Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

168 8. DUQU, FLAME, GAUSS, THE NEXT GENERATION OF CYBER EXPLOITATIONAstonishingly after being used a certain number of times, a Gauss removes itself from the USBstick. Like many of the modules in Gauss, the module that infects USB drives includesencrypted portions that—at the time of this writing—perform functions unknown to commercialand academic security researchers. 25Some security researchers predicted the use of encryption by malware. Nate Lawsonauthored an analysis of Stuxnet that described it as “embarrassing, not amazing.” In this analysis,Lawson references the existence of a code protection system termed “secure triggers,” firstpublished by researchers at the University of Buenos Aires. 26 The “secure triggers” systemdefines a process by which a program can be bound to a specific computer system. 27Lawson argues that knowledge on how to construct such systems has existed in the publicdomain for many years (since 2003), and that it provides a high degree of security and protection.Lawson asserts that this system was not used in Stuxnet, but it was used in Gauss.Furthermore, he asserts that the use of this protection system in Gauss has protected it fromanalysis by Kaspersky. 28However, we should also note that some shortcoming of Stuxnet (such as its susceptibilityto reverse-engineering) may be the result of the simple fact that this malware likely is theproduct of a large organization. It is likely that the different teams working on Stuxnethad varying levels of knowledge, skill, and ability. In such a scenario, we would expectthe quality of different components of the malware to vary. The challenge for the managementteam designated to lead such a project would be to assign those with the better skill-setsto the more critical components of the project.Relationships Among Object-Oriented MalwareAs described earlier in this chapter, some security researchers, in particular those fromKaspersky Labs, believe that Stuxnet and Duqu were created by the same team of hackers.Due to the use of filenames starting with a “d” in both Stuxnet and Duqu, Kaspersky labeledthe source of these pieces of malware the “Tilded platform.” 29 Though there is some similarityin structure and function of Duqu and Flame, most security researchers regard them asdifferent platforms. Hence, Duqu is generally regarded as being less similar to Flame thanit is to Stuxnet. For instance, Kaspersky’s analysis of the Flame command and controlserver—performed using DNS sinkholing (see Chapter 7)—highlights significant differencesbetween the command and control elements of Duqu and Flame. 30 While there is some evidenceof collaboration between the creators of Flame and Stuxnet/Duqu, it appears thatthe current accepted hypothesis is that Stuxnet/Duqu constitutes one framework and Flameanother.At the time of this writing, the association of Gauss with Stuxnet, Duqu, or Flame is an issueof debate. Based on the modular design of Flame and Gauss, as well as the method in whichthey communicate to command and control servers, Kaspersky Labs has labeled Gauss as beingbased on the Flame platform. 31 However, the security firm ESET conducted a comparisonof code in Gauss to Stuxnet and to Flame. b The researchers here found that Gauss was actuallya This has been observed to be 30 times in the current Gauss samples.b The comparison was performed with the BinDiff plugin for the IDA Pro disassembler.