In April 2011 Iran announced its systems had been hit by a new attack it called the Stars virus, but released no code. On September 1, 2011, the CrySyS Lab at the Budapest University of Technology and Economics named a new piece of malware Duqu, after the ~DQ prefix on the temporary files it created, and published a 60-page report. Researchers found a keylogger hidden after the end-of-file marker of a JPEG of colliding galaxies from the Hubble Space Telescope, and Symantec and Kaspersky concluded that Stars and Duqu were the same. Duqu was built on the same Tilde-D platform as Stuxnet, and F-Secure’s Mikko Hyppönen noted its kernel driver, jminet7.sys, was so close to Stuxnet’s that F-Secure’s systems first classified it as a Stuxnet variant.
Duqu entered machines through a Word document that exploited a zero-day flaw in the Win32k TrueType font parsing engine, and its driver carried a valid digital signature stolen from Taiwanese hardware maker C-Media, revoked in October 2011. Much of the code was written in a custom object-oriented C framework compiled in Visual Studio 2008 to slow reverse engineering. Unlike Stuxnet, which sabotaged centrifuges, Duqu gathered reconnaissance on a small number of industrial control system manufacturers, smuggled data out in tiny JPEGs, and erased itself after 36 days. Researchers attribute it to a well-funded state operation, with some reports pointing to Israel’s Unit 8200.
- Microsoft’s interim workaround disabled TrueType font parsing in Windows until patch MS11-087 shipped in December 2011.
- Stolen data was encrypted and appended to 54-by-54-pixel JPEG images to blend into normal traffic.
- On some personal computers Duqu deleted recent data or wiped the entire hard drive.
- Command servers were found in Germany, Belgium, the Philippines, India and China, mostly running CentOS 5.
- Researchers suspect the attackers used a second zero-day to compromise those CentOS servers.
Leave a Reply