New Stuxnet Virus Beta Version Discovered

Stuxnet, the most advanced computer virus ever discovered (by a long way), generally believed to be the first sophisticated example of a virus being used as an international military weapon, just got an upgrade. Most likely from its original authors.

At least, according to Symantec's analysis lab where a recently found version has been dissected on the operating table, it looks like the versions found in the wild "in Europe" were targeted test runs of a new version that was partly recompiled from the original source code which has so far remained secret.

The new version carries a different payload to the original Stuxnet which, it is generally believed, was intended to shut down or disrupt Iranian nuclear facilities. In fact the new version's actual payload is pluggable. Modules can be loaded dynamically from a command and control server located in India.

Duqu, as the new version is called, can read and write files, execute programs, capture keyboard input (to collect passwords) and generally open back doors for later use by the unknown attackers.

Check out the great article on this by Read Write Web and for a quick recap on the original Stuxnet, check this nicely produced - if creepy - video by Hungry Beast in Australia:

China Hackers Update: Arrests and Details

It is inevitable after the Google hacks, as they are known, that China responds by showing its international business partners that they do not condone hacking.

China Daily reports that the biggest hacker training site has been shut down. via RWW

"I could download trojan programs from the site which allowed me to control other people's computers. I did this just for fun but I also know that many other members could make a fortune by attacking other people's accounts," said a 23-year-old member of Black Hawk Safety Net in Nanjing of East China's Jiangsu province, who asked to remain anonymous.

and

They seized nine Web servers, five computers and one car, and shut down all the sites involved in the case, according to the provincial public security department.

So there you go Google - nothing to worry about. The "provincial public security department" got the baddies. Carry on.

Of course there's no reported link with what is now clearly a much larger and more sophisticated program of industrial espionage than previously thought as reported in detail by wired magazine.

The salient points of the wired article are:

• The hacks have compromised thousands of companies, not just 37 as previously reported.
• Most of the compromises are currently still active and law enforcement has been contacting companies to let them know they have been compromised.
• The exploit was an IE 6 security flaw that was first reported to Microsoft by an Israeli researcher in September 2009 but which remained unpatched for months. ("0-day")
• The attack profile include multiple-year-long occupation of companies' computer systems and typically involved hidden siphoning of large amounts of private data including email, documents, etc. This is in contrast to the smash and grab techniques more common in the past.
• Existing security software (like antivirus software) is not able to detect this attack profile or the malware used to initiate it.
• The full extent of data theft will never be known.
• The goal of the attacks appears to be coroporate and national espionage.
• The hackers have levelled up.
• The trail goes dead in Taiwan where the data was siphoned to and China where the spear phishing attacks were initiated from.
  

Now it really feels like we're living in a Neal Stephenson novel.