Kaspersky Says Iran Talks Spyware Masqueraded Under Foxconn Name

Duqu 2.0 virus redirected computer traffic via Foxconn from hotels where the Iran nuclear talks were held.

Send in e-mailSend in e-mail
A logo sits illuminated on the reception desk at the headquarters of Kaspersky Lab, a cyber-security firm, in Moscow, Russia, on Dec. 9, 2014.
A logo sits illuminated on the reception desk at the headquarters of Kaspersky Lab, a cyber-security firm, in Moscow, Russia, on Dec. 9, 2014. Credit: Bloomberg

Further research into the sophisticated computer virus used to hack into hotels where the Iran nuclear talks took place has found it took advantage of digital credentials stolen from the world's top contract electronics maker, Foxconn.

Russian security company Kaspersky Lab said on Monday that researchers learned the Duqu 2.0 virus had redirected computer traffic by using a legitimate digital certificate from Taiwan's Hon Hai, also known as Foxconn.

Foxconn customers have included many of the world's biggest electronic makers, including Apple, Blackberry, Google, Huawei [HWT.UL] and Microsoft.

Kaspersky revealed its initial findings in a report last week in which it said it found the virus in conferencing equipment at three European hotels used in talks involving Iran and six world powers, among other targets.

Digital certificates are the credentials which identify legitimate computers on a network. They act as the basis of e-commerce and other largely automated transactions on the Web.

In recent years, cyberspies have begun to exploit stolen certificates to trick machines into thinking malicious software comes from legitimate computers, an escalation posing a grave threat to business done over the Internet, security experts say.


The "P5+1" group of six world powers have been negotiating with Iran on curbs to its disputed nuclear program - the United States, Russia, China, Britain, France and Germany.

The on-again, off-again series of talks to reach a comprehensive nuclear deal with Iran have been held in Geneva, Lausanne, Montreux, Munich and Vienna since last year.

Both Moscow-based Kaspersky and U.S. security company Symantec Corp said the virus shared some programming with previously discovered espionage software called Duqu, which security experts believe to have been developed by Israelis.

Israel, which has strongly opposed the powers' diplomatic opening to its arch-enemy Iran, denied any connection with the virus. In February, the United States accused Israel of using selective leaks from the talks to distort the U.S. position.

The West suspects Iran wants to develop a nuclear weapons capability from its enrichment of uranium. Iran says it wants nuclear energy only for electricity and medical isotopes.

Symantec and Kaspersky analysts have said there was overlap between Duqu and Stuxnet, a U.S.-Israeli project that sabotaged Iran's nuclear program in 2009-10 by destroying a thousand or more centrifuges that were enriching uranium.

The Stuxnet virus took advantage of stolen digital certificates from two other major Taiwanese companies, JMicron Technology Corp and Realtek Semiconductor Corp, Kaspersky said in a report it published in 2010.

"Duqu attackers are the only ones who have access to these certificates, which strengthens the theory they hacked the hardware manufacturers in order to get these certificates," Kaspersky said in a summary of its report on Monday.

Kaspersky said it had notified Foxconn of the stolen credentials. Foxconn was not immediately available to comment on steps it has taken to secure its systems.

Last week, Kaspersky said Duqu 2.0 had evolved from the earlier Duqu, which had been deployed against unidentified targets for years before it was discovered in 2011.

It said Duqu 2.0 used three previously unknown flaws in Microsoft Corp software to infect machines, for which the software giant subsequently released patches to fix. The attack left almost no traces.

Click the alert icon to follow topics:



Automatic approval of subscriber comments.
From $1 for the first month

Already signed up? LOG IN


The Orion nebula, photographed in 2009 by the Spitzer Telescope.

What if the Big Bang Never Actually Happened?

Relatives mourn during the funeral of four teenage Palestinians from the Nijm family killed by an errant rocket in Jabalya in the northern Gaza Strip, August 7.

Why Palestinian Islamic Jihad Rockets Kill So Many Palestinians

בן גוריון

'Strangers in My House': Letters Expelled Palestinian Sent Ben-Gurion in 1948, Revealed


AIPAC vs. American Jews: The Toxic Victories of the 'pro-Israel' Lobby

Bosnian Foreign Minister Bisera Turkovic speaks during a press conference in Sarajevo, Bosnia in May.

‘This Is Crazy’: Israeli Embassy Memo Stirs Political Storm in the Balkans

Hamas militants take part in a military parade in Gaza.

Israel Rewards Hamas for Its Restraint During Gaza Op