Stuxnet copycat appears, targets European vendors

A relative of Stuxnet, one of the most complex and potentially menacing computer worms ever created, has impacted five Europe-based manufacturers of industrial control systems.

But the new malware, dubbed Duqu, is not quite the son of Stuxnet, researchers said.

"It's not doing any type of cyber sabotage like Stuxnet did," Symantec security technology and response director Kevin Haley said.

"It's really at the reconnaissance phase."

Duqu was first discovered by an unnamed research group that shared the information with vendors.

It is believed attacks using Duqu could stretch back as far as December 2010.

Later research found that it contained Stuxnet code designed to invade industrial control systems.

Stuxnet, discovered in June last year, was considered one of the most advanced peices of malware ever written. It contained four zero-day exploits and crippled Iran's uranium centrifuges.

Symantec researchers examined two variants of Duqu.

Once on a machine, the strains download a remote access tool, which allows the malware to take control of the computer and begin communication with a command-and-control hub.

One variant studied installed an "Infostealer" trojan, designed to record keystrokes and map networks. Duqu is customised to delete itself after 36 days, Haley said.

The exploit code, according to McAfee researchers Guilherme Venere and Peter Szor, mimiced Stuxnet in its encryption keys and drivers.

Like Stuxnet, the threat uses a driver file signed with a legitimate digital certificate, in this case issued by Taiwan-based C-Media Electronics, according to F-Secure.

Researchers were still unclear how the malware initially infected a target machine, and how it propagated.

"What it's accomplishing is not sophisticated," Haley said. "It's pretty straightforward. [But] the underlying code itself, some of that code is from Stuxnet, and the Stuxnet code itself is very complex and sophisticated...It's very typical for malware authors to reuse code."

"This is no different. They felt pretty comfortable the people they were targeting, whatever security they were using, would not discover the code."

The origins of Stuxnet, meant to sabotage Iran's nuclear power program by targeting Siemens software, has never been determined but it is widely believed to have originated in the US or Israel.

This article originally appeared at scmagazineus.com