Scanner can Detect Duqu

Wednesday, November 9, 2011 @ 01:11 PM gHale


An open source scanning tool is capable of detecting all malicious drivers used by the new Duqu threat, say engineers from NSS Labs. However, other security vendors said the malware’s creators are capable of evading detection at any time.

The device’s scanner uses advanced pattern recognition techniques and NSS Labs created it to further research Duqu, the piece of malware that has captured the attention of the entire security industry in recent weeks.

RELATED STORIES
Duqu Server Moved to Belgium
Microsoft Working on Duqu Fix; Workaround Out
Duqu Installer Exploits a Zero Day
Looking for Duqu’s Real Target

Security experts around the world believe Duqu is closely related to the Stuxnet industrial sabotage worm discovered last year. The new threat borrows attack techniques and even code from what the most sophisticated piece of malware of all time.

The security research community has so far determined that Duqu infects systems by exploiting an unpatched vulnerability in the Windows kernel through rogue Word documents, that it has a modular architecture that includes a rootkit component operating as a system driver, and that it targets organizations with the purpose of exfiltrating sensitive information.

“This tool was developed in the hopes that additional drivers can be discovered to allow us to learn more about the functionality, capabilities and ultimate purpose of Duqu,” NSS Labs engineers said in a blog post.

NSS Labs said the tool is capable of detecting Duqu drivers without any false positives and it even picked up two samples discovered after its creation.

However, Costin Raiu, director of the global research and analysis team at antivirus vendor Kaspersky Lab, raised some concerns about the tool’s scope. “It’s useful, however I believe its heuristics rules are too narrow,” he said.

According to him, any heuristic tool that detects Duqu drivers should also detect the Stuxnet ones, because of the high similarity between them. This doesn’t appear to be the case with the new NSS Labs scanner.

Kaspersky Lab doesn’t currently offer a removal tool tailored specifically for Duqu, because of the threat’s complexity, said Raiu. “Just a single removal tool is simply not sufficient.”

Analyzing the other components left by Duqu on infected systems, aside from the malicious drivers, is equally important according to the security expert, because they might provide information about what the attackers were after.

Raiu doesn’t believe the open-source nature of the NSS Labs tool makes it easier for Duqu’s creators to evade detection. “Evidence shows that the authors of Duqu and Stuxnet made sure their malware was undetected at the time of the attack anyways, so they are already bypassing detections,” he said.

NSS Labs is offering the scanner for free, and also the complete reverse-engineered Duqu code and other resources. However, the code will only be available to researchers who contact the company and pass its vetting process.



Leave a Reply

You must be logged in to post a comment.