Stuxnet Worm Clone Could Target Power Plants

Security researchers have detected a new Trojan program, scarily similar to the infamous Stuxnet worm, that could disrupt computers controlling power plants, oil refineries, and other critical infrastructure networks.

The program, which the security firm Symantec dubbed "Duqu," appears to have been written by the same authors as the Stuxnet worm that was used in July to cripple an Iranian nuclear-fuel processing plant, reports SecurityNewsDaily.com.

"Stuxnet source code is not out there," wrote F-Secure cybersecurity expert Mikko Hyppönen on his firm's blog. "Only the original authors have it. So, this new backdoor was created by the same party that created Stuxnet."

The original Stuxnet was designed specifically to compromise an industrial control system by manipulating the software on which these facilities rely on for automation. Duqu may have its sights set on the same target.

"Duqu shares a great deal of code with Stuxnet; however, the payload is completely different," Symantec researchers wrote on its Security Response blog. "Duqu is essentially the precursor to a future Stuxnet-like attack," the researchers added.

Symantec said whoever is behind Duqu rigged the Trojan to install another information-stealing program on targeted computers that could record users' keystrokes and system information and transmit them, and other harvested data, to a command-and-control server. That server is still operational, Symantec said.

Security experts would not speculate about who's behind Duqu, but the conventional wisdom on Stuxnet is that it was created by the intelligence services of the United States and Israel to knock out a uranium-refinement plant in Iran.