Flame/Stuxnet/Duqu are attacking Kaspersky

*What next, NSA? I guess they fake-order pizzas and send them to Snowden's Moscow address.

*It must be kind of flattering to be in Kaspersky and realize that the majors want to knock you over, but switching from attacking North Korea and Iran to attacking commercial outfits that found out your methods, that's a hairy transition. Is Senator Paul supposed to like that kind of activity? Maybe he uses Kaspersky products himself.

https://slim-weight.info/2015/06/kaspersky-finds-new-nation-state-attack-network/%3C/a%3E%3C/p%3E%3Cdiv class="AdWrapper-efOWgS khQFma ad ad--in-content">

"RESEARCHERS AT KASPERSKY Lab in Russia have discovered yet another new nation-state attack attributed to members of the infamous Stuxnet and Duqu gang. But this time the perpetrators were hiding in plain sight—inside the security firm’s own networks.

"Kaspersky says the attackers became entrenched in its networks some time last year. For what purpose? To siphon intelligence about nation-state attacks the company is investigating—a case of the watchers watching the watchers who are watching them. They also wanted to learn how Kaspersky’s detection software works so they could devise ways to avoid getting caught. Too late, however: Kaspersky found them recently while testing a new product designed to uncover exactly the kind of attack the intruders had launched.

"The attackers appear to be the same group that created Duqu, spyware discovered in 2011 that was used to hack a certificate authority in Hungary, as well as targets in Iran and Sudan, and that shared a number of similarities with Stuxnet, the famed digital weapon that sabotaged Iran’s nuclear program. The team’s handiwork popped up again in 2012 in two sophisticated spy tools Kaspersky helped expose—the massive Flame surveillance platform that infected thousands of victims over a period of five years and the mysterious Gauss attack, which contained a payload so securely locked that it’s yet to be deciphered.

"The hack against Kaspersky bears some of the hallmarks of the 2011 Duqu attack, including sharing an algorithm and large amounts of the same code. But where the original Duqu consisted of just six modules, Duqu 2.0, as Kaspersky is calling it, is a massive, 19-megabyte toolkit with plugins for various reconnaissance and data theft activities. All of these are stored in and operated stealthily from inside an infected machine’s memory in order to bypass detection tools that might otherwise uncover them if they were stored on the machine’s hard drive. The attackers also appear to have used at least three zero-day exploits to conduct their attack, as well as a clever technique to surreptitiously extract data remotely and communicate with infected machines.

" “The entire code of this [attack] platform is some of the best we have seen ever,” Costin Raiu, director of the company’s Global Research and Analysis Team, told WIRED. “It is incredibly well written. Almost no mistakes anywhere.”

"Kaspersky is still trying to determine how much data the attackers stole…."