Stuxnet cyberweapon looks to be one on a production line, researchers say
Evidence is rising that Stuxnet, a cyberweapon that attacked Iran's nuclear facilities in 2009, is part of a supersophisticated manufacturing process for malicious software, two antivirus companies tell the Monitor.
(Page 2 of 3)
"Stuxnet's creators used a [software] platform to package and deliver it, because they wanted to be able to make many cyberweapons easily and be able to change them rapidly for targeting and attack," says Costin Raiu, director of the global research and analysis team at Kaspersky Labs, in a phone interview from Romania.Skip to next paragraph
Subscribe Today to the Monitor
"What's going on seems not so much like a weapons factory as much as a super-secret lab that creates experimental cyberweapons," he adds. "It's more like they're making ion cannons or something – but for cyberwar. These are not normal line weapons, but the highest tech possible to wage cyberwar and cybersabotage."
First signs that Stuxnet was part of a larger family of malicious software, or malware, came with the discovery in September 2010 of Duqu, a specialized espionage program. Duqu appears to be designed to zero in on industrial secrets related to Stuxnet's target, and its code contains digital fingerprints akin to some in Stuxnet, indicating it was created with some of the same source code. Stuxnet's mission, much of it now decoded, was to wreak havoc on Iran's ability to refine nuclear fuel using centrifuges.
"We've done the same analysis Kaspersky has, and seen the same timelines, dates, encryption keys," says Liam O Murchu, manager of operations for Symantec Security Response, in a phone interview. "We think Stuxnet and Duqu are made by the same team, with the same goal.... They can change [the software weapon produced on the common platform], manipulate it, have different payloads."
Using a common malware "platform," or "framework," system can be likened to an auto factory building an exotic car, like a Lamborghini. There are a lot of common parts, but also a bit of artistry. There may be a common frame and engine, but other code has been hand-tooled by expert engineers, Mr. Raiu and Mr. O Murchu agree.
That common platform – for Stuxnet, Duqu, and the rest – is a way to reuse software that was expensive to develop. But it also allows for faster assembly of existing modules into full-blown cyberweapons, which can then be tweaked to sabotage a new industrial control system target or to evade detection.
"Let's imagine you want to steal documents," Raiu adds. "You don't need the sort of sabotage capability built into Stuxnet, so you take that off. Instead, you use the same platform to create targeted malware, but perhaps focusing on espionage instead. That's Duqu."
A light bulb went on last October when Kaspersky researchers looking at Duqu downloaded a different piece of malware that had been on a Chinese computer that also had Duqu on it. At first, the file was misidentified as Stuxnet. But a closer examination showed it was something new and slightly different. So Kaspersky began reexamining its own archive of malware again to see what files might have been missed, dredging up seven in all.
Duqu used two files. Stuxnet used two files. Three others had no affiliated programs. But all of the files shared a common characteristic: They carried a "~d" symbol in their names. That led Kaspersky's researchers to dub the common platform used to create all the files for Duqu, Stuxnet, and the others the Tilde-d, or "Tilded," platform.