Feeds

That MYSTERY Duqu Trojan language: Plain old C

How quaint

Reducing security risks from open source software

An appeal for help from the programming community has allowed antivirus analysts to classify the unknown language used to develop key components of the Duqu Trojan.

Duqu creates a backdoor on compromised SCADA-based industrial control systems. The malware is closely related to the nuke plant centrifuge-busting Stuxnet worm and was probably developed by the same group. Security researchers at Kaspersky Lab found that Duqu uses the mystery code to communicate with its command-and-control (C&C) servers from infected machines. Unlike the rest of Duqu, the so-called Duqu Framework is not written in C++ and it's not compiled with Microsoft's Visual C++ 2008.

The code was not written using Delphi or .Net, other virus-writing favourites, either. Hardcore VXers use assembler to write malicious code but it wasn't that either.

After going some way in unraveling the mystery language used by the Duqu Framework, Kaspersky Lab researchers appealed for help from the programming community.

During a webcast on Monday, Kaspersky Lab chief malware expert Vitaly Kamluk said that a variety of programming languages had been suggested in response for this appeal for help, including Lisp and Ada.

However the suggestion that the Duqu Framework might have been developed using old-school Object Oriented C (OO C) hit the bullseye. Code compiled using C and Microsoft Visual Studio 2008 was a close match for the code in the Duqu framework, allowing Kaspersky researchers to conclude that the framework had been written using a custom object-oriented extension to C or plain C with a changed dialect, as Kamluk described it.

"It's old school C. These are techniques used by professional software developers but not malware writers," Kamluk explained.

Kamluk said the whoever created the framework had reapplied an approach most often encountered in professional Mac OS applications development to create Windows malware.

Using the approach offered several advantages compared to using conventional malware writing techniques, Kamluk explained. He said that the approach created code that was "more efficient, smaller, faster, more flexible and re-useable".

Knowing the techniques used to develop the malware allows Kaspersky's researchers to make better guesses about who might be behind the code. The security researchers said that the Duqu framework was probably created by old school professional developers who were well used to making software using Object Oriented C.

"The developers of the framework prefer to extend an 'old-school' language with contemporary techniques," the Kaspersky boffins conclude. "The framework could have been reused from an existing software project. [The approach is] common for professional software developers, but unique for malware writers."

"The code was written by a team of experienced ‘old-school’ developers who wanted to create a customised framework to support a highly flexible and adaptable attack platform. The code could have been reused from previous cyber-operations and customised to integrate into the Duqu Trojan,” said Igor Soumenkov, Kaspersky Lab malware expert. “However, one thing is certain: these techniques are normally seen by elite software developers and almost never in today’s general malware.”

Creating Duqu was a major project, so it’s possible that an entirely different team was responsible for creating the Duqu Framework, while others worked on creating drivers and system infection exploits. In this scenario it's even possible that those who created the Duqu framework were ignorant of the real purpose of their work.

Compiling source code is a one-way transformation. Virus analysts are skilled at going from machine code to assembler but are unable to go any further. By experience the researchers can tell which language and compiler is likely used to write an item of malware, but the techniques used in the Duqu framework were not out of the regular VXer cookbook, hence the appeal for help from the wider programming community.

Researchers at Kaspersky were the first to find the "smoking code" linking Stuxnet and Duqu. A detailed analysis of the Duqu code by Kaspersky researchers, can be found here.

More on how the language behind the Duqu language was deduced can be found here. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Apple fanbois SCREAM as update BRICKS their Macbook Airs
Ragegasm spills over as firmware upgrade kills machines
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.