June 11, 2012, 1:59 PM — Security researchers today said that they have found a direct link between the notorious Stuxnet worm and the more-recently-discovered Flame espionage malware, indicating that the two teams cooperated and collaborated.
The news ties Flame to the U.S. and Israeli governments, which reportedly designed and launched Stuxnet in an attempt to sabotage Iran's nuclear program.
"We're very confident that the Flame team shared some of their source code with the Stuxnet group," Roel Schouwenberg, a senior researcher with Moscow-based Kaspersky Lab, said in an online presentation early Monday about the company's findings. "It's conclusive proof that the two worked together, at least once."
Stuxnet, a powerful cyberweapon that crippled parts of Iran's nuclear fuel enrichment effort, was first discovered in mid-2010, but researchers later traced its first variant, and first attack, to June 2009.
Flame's timeline is more murky, but most researchers agree that it goes back at least to 2010.
Today, Kaspersky said that its analysis shows that Flame harks back to no later than the summer of 2008, perhaps earlier.
The two pieces of malware -- Flame for reconnaissance, Stuxnet for attack -- each included a module that appears to originate from the same source code, likely written by a single programmer. That module was used to infect Windows PCs through USB flash drives, and exploited a vulnerability that was patched in June 2009.
When the attack code module was written, however, the vulnerability Microsoft fixed in MS09-025 was still unpatched, and thus a "zero-day" bug. At the time it quashed the flaw, Microsoft said it had not been used in the wild.
Not true, said Kaspersky: The elevation-of-privilege exploit of a Windows kernel vulnerability had been used by both the first version of Stuxnet and early editions of Flame. "The [attack] module had a creation date of February 2009," said Schouwenberg. "It exploited a zero-day at the time of creation, and most likely at the time of Stuxnet's deployment."
That variant, dubbed "Stuxnet.a," was relatively unsuccessful or ultra-quiet, or both, according to researchers. It wasn't until 2010's Stuxnet.b that researchers stumbled upon the worm.
Kaspersky dug into its detection logs last week to look for possible evidence of a link between Flame and Stuxnet, and found one.
"Flame was a kick-starter," Schouwenberg said, explaining the use of the code similar to both Stuxnet and Flame. "In 2010, the Stuxnet group removed that [module], and each team went their separate ways."