Anatomie eines Cyberwars

Stuxnet, Duqu und Flame – der virtuelle Krieg hat begonnen

Buchtitel

Im Entwickler Magazin 5.2012 ist ein Artikel zu Stuxnet und Co. erschienen - den ersten Waffen im Cyberwar.

Links

Stuxnet

[1] F-Secure: Espionage Attack Uses LNK Shortcut Files
[2] Sophos: Windows zero-day vulnerability uses shortcut files on USB
[3] VirusBlokAda: Rootkit.TmpHider
[4] Kaspersky: Myrtus and Guava, Episode 2
[5] Sophos: W32/Stuxnet-B
[6] Kaspersky: Myrtus and Guava, Episode 3
[7] Microsoft Security Advisory (2286198): Vulnerability in Windows Shell Could Allow Remote Code Execution
[8] Microsoft Malware Protection Center: The Stuxnet Sting
[9] F-Secure: More Analysis of Case LNK Exploit
[10] Sophos: Yes, there's malware. But don't change your SCADA password, advises Siemens
[11] Siemens: SIMATIC WinCC / SIMATIC PCS 7: Information about Malware / Viruses / Trojan horses
[12] ISC Diary: Preempting a Major Issue Due to the LNK Vulnerability - Raising Infocon to Yellow
[13] Microsoft Security Response Center: Security Advisory 2286198 Updated
[14] ISC Diary: Lowering infocon back to green
[15] Microsoft Security Response Center: Out of Band Release to address Microsoft Security Advisory 2286198
[16] Microsoft Malware Protection Center: Stuxnet, malicious .LNKs, ...and then there was Sality
[17] Microsoft Security Bulletin MS10-046 - Critical: Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198)
[18] Symantec: Stuxnet Introduces the First Known Rootkit for Industrial Control Systems
[19] Symantec: W32.Stuxnet — Network Information
[20] Kaspersky: Myrtus and Guava, Episode 4
[21] Kaspersky: Myrtus and Guava, Episode MS10-061
[22] Symantec: Stuxnet Using Three Additional Zero-Day Vulnerabilities
[23] Symantec: Stuxnet Print Spooler Zero-Day Vulnerability not a Zero-Day at All?
[24] ThreatPost: Microsoft Missed 2009 Published Article on Stuxnet-Type Attack
[25] Symantec: W32.Stuxnet Variants
[26] Symantec: Stuxnet Before the .lnk File Vulnerability
[27] Symantec: Stuxnet Infection of Step 7 Projects
[28] Sophos: Certified uncertainty
[29] Symantec: Stux to be You
[30] Symantec: Exploring Stuxnet’s PLC Infection Process
[31] tehran times: Iran successfully battling cyber attack
[32] sueddeutsche.de: Computer-Virus Stuxnet trifft deutsche Industrie
[33] Wall Street Journal: Computer Worm Hits Iran Power Plant
[34] Knowledge Brings Fear: stuxnet: targeting the iranian enrichment centrifuges in Natanz?
[36] Symantec: Stuxnet: A Breakthrough
[37] New York Times: Israeli Test on Worm Called Crucial in Iran Nuclear Delay
[38] Marty Edwards, Todd Stauffer: Control System Security Assessments; 2008 Automation Summit (PDF)
[39] Symantec: Updated W32.Stuxnet Dossier is Available
[40] ISSSource: Stuxnet Loaded by Iran Double Agents
[41] New York Times: Obama Order Sped Up Wave of Cyberattacks Against Iran
[42] Kim Zetter: How Digital Detectives Deciphered Stuxnet, the Most Menacing Malware in History
[43] ThreatPost: Report: Iran Resorts to Rip And Replace To Kill Off Stuxnet
[44] Institute for Science and International Security:
a) Did Stuxnet Take Out 1,000 Centrifuges at the Natanz Enrichment Plant? (auch als PDF)
b) Stuxnet Malware and Natanz: Update of ISIS December 22, 2010 Report (auch als PDF)
[45] Sophos: Stuxnet: How USA and Israel created anti-Iran virus, and then lost control of it
[46] Kaspersky: The Day The Stuxnet Died

Duqu

[47] Symantec: W32.Duqu: The Precursor to the Next Stuxnet
[48] Symantec: W32.Duqu
[49] F-Secure: Duqu – Stuxnet 2
[50] F-Secure: Galaxies Collide
[51] McAfee: The Day of the Golden Jackal – The Next Tale in the Stuxnet Files: Duqu Updated
[52] Kaspersky: The Mystery of Duqu: Part One
[53] Symantec: Duqu: Status Updates Including Installer with Zero-Day Exploit Found
[54] Microsoft Security Advisory: (2639658): Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege
[55] Microsoft Security Bulletin: MS11-087 - Critical: Vulnerability in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2639417)
[56] Kaspersky: The Duqu Saga Continues: Enter Mr. B. Jason and TV’s Dexter
[57] Symantec: New Duqu Sample Found in the Wild
[58] Kaspersky: The mystery of Duqu: Part Ten
[59] Kaspersky: Duqu First Spotted as 'Stars' Malware in Iran
[60] Kaspersky: Stuxnet/Duqu: The Evolution of Drivers

Flame

[61] Iran National CERT (MAHER): Identification of a New Targeted Cyber-Attack
[62] Sophos: Flame worm - Iran claims to discover new Stuxnet-like malware
[63] CrySyS Lab: sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex malware for targeted attacks (PDF)
[64] Symantec: W32.Flamer: Enormous Data Collection
[65] Kaspersky: The Flame: Questions and Answers
[66] Kaspersky: Flame: Bunny, Frog, Munch and BeetleJuice…
[67] F-Secure: On Stuxnet, Duqu and Flame
[68] Bruce Schneier: The Failure of Anti-Virus Companies to Catch Military Malware
[69] F-Secure: Commoditization vs. Specialization
[70] McAfee: What the Skywiper Files Tell Us
[71] Carsten Eilers: Flame und die Windows-Updates
[72] Kaspersky: Back to Stuxnet: the missing link
[73] Symantec: Flamer: Urgent Suicide
[74] Kaspersky: The Roof Is on Fire: Tackling Flame’s C&C Servers
[75] Washington Post: U.S., Israel developed Flame computer virus to slow Iranian nuclear efforts, officials say
[76] Carsten Eilers: Internet Explorer: 0-Day-Schwachstelle (und 7 weitere) gepatcht
[77] Bruce Schneier: Cyberwar Treaties

Whitepaper und FAQ

Stuxnet:
- ESET: Stuxnet Under the Microscope (PDF)
- F-Secure: Stuxnet Questions and Answers
- F-Secure: Stuxnet Redux: Questions and Answers
- Symantec: W32.Stuxnet Dossier (PDF)
Duqu
- CrySyS Lab: Duqu: A Stuxnet-like malware found in the wild (PDF)
- F-Secure: Duqu: Questions and Answers
- Kaspersky: Duqu: Steal Everything
- Kaspersky: Duqu FAQ
- McAfee: Duqu– Threat Research and Analysis (PDF)
- Symantec: Duqu: The Precursor to the Next Stuxnet
- Symantec: W32.Duqu - The precursor to the next Stuxnet (PDF)
Flame
- F-Secure: Flame-bait Questions
- F-Secure: Flame is Lame
- Kaspersky: The Flame: Questions and Answers