Researchers find direct link between Flame, Stuxnet malware
Shared source code, says Kaspersky Lab
Computerworld - Security researchers today said that they have found a direct link between the notorious Stuxnet worm and the more-recently-discovered Flame espionage malware, indicating that the two teams cooperated and collaborated.
The news ties Flame to the U.S. and Israeli governments, which reportedly designed and launched Stuxnet in an attempt to sabotage Iran's nuclear program.
"We're very confident that the Flame team shared some of their source code with the Stuxnet group," Roel Schouwenberg, a senior researcher with Moscow-based Kaspersky Lab, said in an online presentation early Monday about the company's findings. "It's conclusive proof that the two worked together, at least once."
Stuxnet, a powerful cyberweapon that crippled parts of Iran's nuclear fuel enrichment effort, was first discovered in mid-2010, but researchers later traced its first variant, and first attack, to June 2009.
Flame's timeline is more murky, but most researchers agree that it goes back at least to 2010.
Today, Kaspersky said that its analysis shows that Flame harks back to no later than the summer of 2008, perhaps earlier.
The two pieces of malware -- Flame for reconnaissance, Stuxnet for attack -- each included a module that appears to originate from the same source code, likely written by a single programmer. That module was used to infect Windows PCs through USB flash drives, and exploited a vulnerability that was patched in June 2009.
When the attack code module was written, however, the vulnerability Microsoft fixed in MS09-025 was still unpatched, and thus a "zero-day" bug. At the time it quashed the flaw, Microsoft said it had not been used in the wild.
Not true, said Kaspersky: The elevation-of-privilege exploit of a Windows kernel vulnerability had been used by both the first version of Stuxnet and early editions of Flame. "The [attack] module had a creation date of February 2009," said Schouwenberg. "It exploited a zero-day at the time of creation, and most likely at the time of Stuxnet's deployment."
That variant, dubbed "Stuxnet.a," was relatively unsuccessful or ultra-quiet, or both, according to researchers. It wasn't until 2010's Stuxnet.b that researchers stumbled upon the worm.
Kaspersky dug into its detection logs last week to look for possible evidence of a link between Flame and Stuxnet, and found one.
"Flame was a kick-starter," Schouwenberg said, explaining the use of the code similar to both Stuxnet and Flame. "In 2010, the Stuxnet group removed that [module], and each team went their separate ways."
Schouwenberg said he wasn't sure why the Stuxnet group pulled the attack module, but speculated that it was because Microsoft patched it several months after its creation. Later versions of Stuxnet relied on a different -- and at the time also unpatched -- vulnerability to do the work of the yanked module. "It was no longer needed, and maybe [the Stuxnet team] did not want to jeopardize the Flame operation."
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- Big Data, Big Mess: Sound Risk Intelligence Through Complete Context This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Malware and Vulnerabilities White Papers | Webcasts