DuQu… The Evolution Of ‘Weaponized’ Malware Is Unfolding Right In Front Of Our Eyes!

Hello friends,

Today I am going to continue my observations of and re-look at my conclusions on the DuQu.

DuQu… The Evolution Of ‘Weaponized’ Malware Is Unfolding Right In Front Of Our Eyes!

I realize that ‘Weaponized’ is such a graphic term!  Yet, I think that using it to describe the DuQu is no more ‘scaremongering’ than stating Pakistan and India are nuclear powers. As the various unique DuQu infections are slowly being successfully disseminated by the Data Security industry, it is becoming very clear that this is not the work of some cyber-criminal gang or any ‘hacktavist’ group. The DuQu is the first salvo (or pre-salvo if you will) of another operation, or more likely, many seemingly-unrelated operations. Any one of these operations could potentially have a larger visible effect to the world’s population than ANY other malware ever documented before! Or, maybe not. In a flash-back to the CIA’s assassination days, the information gathered by DuQu could (& I wager would) be used to cause a seemingly-isolated ‘incident’ in some critical control system that would result in the death of some ‘High Profile Wanted’ person almost anywhere on the globe (with say, a few days to a week’s notice)! Or realistically it could even easily be all of the above!

Granted the DuQu as we know it now doesn’t appear to be much more than an unbelievably clever spyware, so to deliver on the above statements it would be needing some help. But I would bet the farm ‘that help’ is sitting ready and only waiting on specific parameters to be entered on various blocks of pre-existing code to be ready for compilation right now! Here is some of my reasoning and why I think this…

The first example the world ever saw of any type of ‘weaponized’ code was last year; it was called the Stuxnet. Its target was obviously Iran’s Natanz Nuclear Labs. It was unique in several ways, in that it used an unheard of four different Zero-Day exploits! It was specifically targeted to sabotage the normal operation of Siemens Centrifuge Controllers while simultaneously covering up its activities and presenting a seemingly ‘normal operation’ environment for Iran’s centrifuge operators physically present at those machines! Excuse my language but, that is quite a damn feat! There were a couple of variations of Stuxnet discovered, and the disseminations indicated that the code functions were written in ‘blocks’ (a common practice) and in several different programming languages and the second variation indicated the various ‘blocks’ of code might be interchangeable to add quick customizable functionality! Holy quick versatility, Batman!

November 1, 2011 DuQu is publicly announced by Symantic. Their first impression of the code was it was another variant of the Stuxnet because a percentage of this new code was quickly identified by heuristic scan engines as the Stuxnet. But there were more similarities. Of the six confirmed unique instances of the DuQu, currently being studied by various members of the Data Security industry, evidence exists that every instance was specifically compiled for a specific target. Each one involved in the manufacturing and/or maintenance of industrial control systems. Yes, the types that are commonly used for critical infrastructure control in the developed world. The ‘blocks’ of code seem to indicate that the DuQu’s programing was written in or about Oct ’07 (as did some of the Stuxnet) However, one security company thinks that some of this coding was written as far back as ’04.

The DuQu uses a fresh C&C (Command and Control) Server for every unique instance discovered, which gives DuQu great probabilities of over-all success, as any instance discovered and C&C identified and brought down doesn’t kill any of the yet to be discovered instances still ‘in the wild’. SIDE NOTE: Anonymity could be very fleeting here, as it stands to reason the more C&C Servers identified and studied increases the odds of accurate deduction of the programmer(s) behind these infections.

I find almost all malware’s propagation techniques very interesting reading. My favorite portion of the DuQu’s is its LAN propagation. The initial infection is delivered on to a web facing computer using a malformed .doc file. Where it sits still for 10 minutes or so waiting for computer inactivity. Then it completes its installation and starts sending ‘feelers’ out to find and identify other computers in the LAN neighborhood; specifically, the computers on a non-web facing sub-net. It gathers as much information as it can on this and sends it back to the C&C. Apparently, after human rationalization of the pilfered information, specific attack vectors are settled upon and new a new malware is compiled for the propagation. Then, operators instruct the C&C to send those files needed for the surgical infiltration attempt into the more protected sub-nets. They seem to employ several various tools including key-loggers. If this proves successful the web facing initially infected computer becomes a liaison between the C&C and hopefully the targeted information.

All this doesn’t add up to look like the work of any cyber-criminals or hacktivists that has ever here-to-fore been documented, it’s simply too sophisticated.

Here are some links I read as I formed my conclusions:

http://www.computerworld.com/s/article/9221817/FAQ_What_s_the_big_deal_about_Duqu_?source=CTWNLE_nlt_dailyam_2011-11-15

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf

http://www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploit

http://www.computerworld.com/s/article/9221372/Update_Duqu_exploits_zero_day_flaw_in_Windows_kernel?source=CTWNLE_nlt_pm_2011-11-01

http://www.securelist.com/en/blog/208193243/The_Duqu_Saga_Continues_Enter_Mr_B_Jason_and_TVs_Dexter

http://www.securelist.com/en/blog/606/The_Mystery_of_Duqu_Part_Five

http://en.wikipedia.org/wiki/Stuxnet

http://en.wikipedia.org/wiki/Duqu

http://www.bbc.co.uk/news/technology-11388018

http://arstechnica.com/business/news/2011/10/spotted-in-iran-trojan-duqu-may-not-be-son-of-stuxnet-after-all.ars

http://gcn.com/articles/2011/02/15/stuxnet-targeted-five-iranian-facilities.aspx

Until I sit down to write again, friends please stay safe.
Robert

Technology security and the automobile industry tomorrow.

Hey Folks you remember the movie “Speed”? What about “Who made Who”? They were cool! But what if…

My friends and acquaintances know that the study of smart phone security has been one of my pet projects for some time now. There  is plenty reason to have concerns about the security of your smart phone as I have pointed out repeatedly (at other spots on the web) especially if you use it in any way that needs security (personal banking, tied into a corporate network, etc). But if that wasn’t enough to worry about, let me throw in another security issue on the horizon that is potentially headed your into your daily life. Unauthorized automobile tampering. I’m not referring to the ‘souping up’ some auto enthusiasts do to gain more performance from their vehicles either. I’m speaking of the potential to remotely damage critical safety systems!

Today’s automobile is quite a different machine than it was 15-18 years ago. With the addition of the computer to the automobile there has been an unbelievable rise in fuel economy and service life. That has been the case long enough now that it has begun to be taken for granted. The automotive industry’s R&D departments continue to improve these areas with the marketing of each new model year it seems. But like in so many other industrys the hardening of security seems to be brought on by incidents that require the rethinking of specific situations instead of being developed concurrently to the original product. There are several reasons for such to be the case, the main one is money, but also there is the fact that many security issues that do crop up, have simply never been thought of before the need for action in response to a specific incident. That’s why there are folks out there constantly looking for these potential problems, and sounding off their findings in an attempt to head these potential problems off, before they are reported as a gristly incident in the evening news. I try to pass this style of information along as I come across it in hopes that my personal contacts are at least better informed.

Is there any reason really to be concerned? YES! A few months back I found it intriguing enough to comment on the possibility of a mp3 file being ‘loaded’ to allow access to system critical applications in an automobile. At that time I realized this was an area that I would want to follow closely. The redeeming factor in my view at that time on this subject was one needed physical access to the vehicle to use the exploit even after it was in place. But now with Bluetooth’s wide acceptance for hands free cell communication that is (potentially) no longer the case on many vehicles and soon will not be so for most makes and models! But the scenarios are not just limited to Bluetooth, there are other avenues opening for potential entry, for example, Ford just announced it intends to market a mobile WiFi hot spot in their vehicles! Most of us have at least heard of some the security mishaps that have been exploited in times past (& still exists in varying degrees) in that protocol!

Just how much potential control could be available to a hacker of an automobile? More than you would first think. Using the ECU systems of the modern automobile, car locks could be engaged ( thus holding passengers in the automobile), brakes disabled, individual wheel’s brakes engaged, engine could be stopped or raced, headlight systems controlled, windshield wipers disabled, and more. The part I find the most unsettling in this whole thing is, with a simple reset command followed by a reboot all the code the hacker used to instigate the situation could be irretrievably erased and totally gone, long before any kind of forensics came in to dissect the incident!

Will we ever hear of any of this actually occurring? I hope not. But folks I assure you the Cloak and Dagger types are in the ones in the know! Hey don’t take my word for it, or dismiss out of hand the information is out there on the internet, all you have to gather it in and do some reading to enable you to form an educated opinion on the subject! Here is a few places to start reading.

http://www.autosec.org/pubs/cars-oakland2010.pdf

http://www.computerworld.com/s/article/9176778/Car_hackers_can_kill_brakes_engine_and_more

http://www.csoonline.com/article/676090/with-hacking-music-can-take-control-of-your-car

http://arstechnica.com/security/news/2010/05/car-hacks-could-turn-commutes-into-a-scene-from-speed.ars

http://www.scientificamerican.com/article.cfm?id=wireless-car-hacking

http://www.nytimes.com/2011/03/10/business/10hack.html

http://www.newser.com/story/98172/gearing-up-to-drive-your-car-hackers.html

http://www.security-faqs.com/are-your-car-and-other-devices-susceptible-to-an-attack-from-a-hacker.html

http://techland.time.com/2011/03/17/trojan-mp3-could-let-hackers-take-control-of-your-car/

I hope this has been an interesting read for you. Until next time, have a good one!

Robert Amerson

Let’s have a big “HERE! HERE!” for transparency and ‘open government’! Er Or is that Transparency and Open for Government?

Hey Folks!

I ran across an article today that stopped me and made me think. I challenge you to pause and take a read too.

The thing I find most troubling in this, is the tactic the FBI is using/used that is documented here. You can bet a bakers dozen of the finest doughnuts that this is/has been employed in other systems. We live in the information age people! It matters not if the information is supposed to be ‘confidential’ or not; IT IS ALL TOO AVAILABLE to be perused at someone’s whimsical leisure. Funny how the US government has a hard time with the concept that the sword they like to swing can and is being used to cut them too (Wikileaks). Not that I think Assange is ‘right’ to disclose all that information. In fact, for the most part I personally think Assange is being arguably criminally negligent just to further his own politically motivated irresponsible agenda.

It’s not that I think the government should not ever have access to information that this tactic is designed to provide. BUT there should be an open and transparent procedure involved to safeguard such a powerful tool from misuse by those with less than honorable intent. So, methods for accountability really needs to be viewed as even more important than such tool (or tools similar) itself! Sorry folks, I just can’t be naïve enough to think that all with access to this ‘backdoor’ technology today or in the future will use it in a way that is for the greater good. And worse (Our track record of keeping secrets is dismal when it counts) if it has not already been discovered and being actively used by other nations (it soon will be) for disclosure of Classified state defense secrets right on down to new technology’s research and development in a (likely a state sponsored) corporate environment.

I could go on, but I am supposed to be writing a paper for school (I obviously got side tracked) with any free time I might enjoy today. Comments are welcome.

Until next post…

Robert