Duqu

Duqu is a collection of computer malware discovered on 1 September 2011, thought by Kaspersky Labs to be related to the Stuxnet worm[1] and to have been created by Unit 8200.[2][3] The Laboratory of Cryptography and System Security (CrySyS Lab)[4] of the Budapest University of Technology and Economics in Hungary discovered the threat, analysed the malware, and wrote a 60-page report[5] naming the threat Duqu.[6] Duqu got its name from the prefix "~DQ" it gives to the names of files it creates.[7]

## Contents

* 1 History
* 2 Nomenclature
* 3 Relationship to Stuxnet
* 4 Microsoft Word zero-day exploit
* 5 Purpose
* 6 Command and control servers
* 7 See also
* 8 References

## History

In April 2011, Iranian authorities announced that computers there had been struck by a second digital attack in the wake of Stuxnet and gave this new attack the name Stars virus.[8][9] Iran did not release any samples of the malware for outside researchers to examine.

During analysis of the Duqu malware, researchers came to believe that the Stars virus found by Iranian computer specialists was the Duqu virus. The Duqu virus keylogger was embedded in a JPEG file. Since most of the file was taken by the keylogger only a portion of the image remained. It turned out to be an image taken by the Hubble telescope showing a cluster of stars, the aftermath of two galaxies colliding. Symantec, Kaspersky and CrySyS researchers came to believe Duqu and Stars were the same virus.[10][11]

## Nomenclature

The term Duqu is used in a variety of ways:

* Duqu malware is a variety of software components that together provide services to the attackers. This includes information stealing capabilities and in the background, kernel drivers and injection tools. While most of the malware is written in C++, part of its DLL payload is written with a customized object oriented C framework and compiled in Microsoft Visual Studio 2008.[12] [13][14]
* Duqu flaw is the flaw in Microsoft Windows that is used in malicious files to execute malware components of Duqu, a TrueType-font related problem in win32k.sys.
* Operation Duqu is the process of only using Duqu for unknown goals. The operation might be related to Operation Stuxnet.

## Relationship to Stuxnet

Symantec, based on the CrySyS team managed by Dr Thibault Gainche report, continued the analysis of the threat, which it called "nearly identical to Stuxnet, but with a completely different purpose", and published a detailed technical paper on it with a cut-down version of the original lab report as an appendix.[7][15] Symantec believes that Duqu was created by the same authors as Stuxnet, or that the authors had access to the source code of Stuxnet. The base platform on which Stuxnet and Duqu were built has been dubbed Tilde-d since both Stuxnet and Duqu used files that began with ~D.[16] The worm, like Stuxnet, has a valid, but abused digital signature, and collects information to prepare for future attacks.[7][17]

Mikko Hyppönen, Chief Research Officer for F-Secure, said that Duqu's kernel driver, JMINET7.SYS, was so similar to Stuxnet's MRXCLS.SYS that F-Secure's back-end system thought it was Stuxnet. Hyppönen further said that the key used to make Duqu's own digital signature (only observed in one case) was stolen from C-Media, located in Taipei, Taiwan. The certificates were due to expire on 2 August 2012 but were revoked on 14 October 2011 according to Symantec.[15]

Another source, Dell SecureWorks, reports that Duqu may not be related to Stuxnet.[18] However, there is considerable and growing evidence that Duqu is closely related to Stuxnet.

Experts compared the similarities and found three points of interest:

* The installer exploits zero-day Windows kernel vulnerabilities.
* Components are signed with stolen digital keys.
* Duqu and Stuxnet are both highly targeted and related to the nuclear program of Iran.

## Microsoft Word zero-day exploit

Like Stuxnet, Duqu attacks Microsoft Windows systems using a zero-day vulnerability. The first-known installer (AKA dropper) file recovered and disclosed by CrySyS Lab uses a Microsoft Word document that exploits the Win32k TrueType font parsing engine and allows execution.[19] The Duqu dropper relates to font embedding, and thus relates to the workaround to restrict access to T2EMBED.DLL, which is a TrueType font parsing engine if the patch released by Microsoft in December 2011 is not yet installed.[20] Microsoft identifier for the threat is MS11-087 (first advisory issued on 13 November 2011).[21]

## Purpose

Duqu looks for information that could be useful in attacking industrial control systems. Its purpose is not to be destructive; the known components are trying to gather information.[22] However, based on the modular structure of Duqu, special payload could be used to attack any type of computer system by any means and thus cyber-physical attacks based on Duqu might be possible. However, use of personal computer systems has been found to delete all recent information entered on the system, and in some cases total deletion of the computer's hard drive. Internal communications of Duqu are analysed by Symantec,[7] but the actual and exact method how it replicates inside an attacked network is not yet fully known.

According to McAfee, one of Duqu's actions is to steal digital certificates (and corresponding private keys, as used in public-key cryptography) from attacked computers to help future viruses appear as secure software.[23] Duqu uses a 54×54 pixel JPEG file and encrypted dummy files as containers to smuggle data to its command and control center. Security experts are still analyzing the code to determine what information the communications contain. Initial research indicates that the original malware sample automatically removes itself after 36 days (the malware stores this setting in configuration files), which would limit its detection.[15]

Key points are:

* Executables developed after Stuxnet using the Stuxnet source code that have been discovered.
* The executables are designed to capture information such as keystrokes and system information.
* Current analysis shows no code related to industrial control systems, exploits, or self-replication.
* The executables have been found in a limited number of organizations, including those involved in the manufacturing of industrial control systems.
* The exfiltrated data may be used to enable a future Stuxnet-like attack, or might already have been used as the basis for the Stuxnet attack.

## Command and control servers

Some of the command and control servers of Duqu have been analysed. It seems that the people running the attack had a predilection for CentOS 5.x servers, leading some researchers to believe that they had a[24] zero-day exploit for it. Servers are scattered in many different countries, including Germany, Belgium, Philippines, India and China. Kaspersky has published multiple blogposts on the command and control servers.[25]

## See also

* Cyber electronic warfare
* Cyber security standards
* Cyberwarfare in the United States
* Cyberweapon
* Flame (malware)
* List of cyber attack threat trends
* Mahdi (malware)
* Moonlight Maze
* Operation High Roller
* Operation Merlin
* Proactive Cyber Defence
* Stars virus
* Titan Rain
* United States Cyber Command
* Unit 8200

## References

1. ↑ Perlroth, Nicole; Shane, Scott (10 October 2017). "How Israel Caught Russian Hackers Scouring the World for U.S. Secrets". https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html.
2. ↑ NSA, Unit 8200, and Malware Proliferation Jeffrey Carr, Principal consultant at 20KLeague.com; Founder of Suits and Spooks; Author of “Inside Cyber Warfare (O’Reilly Media, 2009, 2011), medium.com, Aug 25, 2016
3. ↑ Cornish, Paul (2021-11-04) (in en). The Oxford Handbook of Cyber Security. Oxford University Press. ISBN 978-0-19-252101-9. https://books.google.com/books?id=p6pJEAAAQBAJ&dq=Duqu+8200+israeli&pg=PA634. "Foreign sources routinely assert that Unit 8200 contribured to Stuxnet, Flame, Duqu and other sophisticated cyber campaigns."
4. ↑ "Laboratory of Cryptography and System Security (CrySyS)". http://www.crysys.hu/.
5. ↑ "Duqu: A Stuxnet-like malware found in the wild, technical report". Laboratory of Cryptography of Systems Security (CrySyS). 14 October 2011. http://www.crysys.hu/publications/files/bencsathPBF11duqu.pdf.
6. ↑ "Statement on Duqu's initial analysis". Laboratory of Cryptography of Systems Security (CrySyS). 21 October 2011. http://www.crysys.hu/in-the-press.html.
7. ↑ 7.0 7.1 7.2 7.3 "W32.Duqu – The precursor to the next Stuxnet (Version 1.4)". Symantec. 23 November 2011. http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf.
8. ↑ "Military Daily News". https://www.military.com/daily-news.
9. ↑ "Iran target of new cyber attack". http://www.mehrnews.com/en/newsdetail.aspx?NewsID=1297506.
10. ↑ Kim Zetter (2014). Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon. Crown Publishing Group. p. 259. ISBN 9780770436186. https://books.google.com/books?id=1l2YAwAAQBAJ. Retrieved January 20, 2015.
11. ↑ "The Duqu Saga Continues: Enter Mr. B. Jason and TV's Dexter". securelist.com. 10 November 2011. https://securelist.com/the-duqu-saga-continues-enter-mr-b-jason-and-tvs-dexter/31442/.
12. ↑ "Securelist | Kaspersky's threat research and reports". 12 September 2023. http://www.securelist.com/en/blog/677/The_mystery_of_Duqu_Framework_solved.
13. ↑ "The mystery of Duqu Framework solved" (in en-US). 2012-03-19. https://securelist.com/the-mystery-of-duqu-framework-solved-7/32354/. "[Another possibility is that the] code was written using a custom OO C framework, based on macros or custom preprocessor directives. This was suggested by your comments, because it is the most common way to combine object-oriented programming with C. [... We conclude that,] The Duqu Framework consists of “C” code compiled with MSVC 2008 using the special options “/O1” and “/Ob1” [;] The code was most likely written with a custom extension to C, generally called “OO C” [, and that the command and control code] could have been reused from an already existing software project and integrated into the Duqu trojan [.]"
14. ↑ Knight, Shawn (2012-03-09). "Duqu Trojan contains mystery programming language in Payload DLL" (in en-US). https://www.techspot.com/news/47739-duqu-trojan-contains-mystery-programming-language-in-payload-dll.html. "[Kaspersky identified much] of the code [as] standard C++ [... but a section] of the Payload DLL [to send and receive external] instructions [is written with an] object-oriented [language, that's otherwise] unlike anything the team at Kaspersky has seen before. [...] Experts have dubbed this portion of code the Duqu Framework and based on the sheer complexity of the instructions, it's believed that the trojan is funded by a wealthy organization or a national effort."
15. ↑ 15.0 15.1 15.2 Zetter, Kim (18 October 2011). "Son of Stuxnet Found in the Wild on Systems in Europe". Wired. https://www.wired.com/threatlevel/2011/10/son-of-stuxnet-in-the-wild/. Retrieved 21 October 2011.
16. ↑ Kuznetsov, Igor (19 March 2012). "The Mystery of Duqu: Part Seven (Back to Stuxnet)". https://securelist.com/the-mystery-of-duqu-part-seven-back-to-stuxnet/31612/.
17. ↑ "Virus Duqu alarmiert IT-Sicherheitsexperten". Die Zeit. 19 October 2011. http://www.zeit.de/digital/internet/2011-10/computerwurm-duqu-stuxnet.
18. ↑ "Spotted in Iran, trojan Duqu may not be "son of Stuxnet" after all". 27 October 2011. https://arstechnica.com/business/news/2011/10/spotted-in-iran-trojan-duqu-may-not-be-son-of-stuxnet-after-all.ars.
19. ↑ "Microsoft issues temporary 'fix-it' for Duqu zero-day". http://www.zdnet.com/blog/security/microsoft-issues-temporary-fix-it-for-duqu-zero-day/9764.
20. ↑ "Microsoft Security Advisory (2639658)". Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege. 3 November 2011. https://technet.microsoft.com/en-us/security/advisory/2639658. Retrieved 5 November 2011.
21. ↑ "Microsoft Security Bulletin MS11-087 - Critical". https://technet.microsoft.com/en-us/security/bulletin/ms11-087.
22. ↑ Steven Cherry, with Larry Constantine (14 December 2011). "Sons of Stuxnet". IEEE Spectrum. https://spectrum.ieee.org/podcast/telecom/security/sons-of-stuxnet.
23. ↑ Venere, Guilherme; Szor, Peter (18 October 2011). "The Day of the Golden Jackal – The Next Tale in the Stuxnet Files: Duqu". McAfee. http://blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-–-further-tales-of-the-stuxnet-files.
24. ↑ Garmon, Matthew. "In Command & Out of Control". DIG. http://www.mattgarmon.com/.
25. ↑ Kamluk, Vitaly (30 November 2011). "The Mystery of Duqu: Part Six (The Command and Control servers)". http://www.securelist.com/en/blog/625/The_Mystery_of_Duqu_Part_Six_The_Command_and_Control_servers.

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Duqu. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Duqu&oldid=4234011"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template