New malware variant: son of Stuxnet?
Today, a co-worker pointed out to me a recent discovery – a precursor to a variant of the Stuxnet worm that appeared last year. In case you have forgotten, Stuxnet was a worm that used several zero-day vulnerabilities and erased itself at a certain point in time. Furthermore, it used two signed certificates from two certificate authorities (possibly stolen, perhaps not) and was a very complex worm. At the time, the original payload was unknown but eventually researchers discovered that it was designed to disrupt the Iranian nuclear program by causing components used in the processing of nuclear material to spin too fast. Nobody claimed responsibility for the worm but industry analysts believe it was a state government and a joint Israeli/US operation. Today, researchers from Symantec and McAfee have discovered another attack in the wild, the next generation of Stuxnet called Duqu. From Darkreading : Researchers at Symantec say newly discovered malware, dubbed "Duqu," shares much of the code from Stuxnet and shows that the authors had access to the source code of Stuxnet, suggesting that it may have been developed by the same attackers who devised Stuxnet.
