Slashdot Mirror


Experts 'Convinced' Duqu Work of Stuxnet Authors

Trailrunner7 writes "Researchers are fairly confident now that whoever wrote the Duqu malware was also involved in developing the Stuxnet worm. They're also confident that they have not yet identified all of the individual components of Duqu, meaning that there are potentially some other capabilities that haven't been documented yet. There was a lot of speculation when Duqu first emerged about whether the attack was the work of the same group--still unknown--that had created Stuxnet and unleashed it on Iran's nuclear facilities last year. Some of that was centered on supposed similarities in the code between the two pieces of malware, but that was before many of the individual components of Duqu had been identified and analyzed. Now that the analysis and research into the Duqu malware have advanced a bit, researchers say they've found more evidence that points to the malware being the work of the Stuxnet authors or their close associates. 'I'm convinced it's the same group,' Costin Raiu, director of global research and analysis at Kaspersky Lab, who has done much of the analysis of Duqu, said."

6 of 85 comments (clear)

  1. Re:Should the researchers keep quiet? by Baloroth · · Score: 5, Informative

    This is probably the intelligence community at work here. If competent (and from the signs of how well created Stuxnet and Duqu are, they are), people who out these things have nothing to fear. It would almost be an open admission of guilt to "make them disappear." Not to mention the risk of being caught. These worms have worked by subtlety and subterfuge, they won't stop doing that now. And that means not killing people. Really, the idea that intelligence agencies work through murder is mostly (definitely not entirely, but mostly) a Hollywood/ New York Times Bestseller invention. In reality, assassination is way to risky to happen often or be used lightly.

    Now, if they were leaking something like a NOC list or exact design documents for thermonuclear warheads, that might be a different story. Stuxnet, however, already did its damage. Duqu probably did too.

    --
    "None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
  2. Re:I would go further by Anonymous Coward · · Score: 3, Informative

    Kaspersky Labs is funded by the sale of Kaspersky AntiVirus and the other security software that they sell direct on kaspersky.com. Everything else in your post in rambling, incoherent drivel that made my head hurt.

  3. its cause we dont have amazing researchers by Tyrannosaur · · Score: 4, Informative

    Ralph Langner was the genius behind our knowing about what Stuxnet did. But his team of researchers aren't studying Duqu much because "please note that we don’t research Duqu as it appears to be unrelated to control systems." We don't have that genius picking apart Duqu as we do Stuxnet. But Duqu is not the next stuxnet. It's not nearly as cool. Stuxnet was a very unique virus for several reasons. Duqu is more like just a standard virus. I don't understand why Stuxnet was underplaid and Duqu is so overplayed. If you want the cool information on Stuxnet http://www.langner.com/en/2011/11/09/two-years-later/ is Langner's latest post.

  4. Re:Should the researchers keep quiet? by Jeng · · Score: 4, Informative

    Really, the idea that intelligence agencies work through murder is mostly (definitely not entirely, but mostly) a Hollywood/ New York Times Bestseller invention. In reality, assassination is way to risky to happen often or be used lightly.

    Remember, we are talking about Israel here, they have no reservations about assassinations.

    http://en.wikipedia.org/wiki/List_of_Israeli_assassinations

    --
    Don't know something? Look it up. Still don't know? Then ask.
  5. Re:All I want to know is.... by Thud457 · · Score: 3, Informative

    How the heck do you pronounce " Duqu "?

    It's pronounced : "for God's sake, keep Lucas away from writing any more Star Wars"

    --

    the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff

  6. Re:Should the researchers keep quiet? by Eunuchswear · · Score: 5, Informative

    Iran is not an arab country.

    --
    Watch this Heartland Institute video