Researchers warn of new Stuxnet worm

Uranium enrichment centrifuge, SPL Stuxnet seems to have been designed to target uranium enrichment systems

Related Stories

Researchers have found evidence that the Stuxnet worm, which alarmed governments around the world, could be about to regenerate.

Stuxnet was a highly complex piece of malware created to spy on and disrupt Iran's nuclear programme.

No-one has identified the worm authors but the finger of suspicion fell on the Israeli and US governments.

The new threat, Duqu, is, according to those who discovered it, "a precursor to a future Stuxnet-like attack".

Its discovery was made public by security firm Symantec, which in turn was alerted to the threat by one of its customers.

The worm was named Duqu because it creates files with the prefix DQ.

Symantec looked at samples of the threat gathered from computer systems located in Europe.

Initial analysis of the worm found that parts of Duqu are nearly identical to Stuxnet and suggested that it was written by either the same authors or those with access to the Stuxnet source code.

"Unlike Stuxnet, Duqu does not contain any code related to industrial control systems and does not self-replicate," Symantec said in its blog.

"The threat was highly targeted towards a limited number of organisations for their specific assets."

In other words, Duqu is not designed to attack industrial systems, such as Iran's nuclear production facilities, as was the case with Stuxnet, but rather to gather intelligence for a future attack.

The code has, according to Symantec, been found in a "limited number of organisations, including those involved in the manufacturing of industrial control systems".

Symantec's chief technology officer Greg Day told the BBC that the code was highly sophisticated.

"This isn't some hobbyist, it is using bleeding-edge techniques and that generally means it has been created by someone with a specific purpose in mind," he said.

Whether that is state-sponsored and politically motivated is not clear at this stage though.

"If it is the Stuxnet author it could be that they have the same goal as before. But if code has been given to someone else they may have a different motive," Mr Day said.

He added that there was "more than one variant" of Duqu.

"It looks as if they are tweaking and fine-tuning it along the way," he said.

The worm also removes itself from infected computers after 36 days, suggesting that it is designed to remain more hidden than its predecessor.

The code used a "jigsaw" of components including a stolen Symantec digital certificate, said Mr Day.

"We provide digital certificates to validate identity and this certificate was stolen from a customer in Taiwan and reused," said Mr Day.

The certificate in question has since been revoked by Symantec.

Cyber warfare

The discovery of the Stuxnet worm was a game-changer in the world of malware and forced governments around the world to beef up the security behind critical systems such as power and water.

Guard at Bushehr nuclear power plant, Iran - 21 August 2010 Iran admitted that Stuxnet had damaged some of its nuclear centrifuges.

It brought the issues of cyber warfare, government-to-government espionage and cyber terrorism firmly to the top of the agenda.

Experts who have studied the Stuxnet worm say that it was configured to damage motors used in uranium-enrichment centrifuges by sending them spinning out of control.

Iran later admitted that some of its centrifuges had been sabotaged although it downplayed the significance of Stuxnet in that.

Stuxnet is not the only example of malware designed to cause government-level disruption.

In 2009 China was accused of spying on Google and in the summer US defence firm Lockheed Martin was victim of a "significant cyber-attack" although it said that none of its programmes had been compromised.

This week the US Department for Homeland Security warned that politically-motivated hackers such as the Anonymous co-operative could begin to target industrial control systems.

More on This Story

Related Stories

More Technology stories

RSS

Features

  • Alana Saarinen at pianoMum, Dad and Mum

    The girl with three biological parents


  • Polish and British flags alongside British roadsideWar debt

    Does the UK still feel a sense of obligation towards Poles?


  • Islamic State fighters parade in Raqqa, Syria (30 June 2014)Who backs IS?

    Where Islamic State finds support to become a formidable force


  • Bride and groom-to-be photographed underwaterWetted bliss

    Chinese couples told to smile, but please hold your breath


  • A ship is dismantled for scrap in the port city of Chittagong, BangladeshDangerous work

    Bangladesh's ship breakers face economic challenge


BBC © 2014 The BBC is not responsible for the content of external sites. Read more.

This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.