analysing a newly discovered driver file from a Chinese PC which contained Duqu files, the researchers discovered that it appeared to be a modified version of a driver file used by Stuxnet. The modification used the same certificate and had the same signing date and time, leading to the conclusion that the two pieces of malware must share common origins.

Running through the company’s malware file database, the team found seven other drivers with similar characteristics, including three - rndismpc.sys, rtniczw.sys and jmidebs.sys - that still can’t be related to specific pieces of malware.

These files cannot interact with any known version of Stuxnet, leaving the researchers to conclude that they were either connected to an earlier version of Duqu or represent fragments from unidentified pieces of malware created by the same team.

“There were a number of projects involving programs based on the 'tilded' platform throughout the period 2007-2011. Stuxnet and Duqu are two of them – there could have been others, which for now remain unknown,” writes Alexander Gostev or Kaspersky Lab.

The team’s evidence is not conclusive but the circumstantial connections between Stuxnet and Duqu are now looking firmer, confounding sceptics who have suggested that the relationship is being overplayed as part of a fashion for geo-political software conspiracies.

In Kaspersky’s analysis, the programs were part of a common effort by a single team dating back at least four years. The evolution of the malware suggests that this development is ongoing and has affected its targets in ways not yet detected or made public.  

What the analysis cannot answer is who was behind what is now widely considered to be most potent cybermalware ever discovered, namely Stuxnet and probably Duqu too. Stuxnet has even recently though less convincingly been connected to the Conficker worm of 2008.

Popular security opinion blames Israel aided by the US but that is speculation. Iran’s nuclear program was Stuxnet’s most obvious victim but Israel and the US are far from the only countries with an interest in seeing it hindered.

“The platform continues to develop, which can only mean one thing – we’re likely to see more modifications in the future,” the researchers conclude.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *