Duqu May Have Targeted Certificate Authorities for Encryption Keys
As Symantec continues its analysis of Duqu, the latest malware targeting industrial control firms and based on the Stuxnet worm, other security researchers believe that certificate authorities are among the affected victims.
Symantec posted its preliminary analysis of the Duqu worm on Oct. 18. Duqu's focus appears to be on industrial control systems, but unlike Stuxnet, its goal appears to be information gathering and not disabling hardware. However, a pair of researchers from McAfee noted that the team behind Duqu may have compromised certificate authorities along the way.
McAfee researchers Guilherme Venere and Peter Szor believe that Duqu was created for espionage and to launch targeted attacks against certificate authorities. While Symantec had noted that several companies in Europe had been hit by Duqu, the Symantec Security Response team had not provided any details on the victims or the kind of information that had been obtained.
