Hackers may have spent years crafting Duqu
Gang customized attack files for each target, says Kaspersky Lab
Computerworld - The hacker group behind Duqu may have been working on its attack code for more than four years, new analysis of the Trojan revealed Friday.
Moscow-based Kaspersky Lab published some findings today from a recent rooting through Duqu samples provided by researchers in the Sudan, saying that one driver included with the attack payload was compiled in August 2007, extending the timeline of the gang's work.
"We can't be 100% sure [of that date], but all the compiled dates of other files seem to match to attacks," said Roel Schouwenberg, a senior researcher with Kaspersky, in an interview today. "So we're leaning towards that date as correct."
Schouwenberg added that the August 2007 driver was most likely created specifically for Duqu by the group responsible for the attacks, and was not an off-the-shelf file built by others, because the driver has not been spotted elsewhere.
Other researchers have found files amongst those used by Duqu that carry build dates of February 2008, but actual attacks have been tracked back only to April 2011.
That was also the month that the Sudan-provided samples indicated attacks took place against an unnamed target in that country, according to Kaspersky, which reported two separate attempts -- one on April 17, the second on April 21 -- to plant malware on Windows PCs.
The first attack failed because the email message carrying a malicious Word document was blocked by a spam filter; the second was successful.
Microsoft has confirmed that the Duqu campaign exploits a vulnerability in a Windows kernel-mode driver -- specifically "W32k.sys," and its TrueType font parsing engine -- to gain rights on the compromised PC sufficient to install the malware.
Although Microsoft has yet to patch the bug, it has urged customers to disable the font parser to protect themselves.
Kaspersky's other notable discovery was that each of the dozen Duqu attacks it knows of used a custom-created set of files compiled immediately before the malware was aimed at a target.
"The differences are pretty minor, but they are using unique files tailor-made for each operation," said Schouwenberg. "Each and every attack had its own command-and-control [C&C] server, with its location embedded in the files," he explained.
"That hints that they're very business oriented," Schouwenberg said. "They're very professional, very polished."
Although Kaspersky's newest analysis differs in some ways from that conducted by other security firms -- notably Symantec, which was the first to disclose Duqu's existence -- neither Schouwenberg or a Symantec director saw a conflict.
"Each security firm has different clients, different contacts, and with the limited sharing of samples, we may have just found the earliest [Duqu code]," said Schouwenberg.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- Is Your Big Data Solution Production-Ready? Read "Is Your Big Data Solution Production-Ready?" now, and discover best practices and actionable steps to implementing a production-ready big data solution.
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Cybercrime and Hacking White Papers | Webcasts