Feeds

Duqu targeted each victim with unique files and servers

Well-financed developers had sense of humor

High performance access to file storage

The creators of the Duqu malware that penetrated industrial manufacturers in at least eight countries tailored each attack with exploit files, control servers, and booby-trapped Microsoft Word documents that were different for each victim, according to research published on Friday.

What's more, two of the drivers the sophisticated, highly modular rootkit used in one attack showed compilation dates of 2007 and 2008, Alexander Gostev, the Kaspersky Lab expert and author of the report said. If the dates are genuine, they suggest the Duqu architects may have spent the past four years developing the malware.

Like forensics investigators combing through a homicide scene for the tiniest scraps of evidence, security researchers around the world are examining every email and computer file associated with Duqu for clues about who created and and for what purpose. They have yet to establish a direct link to the Stuxnet worm that was unleashed to sabotage uranium-enrichment plants in Iran, but the aggregate picture of Duqu that's emerging is that like Stuxnet, it was painstakingly developed by a world-class team of disciplined and well-financed engineers.

The Duqu version examined in Friday's report was recovered by the Sudan Computer Emergency Response Team from an undisclosed company that the attackers targeted in advance. Like attacks on other targets, it was launched using a booby-trapped Word document with content that was tailored to the receiving organization and exploited a previously unknown vulnerability in the kernel of all supported versions of Microsoft Windows.

The first attempt at infection in the incident studied by Kaspersky failed because the email containing the Word document wound up in a spam folder. On May 21, four days after the first email was sent, the attackers tried again with a slightly modified message. Both the subject line and the title of the attached file referenced the targeted company specifically. Interestingly, the DLL file that served as the trojan's main module was dated April 17, the same day as the first attempt to infect the target.

When the recipient of the second email opened the Word document, a malicious payload immediately hijacked the computer, but sat dormant for about 10 minutes, Gostev said. The exploit didn't actually install the spy components until the end user went idle. The infected computer used a command and control server researchers have never seen before. So far, investigators have identified at least four such servers, and each one was used to send and receive data from only one target.

In late May, a second computer in the attack examined by Kaspersky was infected over the targeted company's local network. Gostev didn't say how the Duqu infection was able to spread. Separate research from Symantec has suggested the malware is was able to spread across networks through SMB connections used to share files from machine to machine.

For all the skill and care the attackers took, they also showed an intriguing sense of humor. The malicious shellcode for their exploit was embedded in a fictitious font called “Dexter Regular,” and contained the line “Copyright (c) 2003 Showtime Inc.” The hidden message is an obvious reference to the Dexter television series, which depicts a ritualistic serial killer who works as a crime-scene investigator for the Miami Police Department.

“This is another prank pulled by the Duqu authors,” Gostev wrote. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.