Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security

Precursor To the Next Stuxnet? 49

Posted by Unknown Lamer from the us-government-denies-involvement dept.
An anonymous reader writes "On Oct. 14, 2011 Symantec was alerted to a malware sample from some recovered computers that demonstrated code similar to Stuxnet. This code however appears to serve a different purpose, apparently laying the groundwork for a future Stuxnet type of attack." Quoting Symantec: "The threat was written by the same authors (or those that have access to the Stuxnet source code) and appears to have been created since the last Stuxnet file was recovered. Duqu's purpose is to gather intelligence data and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party. The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility."
This discussion has been archived. No new comments can be posted.

Precursor To the Next Stuxnet? More

Precursor To the Next Stuxnet?

Comments Filter:
  • ... a development like this seemed inevitable, it was only a question of when it would happen again - the mere existence of Stuxnet proved that a malware attack on an industrial control system is not only plausible, but effective if done right. Furthermore, I'm sure the attackers realize that they can cause a lot of damage without ever having to visit a site physically. This fact makes such attacks more difficult than usual to defend against, and not helping matters is that not all industrial control vendor

    • Re: (Score:3)

      by mlts ( 1038732 ) *

      Not to mention that Stuxnet showed that one could do a major attack against a country without a single shot being fired.

      Additionally, I'm sure the IRG has a bunch of coders looking to exact revenge... and there are a lot of IT departments run by lazy PHBs who believe in the slogan, "I can just call Geek Squad if we get hacked... otherwise it is too expensive to bother with security."

      So, seeing something Stuxnet based is not a surprise... I just wonder what will be attacked first, some power company whose id

      • Re: (Score:2)

        by tqk ( 413719 )

        So, seeing something Stuxnet based is not a surprise... I just wonder what will be attacked first, some power company whose idea of security is ...

        That's what first occurred to me. The last time we discussed this, a host of security people showed up to testify about the rampant lack of security they'd seen in this area. No air gap, the boss wants to access it from home, default passwords never changed, & etc. What Stuxnet really proved was how vulnerable many very important, powerful, and dangerous systems are. I mean, geez, viruses infiltrating Predator drone control networks? Yikes. Monumental failure doesn't begin to describe it.

        • Re: (Score:2)

          by tqk ( 413719 )

          Oh, and to finish this, what the US/Israel/$whoever could do to Iran, Iran can do to US/Israel/$whoever.

      • Re: (Score:2)

        by tlhIngan ( 30335 )

        So, seeing something Stuxnet based is not a surprise... I just wonder what will be attacked first, some power company whose idea of security is turning off SSID broadcast (but leaving the wireless segment open so the old game console can get on without configuration), or perhaps some manufacturing company who has Joe Sixpack in receiving browsing pr0n between trucks causing malware entry will be the target. It really is only a matter of time when someone will knock something down.

        No. None of the above. Stux

    • They did have to physically visit the site for stuxnrt, it was delivered on USB. You'd imagine control systems would generally be on their own network, seemed that way where I've worked.

      • Re: (Score:2)

        by ttyRazor ( 20815 )

        They wouldn't have to visit the site, just infect the USB drive of someone visiting the site. It'd be a lot easier to target someone who would have reason to visit the site, including foreign contractors.

        • They wouldn't have to visit the site, just infect the USB drive of someone visiting the site. It'd be a lot easier to target someone who would have reason to visit the site, including foreign contractors.

          This is true and that may be how it happened with Stuxnet. If so, it may also have been the primary reason that Stuxnet met with limited success at best. Stuxnet spread too much for its own good. It was detected and analyzed a lot earlier than I suspect its creator would have preferred. The other thing that was likely unanticipated was that the size, complexity, and uniqueness of the code would attract attention from people with the drive to solve mysteries, the knowledge to actually attack the code, an

  • The threat was written by the same authors (or those that have access to the Stuxnet source code)

    Erm, the stuxnet code was released online, no?

    • Re:Original Authors? (Score:4, Informative)

      by chrb ( 1083577 ) on Tuesday October 18, 2011 @05:45PM (#37755212)
      "Stuxnet source code is not out there. Only the original authors have it. So, this new backdoor was created by the same party that created Stuxnet." - F-Secure. [f-secure.com]
      • That's funny, there was lots of talk about the code being out there. I never had much interest in looking for it though... I guess it was all BS.

        • That's funny, there was lots of talk about the code being out there. I never had much interest in looking for it though... I guess it was all BS.

          I thought there was a lot of talk about the code, not about it being out there. You can get pretty far by just looking at the binaries.

      • "Stuxnet source code is not out there. Only the original authors have it. So, this new backdoor was created by the same party that created Stuxnet." - F-Secure.

        Unless someone reverse-engineered the object code. It's been done for lesser reasons.

  • Duqu? (Score:3)

    by Ihmhi ( 1206036 ) <i_have_mental_health_issues@yahoo.com> on Tuesday October 18, 2011 @05:10PM (#37754810)

    Duqu? Like the count?

    Programmers are Star Wars nerds, Film at 11.

    Next year, we'll have a worm called 4n4k1n which melts hard drives as if they were dropped into molten lava. Damn, evil geniuses used to give their doomsday weapons classy names like "Ice-9" or "Moonraker" or "Britney Spears".

    • *This is not the post you are looking to Buzz Kill with facts from the article*

  • Hey, if at first you succeed... (Score:3)

    by Fluffeh ( 1273756 ) on Tuesday October 18, 2011 @05:14PM (#37754846)

    Then you are clearly onto something good!

    Seriously, if anyone thought that either a, whoever built Stuxnet or b, all those who said "Wow, that worked well..." wouldn't be stumbling over one another to release ver 2.0 either had their head buried in the sand, or there are pink unicorns farting rainbows in their existence.

    I would go further again and say that if anyone thinks that the mega-corporations might not be looking at possible similar little ideas to say knock out a competitors new product range of TVs or to cause problems in that new line of cars with wifi spots is also sadly mistaken. It's not to say that I have a tinfoil hat on or the like, but this is "serious business" when it comes to potentially millions and millions of dollars. Just look at all the fuss and bad press that Toyota got when they had their "funny accelerator pedal" problem a while ago. I can't even remember what the eventual cause was, I do recall reading a number of amusing possible scenarios like particles from space, people getting confused with the pedals and a bunch more - but what if the next time it was simply a virus engineered by a rival manufacturer?

    • I can't even remember what the eventual cause was

      Loose nuts behind the steering wheels.

    • "but what if the next time it was simply a virus engineered by a rival manufacturer?"

      - or a virus engineered by somebody who wanted to short a company's stock...

      • "but what if the next time it was simply a virus engineered by a rival manufacturer?"

        - or a virus engineered by somebody who wanted to short a company's stock...

        See, you're getting it now!

    • Re: (Score:2)

      by jon3k ( 691256 )
      FUD.
      • Agree. FUD. If it doesn't pass pre-existing AV, its either old or poorly done. The A team hackers don't forget to check their code against antivirus.

    • Seriously, if anyone thought that either a, whoever built Stuxnet or b, all those who said "Wow, that worked well..." wouldn't be stumbling over one another to release ver 2.0 either had their head buried in the sand, or there are pink unicorns farting rainbows in their existence.

      It will be interesting to see if it does occur. A couple of interesting points:

      1. Stuxnet was extremely sophisticated and included four 0day exploits in it to propagate. That is a lot of advantage to blow on something like this for the average virus author.
      2. For all intents and purposes Stuxnet was designed to propagate on a LAN and targeted specific systems. Much of the code will not generalize well, even if it could be disassembled.
      3. The code hiding and organization was extremely convoluted and it is un

    • Re: (Score:2)

      by martas ( 1439879 )
      there was no cause, because there was no problem -- it was just media panic.

    • Re: (Score:1)

      by Jazari ( 2006634 )

      I would go further again and say that if anyone thinks that the mega-corporations might not be looking at possible similar little ideas to say knock out a competitors ... Toyota got when they had their "funny accelerator pedal" problem a while ago. I can't even remember what the eventual cause was,

      No major corporation would ever do this. Not because they are benevolent, but because the penalty for being caught would be huge: possible bankruptcy and liquidation following massive lawsuit and criminal investigation, plus jail time for the executives. Governments can get away with this because they write the laws and can enforce secrecy. Corporations will eventually be ratted out by their subcontractors.

      Toyota: the problem was proven to be entirely due to driver error except due to a few cases of f

  • Considering who Stuxnet attacked, perhaps this is not such a bad thing.

  • Lovely! (Score:1)

    by Anonymous Coward

    Maybe Symnatec can let them attack Iran properly this time?

  • It seems that changing target from Siemens to NeXT is a very inefficient way to increase your attack vector. I mean how many NeXT computers are still around these days? ... And yeah, I know , but I really cant be bothered to read anything more than the headline of the articles these days.

  • The trojan uses the exact same mechanism as Stuxnet, and has the same compilation date stamp.

    This proves that the authors of Stuxnet are behind this? Really?

    That stamp would be one of the first things I spoofed.

Slashdot Top Deals

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Close