Duqu is no 'hydrogen bomb,' but is part of the new cyber threat
Connecting state and local government leaders
The Stuxnet-related malware is part of the trend toward gathering massive amounts of information for use in future attacks, Bitdefender's online threats chief says.
The “Duqu” malware that showed up in Europe recently caused quite a stir in the cybersecurity world because of its similarity to the infamous Stuxnet worm and its similar focus on industrial systems.
But cries that Duqu alone represents a heavyweight threat — a FoxNews.com headline wondered if it was “The Hydrogen Bomb of Cyberwarfare” — appear to be a tad overstated.
As Symantec researchers said when first reporting Duqu, it is designed to gather information but not do damage, unlike Stuxnet, which derailed Iran’s nuclear program. But because some of its code was nearly identical to Stuxnet’s, Symantec said it was likely written by the same people or by someone with access to the code.
Related stories:
Stuxnet variant, Duqu, found foraging in the wild
Stuxnet targeted five Iranian facilities, report says
Security experts, however, now question whether Stuxnet’s creators are behind Duqu. One indication, in fact, is the reuse of Stuxnet’s code, which had been reverse-engineered and posted on the Internet, said Catalin Cosoi, head of Bitdefender’s Online Threats Lab. Duqu uses a small part of Stuxnet’s code, designed to avoid detection, he said.
Reusing code is a common, efficient practice when building legitimate software, but for malware, “reusing code is not a good idea,” Cosoi said. Antivirus makers have developed heuristics and detection techniques for known viruses, especially one as high-profile as Stuxnet.
Considering Stuxnet’s sophistication, it’s unlikely that the same people would simply cut and paste easily detected code — even code designed to avoid detection — into a new piece of malware, Catalin said. “We’re pretty confident that these guys are a different gang,” he said.
But although Duqu might not represent a major threat in an of itself, it does reflect a trend in the use of malware toward gathering massive amounts of information for use in some future attack, he said.
That trend applies to industrial systems and, more extensively, to individuals, he said.
“The trend is to extract as much private information as possible,” something that is being made a lot easier with the spread of social networks and digital communications, Cosoi said.
People post information on social media sites, such as Facebook, and share contact information and other personal details via smart phones, for which an increasing amount of malware is being written. They also store this information on PCs, which, via apps such as e-mail and Web browsers, are frequent targets of socially engineered spear-phishing attacks — attacks that are aided and abetted by all that personal information that has been posted elsewhere.
The extent of all that personal information lets attackers perform phishing operations that appear to be very credible, Cosoi said. They have come in the form of messages from an organization’s human resources department, for instance, or appear to be from someone the user knows, which increases the chance that a user will click on a link and unknowingly download software that probes a network for critical information.
Quite a few high-profile hacks, such as those of Google, RSA Security and Oak Ridge National Laboratory, began with phishing e-mails. And Cosoi said he expects to see a lot more of these socially engineered attacks.
In that sense, Duqu is in keeping with the malware trend, trying to quietly siphon information for later use. But in the grand scheme of the next major cyber incident, Duqu appears to be mostly a scout.
Cosoi said he does think there will be another Stuxnet, but that “it will be very, very sophisticated” and highly targeted. Although Stuxnet was specifically aimed at Siemens programmable logic controllers used for centrifuges in Iran, it spread widely around the world. In the next such attack, the malware would likely be confined to a few organizations, he said.