Slashdot Mirror
Experts 'Convinced' Duqu Work of Stuxnet Authors
Trailrunner7 writes "Researchers are fairly confident now that whoever wrote the Duqu malware was also involved in developing the Stuxnet worm. They're also confident that they have not yet identified all of the individual components of Duqu, meaning that there are potentially some other capabilities that haven't been documented yet. There was a lot of speculation when Duqu first emerged about whether the attack was the work of the same group--still unknown--that had created Stuxnet and unleashed it on Iran's nuclear facilities last year. Some of that was centered on supposed similarities in the code between the two pieces of malware, but that was before many of the individual components of Duqu had been identified and analyzed. Now that the analysis and research into the Duqu malware have advanced a bit, researchers say they've found more evidence that points to the malware being the work of the Stuxnet authors or their close associates. 'I'm convinced it's the same group,' Costin Raiu, director of global research and analysis at Kaspersky Lab, who has done much of the analysis of Duqu, said."
If Stuxnet is designed to prevent the total destruction of Israel and Duqu is intended to do something similar, shouldn't these "researchers" keep quiet about what they've found? People who mess with the military often find themselves six feet under (unless they're cremated first). I'm sorry, but I think their egos are taking over their common sense.
If I used a sig over again, would anyone notice?
Of course its the CIA.
since the last time we met, Duqu!
So Duqu is estimated to have infected about 50 machines. It's a piece of scouting software that collects and maps information, but doesn't attack. It doesn't even phone home yet. It's obviously not news because of its impact to the broad population of computers on the Internet.
So what exactly is this story telling us? Panic now, because the Stuxnet authors are still on the loose and writing malware? Don't panic at all, because Duqu is obviously targeting an Enemy of the State (like Iran) and not generic PCs? Buy Symantec or Kaspersky antivirus software because their detection has gotten better since Stuxnet?
John
Who is funding Kaspersky labs?
Remember that money makes for strange bedfellows. For instance, take Reuters. They been found to be lying in their reporting in this area... but what few THEN ask, why they ALWAYS been found lying to favor one side.
And if these companies are aiding Iran in keeping its nuclear facilities safe are they aiding it in nuclear development which it is not allowed to do according to UN regulations?
This whole case has more depth to it then just the west vs Iran. Somebody is playing games and we so far only got researchers with funny names and shady funding and Iran to prove any of this.
Remember this all originates from a country that blaims earth quakes on short skirts. To some the truth is not just a flexible concept but nothing different from propaganda shouted really loudly.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
The greatest myth of Stuxnet is that the perpetrators who created it are still a mystery. A retiring Israeli general admitted on _video_ and bragged about the fact that Stuxnet was developed as a joint U.S.-Israeli project to attack Iran's nuclear facilities.
http://www.net-security.org/secworld.php?id=10596
Just today I posted a recent news on this Stuxnet-Duqu issue. Read it here http://slashdot.org/submission/1851158/stuxnet-30-released-at-malcon. Apparently we will hear a lot about this in the near future...
Ralph Langner was the genius behind our knowing about what Stuxnet did. But his team of researchers aren't studying Duqu much because "please note that we don’t research Duqu as it appears to be unrelated to control systems." We don't have that genius picking apart Duqu as we do Stuxnet. But Duqu is not the next stuxnet. It's not nearly as cool. Stuxnet was a very unique virus for several reasons. Duqu is more like just a standard virus. I don't understand why Stuxnet was underplaid and Duqu is so overplayed. If you want the cool information on Stuxnet http://www.langner.com/en/2011/11/09/two-years-later/ is Langner's latest post.
I can never tell if these words in quotes are meant to be taken as literary citations or an indication of sarcasm. I think this 'style' of writing should be 'retired'.
I was checking out the Zeus source the other day, and these worms and botnets really aren't that complicated. I'd be surprised if we didn't see a boom of new worms/botnets because this looks like something any computer science major could come up with in a few days. The real way to avoid these would be to fix the grievous security holes in the main operating systems affected.
If the only way you can accept an assertion is by faith, then you are conceding that it can't be taken on its own merits
Stuxnet has leaked to the public, someone could just copy and modify it.
And haven't been infected by Duqu OR Stuxnet in YEARS. Take that, Linus.
Reading all of these comments on these 00ber-worms really parallels a book called Zero Day that I'm reading. It's fairly entertaining so far, just in case anyone else is interested in a story revolving around Stuxnet/Duqu type stuff. It's probably old news around here, but anyway...
Pinball, arcade video, tech and more: www.micsaund.com
I confess, I wrote Stuxnet and Duqu with BASIC on my Sinclair, during commercial breaks in Married with Children.
Mea culpa.
I promise not to do it again. Really. I promise.
This is fascinating, a team potentially responsible for an military attack on Iran is now in business for themselves? This and the alleged HBgary root kit make it seem as though "The Powers That Be" are taking the low road on the Internet.
As jaded as I am I guess there was still something in me left to turn cynical rather than hopeful.
"If any question why we died, Tell them because our fathers lied."
How the heck do you pronounce "Duqu"?
Utter horse-crap. Gotta post anon, but look.... the evidence for identifying individual actors thru their code is slim-to-none. No, worse, it's complete crap.
To wit: First, There are tons of Stuxnet and Duqu code samples around. Not hard to get -- for example, stored somewhere close by with hundred of people with access including poorly-vetted vendors of all diff nationalities. Kaspersky and Symantec are also both sieves, and so are many other relevant orgs.
Second.... Got IDA Pro? Got a decent IDE? If the bar to entry is $500, pretty much anyone can disassemble the code, and a competent programmer can easily look at the elegant structure and made use of it (re-use, that is). What, it's hard when all the classes and variables are generically named? Oh, please, just looking at the structure and modular payload management, and emulating the evasion functions selected by someone else's good risk/design process would be incredibly useful, and it's not hard to reuse large sections of code wholsesale. I'm surprised that it took this long for good copycats to come along.
That said, prove it wasn't the guy in the next room. Or your netadmin buddy who's always babbling about hacktivism. Once it's in the wild, code similarity doesn't tell you shit about specific actors. It's nonsense, and the fools at Synamtec and Kaspersky should be ashamed to keep pushing it.
Isn't it amazing how much effort humans put into the purpose of destroying one another?
I started to realise this recently while visiting some pre-WWII military sites, mostly former anti-ship and anti-aircraft batteries. So much effort it must have take to build them. It goes to show how much effort other groups must have put in to try and destroy that again. Now if only all that effort would have been put to different, more peaceful uses...
Stuxnet and Duqu are no different. They must have taken a lot of resources to create (in research and software development). Resources lost for other uses. The same accounts for the Iranians of course: the effort they put into building up nuclear facilities and (allegedly) making nuclear bombs is lost on the effort they could put into making their country a better place to live.
AC 'Convinced' Dupes Work of Slashdot Authors... (lame filter /. so lame ; )