Researchers find direct link between Flame, Stuxnet malware
Shared source code, says Kaspersky Lab
Computerworld - Security researchers today said that they have found a direct link between the notorious Stuxnet worm and the more-recently-discovered Flame espionage malware, indicating that the two teams cooperated and collaborated.
The news ties Flame to the U.S. and Israeli governments, which reportedly designed and launched Stuxnet in an attempt to sabotage Iran's nuclear program.
"We're very confident that the Flame team shared some of their source code with the Stuxnet group," Roel Schouwenberg, a senior researcher with Moscow-based Kaspersky Lab, said in an online presentation early Monday about the company's findings. "It's conclusive proof that the two worked together, at least once."
Stuxnet, a powerful cyberweapon that crippled parts of Iran's nuclear fuel enrichment effort, was first discovered in mid-2010, but researchers later traced its first variant, and first attack, to June 2009.
Flame's timeline is more murky, but most researchers agree that it goes back at least to 2010.
Today, Kaspersky said that its analysis shows that Flame harks back to no later than the summer of 2008, perhaps earlier.
The two pieces of malware -- Flame for reconnaissance, Stuxnet for attack -- each included a module that appears to originate from the same source code, likely written by a single programmer. That module was used to infect Windows PCs through USB flash drives, and exploited a vulnerability that was patched in June 2009.
When the attack code module was written, however, the vulnerability Microsoft fixed in MS09-025 was still unpatched, and thus a "zero-day" bug. At the time it quashed the flaw, Microsoft said it had not been used in the wild.
Not true, said Kaspersky: The elevation-of-privilege exploit of a Windows kernel vulnerability had been used by both the first version of Stuxnet and early editions of Flame. "The [attack] module had a creation date of February 2009," said Schouwenberg. "It exploited a zero-day at the time of creation, and most likely at the time of Stuxnet's deployment."
That variant, dubbed "Stuxnet.a," was relatively unsuccessful or ultra-quiet, or both, according to researchers. It wasn't until 2010's Stuxnet.b that researchers stumbled upon the worm.
Kaspersky dug into its detection logs last week to look for possible evidence of a link between Flame and Stuxnet, and found one.
"Flame was a kick-starter," Schouwenberg said, explaining the use of the code similar to both Stuxnet and Flame. "In 2010, the Stuxnet group removed that [module], and each team went their separate ways."
Schouwenberg said he wasn't sure why the Stuxnet group pulled the attack module, but speculated that it was because Microsoft patched it several months after its creation. Later versions of Stuxnet relied on a different -- and at the time also unpatched -- vulnerability to do the work of the yanked module. "It was no longer needed, and maybe [the Stuxnet team] did not want to jeopardize the Flame operation."
- 2013 Cyber Risk Report The "Cyber risk report 2013 Executive summary" presents the major findings of HP Security Research's comprehensive dive into today's cyber vulnerability and threat...
- Why You Need a Next-Generation Firewall This white paper explores the reasons for implementing next-generation (NG) firewalls and lays out a path to success for overburdened IT organizations.
- Path Selection Infographic Path Selection Infographic
- Hyperconvergence Infographic A wide range of observers agree that data centers are now entering an era of "hyperconvergence" that will raise network traffic levels faster...
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users? All Malware and Vulnerabilities White Papers | Webcasts