Don
Face to Face with Duqu malware
Face to Face with Duqu malware
Once again we discuss about Stuxnet, cyber weapons and of the malware that appears derivate from the dangerous virus. The international scientific community has defined a Stuxnet deadly weapon because been designed with a detailed analysis of final target environment supported by a meticulous intelligence work that for the first time in history has embraced the world of information technology.
The agent was designed with the intent to strike the Iranian nuclear program and even more clear is who has always opposed such a program, U.S. and Israel first, and consider also the technology skill necessary to develope a weapon with the observed architecture is really high.
Extremely important two factors af the event:
1. the choose of control systems as target of the malware.
2. the conception of the virus as an open project, a modular system for which it was designed a development platform used to assemble the deadly cyber weapons in relation to the final targets.
Regarding the second point, it has been discovered a platform behind Stuxnet called “Tilded Platform“, used also for the development of Duqu malware, and that make possible the development of a set of reusable tools, a true innovation that make possible the composition of ever new and enhanced agents with modules developed to fulfill specific functions against clearly defined targets.
As previously stated Duqu has some interesting features such as:
- Modularity of its structure.
- In isolated instances of the malware, unlike Stuxnet, it would not seem to be equipped with modules for SCADA systems attack. It is only able to steal information from the host system.
- The malware, such as Stuxnet has characteristics that demonstrate innovative techniques behind its development. We suppose that a team of specialists with high technical skills has been engaged to project the most innovative cyber weapon.
According the ENISA Duqu Analysis there are important differences between Duqu and Stuxnet. The 2010 Kaspersky analysis [Gostev 2011] concluded that Stuxnet consists of the two parts:
1. A component responsible for the propagation of the malware (a carrier platform).
2. A separate module targeting Programmable Logic Controllers (an attack module).
The attack module of DuQu, found together with the detected samples was a general purpose keylogger (enriched with some additional spying capabilities) able to perform a reconnaissance in any organization. However, according to Symantec, the aim of DuQu is to infiltrate organizations operating in industrial environments. This conclusion is based on the fact that the majority of the detected threats were found in industrial infrastructures, and because of the connection to Stuxnet code. Unlike Stuxnet, DuQu is an intelligence gathering tool, apparently aiming to prepare the ground for attacks such as Stuxnet. It should be emphasised, however that there is no direct evidence for the intentions behind DuQu
But if Duqu has no components to attack SCADA systems or similar, why create in us so much worry? Remember that we defined modular Duqu? Well this is the feature I think that should cause us to jump from the chair. To date we have isolated versions of malware orphan of those components to attack specific critical systems, but it is reasonable to assume that the same Duqu is a work in progress project. The ability to compose its structure at different times using modules designed specifically for precise goals, makes this unique and formidable.
What occurred in the Stuxnet case has raised media attention demonstrating the total inadequacy of the defense systems of critical infrastructures across the world. Many, too many, the SCADA systems around the world, achievable in an easy manner and easily attacked by evil-minded because they are un protected, exposed on the web for maintenance purpose, and configured with the factory settings easily available even with simple searches on the web. Also for that SCADA systems deployed without security and isolated from the Internet there is a concrete risk to be infected using USB memory sticks.
While in recent weeks, the Iranian government declared definitively defeat the threat Stuxnet in the last month there are many news published on the web related to malware Duqu.
The mistery of Duqu sorce code
The first one was related the identification of the mysterious language used in the DuQu virus. Researchers at Kaspersky Lab requested the help of international experts after failing to figure out the language on their own.
Thanks to help from programmers has been discovered that the language, which DuQu used to communicate with C&C (command & control) servers, is a special type of C code compiled with the Microsoft Visual Studio Compiler 2008.
Despite the long period of study conducted on the agent the component of the source written in C remained a mystery. It's a vital part for Duqu used to communicate with C&C servers, download additional payload modules and execute them on infected machines.
The code was C code compiled with Microsoft Visual Studio Compiler 2008 using options 01 and Ob1 in the compiler to keep the code small optimizing execution time and size of the source code.
The use of object-oriented C dialect, generally called “OO C, to write the event-driven code in the malware reveals that authors who coded this part of DuQu were probably old-school programmers, their style is uncommon for malware and is more commonly found in professionally-produced commercial software created ten years ago, according Costin Raiu, director of Kaspersky Lab's global research and analysis team.
Another important factor in choose of C language instead other more powerful like C++ it the necessity to grant portability of the agent that maybe must be compiled with several standard compiler in different environments. This requirement indicate us that the agent could be used to attack other platforms, not necessary Widows based.
“Obviously when you create such a complex espionage tool, you take into account that maybe some day you will run it on servers, maybe you will want to run it on mobile phones or God knows what other devices, so you just want to make sure your code will work everywhere,” Raiu says.
The Duqu evolution
News of these days is that a new variant of Duqu has been isolated, the event confirm the hypothesis made on the evolution of the malware, a work still in progress that will propose in the next year several instances customized to attacks specific targets. The variant found was designed to evade detection mechanism of antivirus products and other security systems. Vikram Thakur, principal security response manager at Symantec, announced that the new Duqu Driver has been identified, let's remind that the module is used for loading the malware's encrypted body stored on the systems. The driver is called mcd9x86.sys and it was compiled on Feb. 23.
What is changed in the new driver?
The source code appears to be reshuffled and compiled with a different set of options and it also contains a different subroutine for decrypting the configuration block and loading the malware's body. A similar operation has been already observed in October 2011. Of course also the references to C&C server are changed because all old structures were shut down on Oct. 20, 2011.
Unfortunately the addresses of this server are not known because principal security firm don't have the full Duqu body but only the loader in the form of the driver, the loader does not contact the C&C directly, it only loads the main body which is stored in encrypted form.
What we expect from the future?
Surely we will confront with new and dangerous cyber threats that can offend the military and also private sector. Agents such as Stuxnet and Duqu are children of an ambitious and complex project that wants to be able to provide an "evolutionary" threat. Prepare to have to deal with new modules and new features designed to attack specific targets.
Let me raise serious doubts on the immediate effectiveness of preventive measures against this new generation of cyber weapons because the industry in general is still too vulnerable. Possible evolutions of malware could cause serious damage to infrastructures that use the systems in question.
The only way to emerge unscathed from this awkward situation is a close collaboration between industry, leading manufacturers of control systems and governments, hoping that security will become a requirement in the design phase.
Submitted By : Pierluigi Paganini
About the Author : Pierluigi Paganini, Security Specialist
CEH - Certified Ethical Hacker, EC Council
Security Affairs ( http://securityaffairs.co/wordpress )
Go there...
http://thehackernews.com/2012/03/face-to-face-with-duqu-malware.html
Duqu
From Wikipedia, the free encyclopedia
Duqu is a computer worm discovered on 1 September 2011, thought to be related to the Stuxnet worm. The Laboratory of Cryptography and System Security (CrySyS)[1] of the Budapest University of Technology and Economics in Hungary discovered the threat, analysed the malware, and wrote a 60-page report[2] naming the threat Duqu.[3] Duqu got its name from the prefix "~DQ" it gives to the names of files it creates.[4]
Another source, Dell SecureWorks, reports that Duqu may not be related to Stuxnet.[8] However, more and more evidences understate that the Duqu operation has close relations to the Stuxnet attack.
Experts compared the similarities and found three of interest:
Key points are:
Contents[hide] |
[edit] Nomenclature
The term Duqu is used in a variety of ways:- Duqu malware is a variety of software components that together provide services to the attackers. Currently this includes information stealing capabilities and in the background, kernel drivers and injection tools. Part of this malware is written in unknown high level programming language [5], dubbed "Duqu framework". It is not C++, Python, Ada, Lua and many other checked languages. However, recent evidence suggests that Duqu may have been written in Object Oriented C (OO C) and compiled in Microsoft Visual Studio 2008.
- Duqu flaw is the flaw in Microsoft Windows that is used in malicious files to execute malware components of Duqu. Currently one flaw is known, a TTF related problem in win32k.sys.
- Operation Duqu is the process of only using Duqu for unknown goals. The operation might be related to Operation Stuxnet.
[edit] Relationship to Stuxnet
Symantec, based on the CrySyS report, continued the analysis of the threat, which it called "nearly identical to Stuxnet, but with a completely different purpose", and published a detailed technical paper on it with a cut-down version of the original lab report as an appendix.[4][6] Symantec believes that Duqu was created by the same authors as Stuxnet, or that the authors had access to the source code of Stuxnet. The worm, like Stuxnet, has a valid, but abused digital signature, and collects information to prepare for future attacks.[4][7] Mikko Hyppönen, Chief Research Officer for F-Secure, said that Duqu's kernel driver, JMINET7.SYS, was so similar to Stuxnet's MRXCLS.SYS that F-Secure's back-end system thought it was Stuxnet. Hyppönen further said that the key used to make Duqu's own digital signature (only observed in one case) was stolen from C-Media, located in Taipei, Taiwan. The certificates were due to expire on 2 August 2012 but were revoked on 14 October 2011 according to Symantec.[6]Another source, Dell SecureWorks, reports that Duqu may not be related to Stuxnet.[8] However, more and more evidences understate that the Duqu operation has close relations to the Stuxnet attack.
Experts compared the similarities and found three of interest:
- The installer exploits zero-day Windows kernel vulnerability(ies).
- Components are signed with stolen digital keys.
- Duqu and Stuxnet are both highly targeted and related to the nuclear program of Iran.
[edit] Microsoft Word zero-day exploit
Like Stuxnet, Duqu attacks Microsoft Windows systems using a zero-day vulnerability. The first-known installer (AKA dropper) file recovered and disclosed by CrySyS Lab uses a Microsoft Word (.doc) that exploits the Win32k TrueType font parsing engine and allows execution.[9] The Duqu dropper relates to font embedding, and thus relates to the workaround to restrict access to T2EMBED.DLL, which is a TrueType font parsing engine if the patch released by Microsoft in December, 2011 is not yet installed.[10] Microsoft identifier for the threat is MS11-087 (first advisory issued on 13 November 2011).[11]
[edit] Purpose
Duqu looks for information that could be useful in attacking industrial control systems. Its purpose is not to be destructive, the known components are trying to gather information.[12] However, based on the modular structure of Duqu, special payload could be used to attack any type of computer systems by any means and thus cyber-physical attacks based on Duqu might be possible. Internal communications of Duqu are analysed by Symantec [4], but the actual and exact method how it replicates inside an attacked network is not yet fully known. According to McAfee, one of Duqu's actions is to steal digital certificates (and corresponding private keys, in contrast to public-key cryptography) from attacked computers to help future viruses appear as secure software.[13] Duqu uses a 54×54 pixel jpeg file and encrypted dummy files as containers to smuggle data to its command and control center. Security experts are still analyzing the code to determine what information the communications contain. Initial research indicates that the original malware sample automatically removes itself after 36 days (the malware stores this setting in a configuration files), which would limit its detection.[6]Key points are:
- Executables developed after Stuxnet using the Stuxnet source code that have been discovered.
- The executables are designed to capture information such as keystrokes and system information.
- Current analysis shows no code related to industrial control systems, exploits, or self-replication.
- The executables have been found in a limited number of organizations, including those involved in the manufacturing of industrial control systems.
- The exfiltrated data may be used to enable a future Stuxnet-like attack or might already have been used as basis for the Stuxnet attack.
[edit] Command and control servers
Some of the command and control servers of Duqu have been analysed. It seems that the people running the attack had a predilection for CentOS 5.x servers, leading some researchers to believe that they had a zero-day exploit for it. Servers are scattered in many different countries, including Germany, Belgium, Philippines and China. Kaspersky published multiple blogpost on the command and control servers.[14][edit] See also
- Stars virus
- Cyber electronic warfare
- Cyber security standards
- Cyberwarfare in the United States
- List of cyber attack threat trends
- Operation Merlin
- Proactive Cyber Defence
- United States Cyber Command
- Moonlight Maze
- Titan Rain
[edit] References
- ^ "Laboratory of Cryptography and System Security (CrySyS)". Retrieved 4 November 2011.
- ^ "Duqu: A Stuxnet-like malware found in the wild, technical report". Laboratory of Cryptography of Systems Security (CrySyS). 14 October 2011.
- ^ "Statement on Duqu's initial analysis". Laboratory of Cryptography of Systems Security (CrySyS). 21 October 2011. Retrieved 25 October 2011.
- ^ a b c d "W32.Duqu – The precursor to the next Stuxnet (Version 1.4)". Symantec. 23 November 2011. Retrieved 30 December 2011.
- ^ Shawn Knight (2012) Duqu Trojan contains mystery programming language in Payload DLL
- ^ a b c Zetter, Kim (18 October 2011). "Son of Stuxnet Found in the Wild on Systems in Europe". Retrieved 21 October 2011.
- ^ "Virus Duqu alarmiert IT-Sicherheitsexperten". Die Zeit. 19 October 2011. Retrieved 19 October 2011.
- ^ "Spotted in Iran, trojan Duqu may not be "son of Stuxnet" after all". Retrieved 27 October 2011.
- ^ "Microsoft issues temporary 'fix-it' for Duqu zero-day". Retrieved 5 November 2011.
- ^ "Microsoft Security Advisory (2639658)". Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege. 3 November 2011. Retrieved 5 November 2011.
- ^ "Microsoft Security Bulletin MS11-087 - Critical". Retrieved 13 November 2011.
- ^ Steven Cherry, with Larry Constantine (December 14, 2011). "Sons of Stuxnet". IEEE Spectrum.
- ^ Venere, Guilherme; Szor, Peter (18 October 2011). "The Day of the Golden Jackal – The Next Tale in the Stuxnet Files: Duqu". McAfee. Retrieved 19 October 2011.
- ^ "The mystery of Duqu part six: The command and control servers". 30 November 2011. Retrieved 30 November 2011.
| |||||||||||
http://en.wikipedia.org/wiki/Duqu
- Duqu is a computer worm discovered on 1 September 2011, thought to be related to the Stuxnet worm
- duqu malware - Google Search
- Duqu - Wikipedia, the free encyclopedia
- Face to Face with Duqu malware | The Hacker News (THN)
- Hungarian Lab found Stuxnet-like Duqu malware | ZDNet
- 7 Facts On Duqu Malware Attacks - Security - Attacks/breaches - Informationweek
- Technology News: Malware: Duqu Malware Marches Through Windows Kernel Flaw
- Duqu malware resurfaces after four-month holiday - Computerworld
Thehackernews.com Links
No comments:
Post a Comment