A while ago, Kaspersky labs found what we all should have seen before – namely that an older version of Stuxnet contained a file (atmpsvcn.ocx) which essentially is a Flamer plugin. Apart from that, Stuxnet and Flamer are rather different in code.
Or are they?
I was looking at the Stuxnet PLC hooking DLL, s7otbxdx.dll, as I needed to extract the PLC MC7 bytecode blobs in connection with other work. Just for fun I ran my Flamer string decoding script from my previous post in the IDA Pro session. Much to my surprise, the script found a Flamer string decoder in s7otbxdx.dll.
flamedec: IDAPython Flamer decryption tool.flamedec: (C) 2012 Snorre Fagerland, Norman SharkA.------------------------------------------------flamedec: ANSI string decoder found at 10010bbf |
Looking at the code, the similarities became obvious. The Stuxnet decoder uses the same string storage format as Flamer, with byte sized encryption marker at offset 8, word sized stringlength at offset 9, and string start at offset 11. There are minimal differences on assembly code level, such as clearing the encrypted marker after decryption using MOV instead of AND, but functionally they are identical.
Jumping in to the inner decoding loops, we see that they are also functionally identical.
Here’s Stuxnet’s version:
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
void __cdecl Stuxnet__DecodeString(int a1, unsigned int a2){ unsigned int v2; // edi@1 v2 = 0; if ( a2 ) { do { *(_BYTE *)(v2 + a1) -= Stuxnet__GetKey(v2); ++v2; } while ( v2 < a2 ); }} |
And here is Flamer’s:
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
void __cdecl Flamer__SOAPR32_DecodeString(int a1, unsigned int a2){ unsigned int v2; // edi@1 v2 = 0; if ( a2 ) { do { *(_BYTE *)(v2 + a1) -= Flamer__SOAPR_GetKey(v2); ++v2; } while ( v2 < a2 ); }} |
The key generation functions look like this:
These may appear different, but they are actually quite similar and generate identical output. This being the case, I updated my Flamer decoder a little to decode strings from this Stuxnet component as well:
flamedec: ANSI string decoder found at 10010bbfflamedec: Found decoding algorithm type 6 flamedec: New decryption loop. Using decryption function at 10010bbfflamedec: ------------------------------------------------------------ 1004206c : DP_RECV10042088 : s7otbxsx.dll100420cc : 6ES7 417100420ac : 6ES7 315-210042c64 : s7otbxdx.dll10042c88 : CCRtsLoader.exe10042dfc : SOFTWARESIEMENSSINECLogDevices10042e34 : CP_TYPE10043574 : advapi32.dll10043540 : InitializeSecurityDescriptor10043510 : SetSecurityDescriptorDacl |
The fact that Stuxnet and Flamer share not only file components, but also contain islands of identical functionality, suggests that these two projects share at least some source. They may be developed by separate teams, but if so, these teams seem to have access to common resources.
