Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
UCS Invicta: Integrated Flash
Deploy flash memory technology to
deliver peak workload performance.

Find out more>>
Security Solutions
Gartner's #1 for endpoint backup
Average Rating:
Rate this article:  
Stuxnet-Like Virus Detected, Intentions Unclear

Stuxnet-Like Virus Detected, Intentions Unclear
By Adam Dickter

Share
Share on Facebook Share on Twitter Share on Linkedin Share on Google Plus

"From a code analysis standpoint it is quite clear that Duqu's authors had access to at least some of the source code from Stuxnet," said security analyst Chet Wisniewsky of the security firm Sophos. "Whether it is the same group or what their intentions are, is hard to tell" because the Stuxnet-like Duqu can download additional components.
 


A malicious code that may have been a top-secret effort to thwart Iran's nuclear program appears to be back in business. But this time, it may not only be a threat to the global ambitions of ayatollahs.

That's the warning of software security and services firm Symantec, which announced the threat on a company blog Tuesday after a client provided samples of code that could be "the next Stuxnet." Symantec did not name the client but said it was a research lab "with strong international connections."

Trojan Horse

Duqu is a remote access Trojan, or RAT, that collects information that could be used for later attacks.

Variants of the threat, dubbed "Duqu" [pronounced dyü-kyü] because its files carry the prefix DQ, were detected as recently as Monday. Duqu appears to have been aimed at a limited number of manufacturing companies. The samples were recovered from systems in Europe and Symantec, which is based in Mountain View, Calif., confirmed that parts of the virus are nearly identical to Stuxnet, which caused mayhem for Iran's uranium enrichment program in the summer of 2010.

Other systems running Siemens industrial software were also affected, but since 60 percent of computers infected were in Iran, there was wide speculation by security specialists that it was created by American or Israeli intelligence operatives, or a collaboration of both.

Duqu's intentions are more amorphous, leaving computer security experts scrambling not just to identify and counter the virus but to decipher its goal.

"From a code analysis standpoint it is quite clear that Duqu's authors had access to at least some of the source code from Stuxnet," said senior analyst Chet Wisniewsky of the security firm Sophos. "Whether it is the same group or what their intentions are, is hard to tell. Considering that this malware can download additional components it makes it much more difficult to determine the intent than Stuxnet."

Targeting Design Documents

Symantec said Duqu is "essentially the precursor to a future Stuxnet-like attack. The threat was written by the same authors (or those that have access to the Stuxnet source code) and appears to have been created since the last Stuxnet file was recovered. Duqu's purpose is to gather intelligence data and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party. The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility."

Symantec said that while the payload of Stuxnet was intended to sabotage an industrial control system, Duqu's payload is general remote access capabilities.

Symantec said that while the threat was aimed at a limited number of organizations it may well be that there are others under attack, as-yet-undetected.

In an update on Tuesday, Symantec said part of the malware had been linked to a Symantec customer in Taipei, Taiwan, and the company revoked that customer's code-signing certificate, but now believes the code was stolen and not generated for hacking purposes.
 

Tell Us What You Think
Comment:

Name:



Protect 100% of your Data The prevalence of laptops and mobile devices in the enterprise makes corporate data increasingly vulnerable to loss and breach. And yet, workforce productivity is now inextricably linked to mobility. Click here to access the white paper "Top 10 Endpoint Backup Mistakes" to learn more about how to confidently protect data across platforms and devices while also providing features designed to enhance the end user experience.


 Security Solutions
1.   9 Norton Security Products Are Now 1
2.   Yahoo Joins Google To Encrypt E-mail
3.   CloudFlare To Offer Free Encryptions
4.   NSA Brings German Encryption Boom
5.   Google Search Promotes Safer Sites


advertisement
9 Norton Security Products Are Now 1
Symantec takes software-as-service tack.
Average Rating:
Yahoo Joins Google To Encrypt E-mail
Using new encryption techniques.
Average Rating:
NSA Brings German Encryption Boom
Snowden transformed security industry.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
UPS Stores in 24 States Hit by Data Breach
Big Brown has been breached. UPS said that about 105,000 customer transactions at 51 of its UPS Store locations in 24 states could have been compromised between January and August.
 
Cost of Target Data Breach: $148 Million Plus Loss of Trust
The now infamous Target data breach is still costing the company -- and its shareholders -- plenty. In fact, the retailing giant forecast the December 2013 incident cost shareholders $148 million.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 

Enterprise Hardware Spotlight
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 
Three New Lenovo PCs Aimed at Business Users
Businesses everywhere want computing solutions that do more for less money, and Lenovo has unveiled three new desktop PCs that offer solid computing at a budget-minded price.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 

Mobile Technology Spotlight
Google Glass Adds Voice Access to Phone Contacts
The latest update to Google Glass will let users access their top 20 phone contacts with voice commands alone. A user can then choose a phone call, Google hangouts, e-mail or text messaging.
 
Samsung, B&N Target Amazon with Nook Tablet
They've seen the enemy and it is Amazon. So Samsung and Barnes & Noble are teaming up to combat their common foe with a 7-inch tablet that blends Samsung’s tech, Nook’s content and e-reader platform.
 
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.