Feeds

Source code smoking gun links Stuxnet AND Flame

Kaspersky: Devious cyber-weapons share software DNA

Beginner's guide to SSL certificates

A direct link exists between the infamous uranium enrichment sabotage worm Stuxnet and the newly uncovered Flame mega-malware, researchers have claimed.

Russian virus protection outfit Kaspersky Lab said in a blog post yesterday that although two separate teams worked on Stuxnet and Flame, the viruses' programmers "cooperated at least once during the early stages of development".

The smoking gun, in the lab's opinion, is a component in an early build of Stuxnet that appears in Flame as a plugin.

The New York Times revealed this month that Stuxnet's infiltration of Iran's nuclear programme, and subsequent knackering of the Middle East nation's uranium centrifuges, was a joint effort by US and Israel. The project, publicly uncovered in June 2010, was initiated by the Bush administration and continued under President Barack Obama.

Stuxnet, which notoriously exploited previously unknown security vulnerabilities in Microsoft Windows to gain access to industrial control systems, was long believed to be state-sponsored and developed by an American-Israeli alliance.

Meanwhile the Flame malware - a sophisticated data-stealing worm that has also been burning through computers in the Middle East and beyond - was active for up to two years before being unearthed by security experts in May this year. A self-destruct command was issued to the espionage virus by its shadowy handlers last week, and to us on the security desk at Vulture Central that sounds an awful lot like a James Bond mission gone wrong.

Here's a quick rundown of what Kaspersky Lab found during its research:

  • A module from the early 2009-version of Stuxnet, known as "Resource 207", was actually a Flame plugin.
  • This means that when the Stuxnet worm was created in the beginning of 2009, the Flame platform already existed, and that in 2009, the source code of at least one module of Flame was used in Stuxnet.
  • This module was used to spread the infection via USB drives. The code of the USB drive infection mechanism is identical in Flame and Stuxnet.
  • The Flame module in Stuxnet also exploited a vulnerability which was unknown at the time and which enabled escalation of privileges, presumably MS09-025.
  • Subsequently, the Flame plugin module was removed from Stuxnet in 2010 and replaced by several different modules that utilized new vulnerabilities.
  • Starting from 2010, the two development teams worked independently, with the only suspected cooperation taking place in terms of exchanging the know-how about the new 'zero-day' vulnerabilities.

Importantly, according to Kaspersky Lab's investigation, the Resource 207 module - an encrypted DLL file - contained a 341,768-byte executable file named atmpsvcn.ocx that has lots in common with the code used in the Flame malware.

"The list of striking resemblances includes the names of mutually exclusive objects, the algorithm used to decrypt strings, and the similar approaches to file naming," the security experts added.

Kaspersky Lab's chief boffin Alexander Gostev noted that completely different development platforms had been used to craft the separate viruses.

"The projects were indeed separate and independent from each other. However, the new findings that reveal how the teams shared source code of at least one module in the early stages of development prove that the groups cooperated at least once. What we have found is very strong evidence that Stuxnet/Duqu and Flame cyber-weapons are connected,” he said.

A technical look at how researchers spotted Flame's code nesting in the early Stuxnet version is available here. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.