Duqu 2.0 Hits Kaspersky Lab • Hacker News Board

Re: Duqu 2.0 Hits Kaspersky Lab

#11

Post by btilly » Wed, Jun 10, 2015, 4:02 PM UTC

The geopolitics of this one is fascinating.

Stuxnet was a combined Israeli/US attack on Iran's nuclear capability. Kaspersky is a Russian security company which was started with government support, and is believed to still have connections there. Russia and Iran are allies.

Now look at how it played out. The US and Israel attacked Iran. Kaspersky tracked it down and publicized it to the world. And now some combination of the US, Israel, or close allies launched a spying attack on Kaspersky. Which, for all we know, may actually be an important part of the Russian cybersecurity infrastructure.

For all that organizations like the NSA do wrong (like spying on all of us), this is the kind of thing that we actually wanted them doing when they were created.

Re: Duqu 2.0 Hits Kaspersky Lab

#12

Post by shthed » Wed, Jun 10, 2015, 4:03 PM UTC

dbhattar wrote: post #5

I cannot but wonder what would have been the response here if similar attack had occurred inside Google or Facebook.

They might have been attacked too, just not disclosed or even discovered it yet.

Re: Duqu 2.0 Hits Kaspersky Lab

#13

Post by shthed » Wed, Jun 10, 2015, 4:05 PM UTC

Will be interesting to see who else was targeted by this, looks like Kaspersky is just the first to disclose it:

http://www.kaspersky.com/about/news/virus/2015/Duqu-is-back

"Kaspersky Lab would like to reiterate that these are only preliminary results of the investigation. There is no doubt that this attack had a much wider geographical reach and many more targets. But judging from what the company already knows, Duqu 2.0 has been used to attack a complex range of targets at the highest levels with similarly varied geo-political interests."

Re: Duqu 2.0 Hits Kaspersky Lab

#14

Post by omgitstom » Wed, Jun 10, 2015, 4:07 PM UTC

Technical details were released yesterday:

https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0...

Re: Duqu 2.0 Hits Kaspersky Lab

#15

Post by avodonosov » Wed, Jun 10, 2015, 4:14 PM UTC

btilly wrote: post #11

The geopolitics of this one is fascinating. Stuxnet was a combined Israeli/US attack on Iran's nuclear capability. Kaspersky is a Russian security company which was started with government support, and is believed to still have connections there. Russia and Iran are allies. Now look at how it played out. The US and Israel attacked Iran. Kaspersky tracked it down and publicized it to the world. And now some combinatio…

With your fantasy you can work in tabloids like Wired.

Russia and Iran are allies? US is going to use Iran against Russia to sell Iranian gas and oil to Europe and subdue Russian influence - that's why US decided to fix relations with Iran and come to a deal allowing to finish the sanctions. It's more like competitors than allies.

Re: Duqu 2.0 Hits Kaspersky Lab

#16

Post by CWuestefeld » Wed, Jun 10, 2015, 4:27 PM UTC

r721 wrote: post #4

Related report from Symantec: http://www.symantec.com/connect/blogs/duqu-20-reemergence-ag... Eugene Kaspersky: "Why Hacking Us Was A Silly Thing To Do" http://www.forbes.com/sites/eugenekaspersky/2015/06/10/why-h...

From the Kaspersky link:

I can think of several reasons why someone might want to try to steal our technical data, but each one of them doesn’t seem to be worth the risk.

I don't get it: what's the risk here? As far as I can see, the only risk is that their malware is removed from the victim machines. The risk of blowback to the perpetrators is vanishingly small as far as I can see.

Re: Duqu 2.0 Hits Kaspersky Lab

#17

Post by joecasson » Wed, Jun 10, 2015, 4:30 PM UTC

shthed wrote: post #10

The Windows 0-day is CVE-2015-2360 from MS15-061, it appears to be the only one Microsoft admits to have been exploited or used to attack it's customers. https://technet.microsoft.com/library/security/ms15-061

Even if it's the only one they've admitted to, I think it's readily known that Microsoft has numerous zero-days (discovered or not) in their software. Combine that with their prevalence in Enterprise businesses, they're going to be a logical starting point for any top tier blackhat org.

Re: Duqu 2.0 Hits Kaspersky Lab

#18

Post by btilly » Wed, Jun 10, 2015, 4:32 PM UTC

avodonosov wrote: post #15

btilly wrote: post #11

The geopolitics of this one is fascinating. Stuxnet was a combined Israeli/US attack on Iran's nuclear capability. Kaspersky is a Russian security company which was started with government support, and is believed to still have connections there. Russia and Iran are allies. Now look at how it played out. The US and Israel attacked Iran. Kaspersky tracked it down and publicized it to the world. And now some combinatio…

With your fantasy you can work in tabloids like Wired. Russia and Iran are allies? US is going to use Iran against Russia to sell Iranian gas and oil to Europe and subdue Russian influence - that's why US decided to fix relations with Iran and come to a deal allowing to finish the sanctions. It's more like competitors than allies.

In recent history, Russia and Iran have indeed been allies. See http://en.wikipedia.org/wiki/Iran%E2%80%93Russia_relations for verification. And the US has repeatedly found itself on the opposite end of geopolitical conflicts with both countries. For a random example, both Iran and Russia have been supportive of Assad's government in Syria, while the US is opposed.

Of course interests shift over time. We are indeed doing things to improve relations with Iran. But that doesn't change the fact that in recent history we've been calling them part of "the axis of evil" and they have been calling us "the great Satan".

Re: Duqu 2.0 Hits Kaspersky Lab

#19

Post by avodonosov » Wed, Jun 10, 2015, 4:35 PM UTC

btilly wrote: post #18

avodonosov wrote: post #15

Earlier quoted context omitted.

With your fantasy you can work in tabloids like Wired. Russia and Iran are allies? US is going to use Iran against Russia to sell Iranian gas and oil to Europe and subdue Russian influence - that's why US decided to fix relations with Iran and come to a deal allowing to finish the sanctions. It's more like competitors than allies.

In recent history, Russia and Iran have indeed been allies. See http://en.wikipedia.org/wiki/Iran%E2%80%93Russia_relations for verification. And the US has repeatedly found itself on the opposite end of geopolitical conflicts with both countries. For a random example, both Iran and Russia have been supportive of Assad's government in Syria, while the US is opposed. Of course interests shift over time. We are indeed d…

I've heard that Iran calls US "great Satan", and Russia "small Satan"

Re: Duqu 2.0 Hits Kaspersky Lab

#20

Post by huhtenberg » Wed, Jun 10, 2015, 4:45 PM UTC

btilly wrote: post #11

The geopolitics of this one is fascinating. Stuxnet was a combined Israeli/US attack on Iran's nuclear capability. Kaspersky is a Russian security company which was started with government support, and is believed to still have connections there. Russia and Iran are allies. Now look at how it played out. The US and Israel attacked Iran. Kaspersky tracked it down and publicized it to the world. And now some combinatio…

> a Russian company started with government support

From what I know this is simply not true. Got a source?

But I think your overall point holds. Kaspersky's 400 million user base includes a boatload of US/Western users, including enterprise and government clients. This simply cannot NOT be of some concern to respective countries, so it's perfectly logical that they would want to keep an eye on the situation.