Slashdot Mirror
Precursor To the Next Stuxnet?
An anonymous reader writes "On Oct. 14, 2011 Symantec was alerted to a malware sample from some recovered computers that demonstrated code similar to Stuxnet. This code however appears to serve a different purpose, apparently laying the groundwork for a future Stuxnet type of attack." Quoting Symantec: "The threat was written by the same authors (or those that have access to the Stuxnet source code) and appears to have been created since the last Stuxnet file was recovered. Duqu's purpose is to gather intelligence data and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party. The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility."
... a development like this seemed inevitable, it was only a question of when it would happen again - the mere existence of Stuxnet proved that a malware attack on an industrial control system is not only plausible, but effective if done right. Furthermore, I'm sure the attackers realize that they can cause a lot of damage without ever having to visit a site physically. This fact makes such attacks more difficult than usual to defend against, and not helping matters is that not all industrial control vendors are even aware of security problems with their devices; let alone the time it takes to get a patch tested, validated, and deployed.
The threat was written by the same authors (or those that have access to the Stuxnet source code)
Erm, the stuxnet code was released online, no?
Duqu? Like the count?
Programmers are Star Wars nerds, Film at 11.
Next year, we'll have a worm called 4n4k1n which melts hard drives as if they were dropped into molten lava. Damn, evil geniuses used to give their doomsday weapons classy names like "Ice-9" or "Moonraker" or "Britney Spears".
Random Thoughts From A Diseased Mind (Not For Dummies)
Then you are clearly onto something good!
Seriously, if anyone thought that either a, whoever built Stuxnet or b, all those who said "Wow, that worked well..." wouldn't be stumbling over one another to release ver 2.0 either had their head buried in the sand, or there are pink unicorns farting rainbows in their existence.
I would go further again and say that if anyone thinks that the mega-corporations might not be looking at possible similar little ideas to say knock out a competitors new product range of TVs or to cause problems in that new line of cars with wifi spots is also sadly mistaken. It's not to say that I have a tinfoil hat on or the like, but this is "serious business" when it comes to potentially millions and millions of dollars. Just look at all the fuss and bad press that Toyota got when they had their "funny accelerator pedal" problem a while ago. I can't even remember what the eventual cause was, I do recall reading a number of amusing possible scenarios like particles from space, people getting confused with the pedals and a bunch more - but what if the next time it was simply a virus engineered by a rival manufacturer?
Moved to http://soylentnews.org/. You are invited to join us too!
While it may sound moot, how does one update software and apply security patches to the OS in an air gapped network? I suppose you have someone audit the code with SH1 hashes, store to external removable media, sign and document the transfer with a trusted individual, and apply physical patches?
Life is not for the lazy.
Considering who Stuxnet attacked, perhaps this is not such a bad thing.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Maybe Symnatec can let them attack Iran properly this time?
You could use CD's and the hash audits you mentioned, it would at least be better than giving a device USB access.
It seems that changing target from Siemens to NeXT is a very inefficient way to increase your attack vector. I mean how many NeXT computers are still around these days? ... And yeah, I know , but I really cant be bothered to read anything more than the headline of the articles these days.
If my comment didn't sound as good in your head as it did in mine, then I guess we all know who's to blame
The trojan uses the exact same mechanism as Stuxnet, and has the same compilation date stamp.
This proves that the authors of Stuxnet are behind this? Really?
That stamp would be one of the first things I spoofed.
I am very small, utmostly microscopic.
... or if you can exploit a zero-day in thumbnail handling, right?
Every end has half a stick.
One word answer : money. Any mega-corp, and most midi- and mini- corps, will do pretty much anything for money. It's in the nature of being in business.
Why is it difficult to understand this?
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"