Duqu exploits zero-day Microsoft bug

Powered by SC Magazine
 

But some say evidence on Stuxnet link is 'circumstantial at best'.

 

Duqu, the so-called "son of Stuxnet" trojan, contains a dropper program that exploits a previously unknown vulnerability in the Windows kernel, researchers said Tuesday.

This could add merit to some security industry suspicions that Duqu is a sophisticated piece of malware, possibly containing underlying Stuxnet code.

Analysts have suggested that Duqu was created to conduct reconnaissance of target industrial control systems, and may be a precursor to another Stuxnet-like attack.

The zero-day exploit was confirmed by the Laboratory of Cryptography and System Security (CrySyS), a Budapest, Hungary-based facility that originally discovered Duqu.

"We immediately provided competent organisations with the necessary information such that they can take appropriate steps for the protection of the users," a brief statement from CrySyS said.

 

Duqu's installation process : Symantec

 

One of those organisations was Symantec, whose own research team studied how the zero-day exploit eventually leads to the installation of Duqu.

 

 

"The installer file is a Microsoft Word document that exploits a previously unknown kernel vulnerability that allows code execution," Symantec researcher Vikram Thakur said.

 

 

"When the file is opened, malicious code executes and installs the main Duqu binaries."

 

 

The installation file recovered appeared to be specially crafted to attack an organisation within an eight-day window in August, according to Thakur.

 

 

As reported, the Duqu binaries were configured to erase the malware after 36 days.

 

 

The Microsoft Security Response Center, in a tweet, said it was  working to close the hole. Stuxnet spread by leveraging an unprecedented  four zero-day vulnerabilities, all of which have since been patched.

 

 

Once on a system, Duqu can spread via Server Message Block (SMB)  shares to other computers through attacker commands, Thakur said.

 

 

So  far, researchers have confirmed infections at six organizations in  eight countries: Iran, France, Netherlands, Switzerland, Ukraine, India,  Sudan and Vietnam.

 

 

Meanwhile, authorities in India have confiscated a hard drive at a Mumbai web hosting firm believed to be part of a Duqu command-and-control server, according to reports.

 

 

Still, not everyone is sold on Duqu's motives. According to a Dell SecureWorks research note, published late last week, Duqu does not contain any code specifically designed to infiltrate industrial control systems.

 

 

Researchers believe this makes the trojan quite distinct from Stuxnet.

 

 

"Both Duqu and Stuxnet are highly complex programs with multiple components," they wrote.

 

 

"All of the similarities from a software point of view are in the 'injection' component implemented by the kernel driver. The ultimate payloads of Duqu and Stuxnet are significantly different and unrelated.

 

 

"One could speculate the injection components share a common source, but supporting evidence is circumstantial at best and insufficient to confirm a direct relationship."

 

 

Thakur said there are no existing, reliable workarounds for the Duqu zero-day exploit.

 

 

In lieu of these, organisations should follow traditional best practices, such as "avoiding documents from unknown parties and utilising alternative software".

 

 

Although the origin of Stuxnet, meant to sabotage Iran's nuclear power program by targeting Siemens software, has never been determined, it is widely believed to have originated in the United States or Israel.

 

 

While Iranian officials reportedly have denied that Stuxnet caused any major damage, some experts believe the attack significantly set back the country's nuclear program.

 

 

- WIth Darren Pauli

 

Copyright © SC Magazine, US edition


Duqu exploits zero-day Microsoft bug
 
 
 
Top Stories
Qld Transport to replace core registration system
State's biggest citizen info repository set for overhaul.
 
Innovating in the sleepy super industry
There’s little incentive to be on the bleeding edge, so why is Andrew Todd fighting so hard?
 
How technology will unify Toll
The systems headache formed through 15 years of acquisitions.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
More 4G from Optus in Darwin
Nov 21, 2014
Click to see where Optus has expanded coverage to the suburbs near Darwin.
Optus steps up regional 4G coverage
Nov 20, 2014
Once 700Mhz services are working, Optus claims regional users will have a "faster and more ...
This Huawei 4G phone costs $99
Nov 12, 2014
The $99 Huawei Ascend Y550, available through Vodafone, enters the budget market as one of the ...
4G smartphones: Microsoft's Lumia 830
Nov 7, 2014
Microsoft has announced its flagship Windows Phone, the Nokia Lumia 830 4G, will be available in ...
Do you direct debit customers? Read this
Oct 10, 2014
Authorities have been targeting direct debit practices with iiNet and Dodo receiving formal ...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  7%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  5%
TOTAL VOTES: 846

Vote