Same Platform Made Stuxnet, Duqu; Others Lurk

Posted by timothy on Saturday December 31, 2011 @05:02PM from the what-evil-lurks-in-the-hearts-of-men dept.

wiredmikey writes "New research from Kaspersky Labs has revealed that the platform dubbed 'tilded' (~d), which was used to develop Stuxnet and Duqu, has been around for years. The researchers say that same platform has been used to create similar Trojans which have yet to be discovered. Alexander Gostev and Igor Sumenkov have put together some interesting research, the key point being that the person(s) behind what the world knows as Stuxnet and Duqu have actually been using the same development platform for several years." An anonymous reader adds a link to this "surprisingly entertaining presentation" (video) by a Microsoft engineer, in which "he tells the story of how he and others analysed the exploits used by Stuxnet. Also surprising are the simplicity of the exploits which were still present in Win7." See also the report at Secureist from which the SecurityWeek story draws.

1 of 89 comments (clear)

Min score:

Reason:

Sort:

Re:Linking DLL's from the net. Nice! by complete+loony · 2012-01-01 01:39 · Score: 4, Informative

Reminds me of this hack; 133 byte PE executable with remote code loading.

--
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.