Duqu

For the version of malware announced in 2015, see Duqu 2.0.

Duqu is a collection of computer malware discovered on 1 September 2011, thought to be related to the Stuxnet worm. The Laboratory of Cryptography and System Security (CrySyS Lab)[1] of the Budapest University of Technology and Economics in Hungary discovered the threat, analysed the malware, and wrote a 60-page report[2] naming the threat Duqu.[3] Duqu got its name from the prefix "~DQ" it gives to the names of files it creates.[4]

Nomenclature

The term Duqu is used in a variety of ways:

Relationship to Stuxnet

Symantec, based on the CrySyS report, continued the analysis of the threat, which it called "nearly identical to Stuxnet, but with a completely different purpose", and published a detailed technical paper on it with a cut-down version of the original lab report as an appendix.[4][6] Symantec believes that Duqu was created by the same authors as Stuxnet, or that the authors had access to the source code of Stuxnet. The worm, like Stuxnet, has a valid, but abused digital signature, and collects information to prepare for future attacks.[4][7] Mikko Hyppönen, Chief Research Officer for F-Secure, said that Duqu's kernel driver, JMINET7.SYS, was so similar to Stuxnet's MRXCLS.SYS that F-Secure's back-end system thought it was Stuxnet. Hyppönen further said that the key used to make Duqu's own digital signature (only observed in one case) was stolen from C-Media, located in Taipei, Taiwan. The certificates were due to expire on 2 August 2012 but were revoked on 14 October 2011 according to Symantec.[6]

Another source, Dell SecureWorks, reports that Duqu may not be related to Stuxnet.[8] However, there is considerable and growing evidence that Duqu is closely related to Stuxnet.

Experts compared the similarities and found three of interest:

Microsoft Word zero-day exploit

Like Stuxnet, Duqu attacks Microsoft Windows systems using a zero-day vulnerability. The first-known installer (AKA dropper) file recovered and disclosed by CrySyS Lab uses a Microsoft Word document that exploits the Win32k TrueType font parsing engine and allows execution.[9] The Duqu dropper relates to font embedding, and thus relates to the workaround to restrict access to T2EMBED.DLL, which is a TrueType font parsing engine if the patch released by Microsoft in December 2011 is not yet installed.[10] Microsoft identifier for the threat is MS11-087 (first advisory issued on 13 November 2011).[11]

Purpose

Duqu looks for information that could be useful in attacking industrial control systems. Its purpose is not to be destructive, the known components are trying to gather information.[12] However, based on the modular structure of Duqu, special payload could be used to attack any type of computer system by any means and thus cyber-physical attacks based on Duqu might be possible. However, use on personal computer systems has been found to delete all recent information entered on the system, and in some cases total deletion of the computer's hard drive. Internal communications of Duqu are analysed by Symantec,[4] but the actual and exact method how it replicates inside an attacked network is not yet fully known. According to McAfee, one of Duqu's actions is to steal digital certificates (and corresponding private keys, as used in public-key cryptography) from attacked computers to help future viruses appear as secure software.[13] Duqu uses a 54×54 pixel JPEG file and encrypted dummy files as containers to smuggle data to its command and control center. Security experts are still analyzing the code to determine what information the communications contain. Initial research indicates that the original malware sample automatically removes itself after 36 days (the malware stores this setting in configuration files), which would limit its detection.[6]

Key points are:

Command and control servers

Some of the command and control servers of Duqu have been analysed. It seems that the people running the attack had a predilection for CentOS 5.x servers, leading some researchers to believe that they had a zero-day exploit for it. Servers are scattered in many different countries, including Germany, Belgium, Philippines, India and China. Kaspersky has published multiple blogposts on the command and control servers.[14]

See also

References

  1. "Laboratory of Cryptography and System Security (CrySyS)". Retrieved 4 November 2011.
  2. "Duqu: A Stuxnet-like malware found in the wild, technical report" (PDF). Laboratory of Cryptography of Systems Security (CrySyS). 14 October 2011.
  3. "Statement on Duqu's initial analysis". Laboratory of Cryptography of Systems Security (CrySyS). 21 October 2011. Retrieved 25 October 2011.
  4. 1 2 3 4 "W32.Duqu – The precursor to the next Stuxnet (Version 1.4)" (PDF). Symantec. 23 November 2011. Retrieved 30 December 2011.
  5. Shawn Knight (2012) Duqu Trojan contains mystery programming language in Payload DLL
  6. 1 2 3 Zetter, Kim (18 October 2011). "Son of Stuxnet Found in the Wild on Systems in Europe". Wired. Retrieved 21 October 2011.
  7. "Virus Duqu alarmiert IT-Sicherheitsexperten". Die Zeit. 19 October 2011. Retrieved 19 October 2011.
  8. "Spotted in Iran, trojan Duqu may not be "son of Stuxnet" after all". Retrieved 27 October 2011.
  9. "Microsoft issues temporary 'fix-it' for Duqu zero-day". Retrieved 5 November 2011.
  10. "Microsoft Security Advisory (2639658)". Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege. 3 November 2011. Retrieved 5 November 2011.
  11. "Microsoft Security Bulletin MS11-087 - Critical". Retrieved 13 November 2011.
  12. Steven Cherry, with Larry Constantine (14 December 2011). "Sons of Stuxnet". IEEE Spectrum.
  13. Venere, Guilherme; Szor, Peter (18 October 2011). "The Day of the Golden Jackal – The Next Tale in the Stuxnet Files: Duqu". McAfee. Retrieved 19 October 2011.
  14. "The mystery of Duqu part six: The command and control servers". 30 November 2011. Retrieved 30 November 2011.
This article is issued from Wikipedia - version of the 8/19/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.