Duqu exploits zero-day Windows vulnerability to install itself
Connecting state and local government leaders
Researchers in Budapest have recovered the installer in the Stuxnet-like Duqu worm, which exploits a zero-day vulnerability in the Windows kernel, Symantec reports.
Researchers have found that the Duqu worm, which appears to have been built using some of the same code as Stuxnet, exploits a zero-day vulnerability in the Windows kernel to install itself on infected computers.
The installer was recovered by the Laboratory of Cryptography and System Security at the Budapest University of Technology and Economics, and analyzed by Symantec Security Response.
The exploit in at least one case was delivered with the installer file in a targeted Word document. Symantec said it has notified Microsoft of the vulnerability. How the malicious code installed itself on infected computers was one of the two big questions about Duqu, said Kevin Haley, Symantec director of product management.
Related coverage:
How to avoid a Stuxnet of your own
Duqu is no 'hydrogen bomb,' but is part of the new cyber threat
“Unfortunately, it doesn’t shed much light on who is behind it,” which is the second big question, Haley said.
Duqu has gained attention because it appears to include source code from the Stuxnet worm, a sophisticated cyber weapon that is believed to have successfully attacked and damaged uranium refining equipment in Iran. Symantec confirmed that Duqu is nearly identical to Stuxnet, but with a different purpose. Rather than taking control of an industrial control system, it apparently gathers information from targeted organizations.
“The fact that a zero-day vulnerability is involved lends more credence to the idea that the same people are behind it,” Haley said.
Because of the time, money and resources required to produce Stuxnet, it has been suggested that it is the product of a nation, and because of its Iranian target it has been suggested that it could be the work of the United States and/or Israel.
The number of confirmed Duqu infections is limited, but it has spread in six possible organizations in eight countries: France, Netherlands, Switzerland, Ukraine, India, Iran, Sudan and Vietnam.
Other security vendors have reported infections in Austria, Hungary, Indonesia, the United Kingdom and Iran. The exact number of organizations and their identity are not known because some addresses are traceable only to a service provider. This also makes it difficult to say why these organizations have been targeted and what the goal of the campaign is.
“We don’t know what they’re able to find,” Haley said.
Duqu can spread within networks, and one of its interesting features is the ability to communicate with a command-and-control server when installed on a computer without direct Internet access. It creates a bridge using other infected computers as proxies with Internet access, allowing attackers to control infections in secure zones.
The original command server was in India. A second has been found and taken offline in Belgium.
Symantec has called Duqu a precursor to the next Stuxnet attack, but the use of the sophisticated code for simple information gathering would seem to be overkill.
“If it wasn’t for the fact of the reused source code from Stuxnet, we wouldn’t be talking about it,” Haley said. “It’s using some of the code,” but not all of it. Duqu might be simply a commercial venture. “If someone invested that much time and effort in writing the source code, they might have wanted to get their money’s worth out of it.”
The best defense at this time against Duqu is to follow best practices, such as avoiding documents from unknown parties and using alternative software that might not be infected, Symantec said. Most security vendors already detect and block the main Duqu files.
NEXT STORY: Chemical industry targeted by cyber spy attacks