By Suzanne Kelly
Researchers at the same cybersecurity lab that announced the
discovery of the Flame virus this past May believe they have discovered a
related set of code that serves as a Trojan horse, and they're asking
the wider cryptographic community to help them crack it.The newly found code dubbed "Gauss" appears to be a cyber-espionage toolkit that has the ability to intercept passwords, steal computer system configuration information and access credential information for banks located in the Middle East. But researchers at Kaspersky Lab in Russia say things don't seem to be only as they appear.
"We're talking about a complex package," says senior security researcher Kurt Baumgartner, who says the code appears to be created by a nation-state. "It's unique and different in a few ways; it maintains code and has similar functionality to Flame and Stuxnet."
Flame and Stuxnet are computer viruses that have the ability to rewrite code. Stuxnet targeted Iran's nuclear program. It rewrote code that caused enrichment centrifuges to spin out of control, rendering them useless. The U.S. and Israel are widely believed to be behind the creation of the virus.
Baumgartner says researchers have had a harder time understanding what Gauss was actually created to do, or what its payload really is.
A payload is a piece of code or technology that is being delivered within a software package. Baumgartner says the stealing of credentials and monitoring capability may be just a smokescreen for something more sinister.
"It's very likely that its meant to cover up or hide whatever that payload is," says Baumgartner, who adds that it's possible the code was designed to avoid detection until it reached its final target.
Kaspersky Lab posted an appeal on its company website for encryption experts to try to help crack the code. They say they've gotten a number of responses from "talented people."
"There's all sorts of speculation we could make about what's really in the payload," says Baumgartner. "But for a blob of encrypted data to reside within a piece of code that's related to Stuxnet and that has spread to thousands or tens of thousands of machines in that region, it suggests that there is a more significant or more important payload."
So far, Kaspersky says most of the "Gauss" detections have been in Lebanon, with a smaller number reported in Israel.
Researchers have no idea how the code spreads, but say that it has the ability to infect USB ports that, once infected, can spread to as many as 30 computers before the code self destructs.
The toolkit earned its name because of references discovered within the code that pay tribute to mathematicians and philosophers. Johann Carl Friedrich Gauss was a German mathematician.
http://edition.cnn.com/
