Breaking News

SAMA Launches Exclusive Amazon Prime Day Deals on Flagship PC Cases and AIO Cooler Lineup Transcend Launches Ultra-Fast PCIe Gen5 SSD MTE260S Power Your World with DJI's New Portable Power Station Power 2000 G.SKILL CAMM2 DDR5 Memory Module Demonstrates DDR5-10000 Overclock Speed on ASUS Z890 Motherboard JCB Phone Launches New Rugged Smartphone Range to Power Global Expansion

logo

  • Share Us
    • Facebook
    • Twitter
  • Home
  • Home
  • News
  • Reviews
  • Essays
  • Forum
  • Legacy
  • About
    • Submit News

    • Contact Us
    • Privacy

    • Promotion
    • Advertise

    • RSS Feed
    • Site Map

Search form

Duqu Installer Exploited Windows Zero-Day to Infect Systems

Duqu Installer Exploited Windows Zero-Day to Infect Systems

Enterprise & IT Nov 2,2011 0

Microsoft said hackers exploited a bug in its Windows operating system to infect computers with the Duqu virus, which some security experts say could be the next big cyber threat. Microsoft plans to release a ecurity update for the issue.

According to Symantec, the attackers behind Duqu used a Microsoft Windows zero-day as part of their attack campaign. Researchers at the Laboratory of Cryptography and System Security (CrySyS) - the group that initially discovered the original Duqu binaries - has located an installer for the malware. The installer file is a malicious Microsoft Word document that exploits a previously-unknown kernel vulnerability that allows code execution.

"When the file is opened, malicious code executes and installs the main Duqu binaries," blogged Vikram Thakur, principal security response manager at Symantec.

"The Word document was crafted in such a way as to definitively target the intended receiving organization," he added. "This installer is the only installer to have been recovered at the time of writing?the attackers may have used other methods of infection in different organizations."

Unfortunately, no robust workarounds exist at this time other than following best practices, such as avoiding documents from unknown parties and utilizing alternative software. Fortunately, most security vendors already detect and block the main Duqu files, thereby preventing the attack.

Once Duqu is able to get a foothold in an organization through the zero-day exploit, the attackers can command it to spread to other computers. According to Symantec, evidence was found that showed the attackers commanding Duqu to spread across SMB shares. Interestingly though, some of the newly infected computers did not have the ability to connect to the Internet and thereby the command-and-control (C&C) server. The Duqu configuration files on these computers were instead configured not to communicate directly with the C&C server, but to use a file-sharing C&C protocol with another compromised computer that had the ability to connect to the C&C server. Consequently, Duqu creates a bridge between the network's internal servers and the C&C server. This allowed the attackers to access Duqu infections in secure zones with the help of computers outside the secure zone being used as proxies.

So far, the damage done by Duqu remains limited. According to Symantec, six organizations are believed to have been infected with the malware. Some of the organizations are only traceable back to an ISP, so it is possible all six are not separate organizations. The targets identified so far by Symantec have a presence in eight countries: France, India, Iran, Vietnam, Sudan, Netherlands, Ukraine and Switzerland. Other security vendors however have reported infections in other countries as well, including Hungary, Austria and the U.K.

Tags: Virus
Previous Post
Yahoo Unveils Livestand, Products for Tablets And Mobile Devices
Next Post
Nokia Selects ST-Ericsson As supplier For Future Windows Phones

Related Posts

  • Samsung Laptop Full of Notorious Malware Is On Sale For $1.2M

  • Cisco Identifies Virus That Kills Off PCs

  • Researchers Identify iOS Espionage App

  • Researchers Identify New iOS Vulnerability

  • Dropbox, WordPress Used To Spread Malware

  • Microsoft Says Viruses Are Back On The Rise

  • First Targeted Attack Utilising Malware for Android Devices Reported

  • Cyber Attack Targets Nato, Government Websites

Latest News

SAMA Launches Exclusive Amazon Prime Day Deals on Flagship PC Cases and AIO Cooler Lineup
Cooling Systems

SAMA Launches Exclusive Amazon Prime Day Deals on Flagship PC Cases and AIO Cooler Lineup

Transcend Launches Ultra-Fast PCIe Gen5 SSD MTE260S
PC components

Transcend Launches Ultra-Fast PCIe Gen5 SSD MTE260S

Power Your World with DJI's New Portable Power Station Power 2000
Consumer Electronics

Power Your World with DJI's New Portable Power Station Power 2000

G.SKILL CAMM2 DDR5 Memory Module Demonstrates DDR5-10000 Overclock Speed on ASUS Z890 Motherboard
PC components

G.SKILL CAMM2 DDR5 Memory Module Demonstrates DDR5-10000 Overclock Speed on ASUS Z890 Motherboard

JCB Phone Launches New Rugged Smartphone Range to Power Global Expansion
Smartphones

JCB Phone Launches New Rugged Smartphone Range to Power Global Expansion

Popular Reviews

be quiet! Light Loop 360mm

be quiet! Light Loop 360mm

be quiet! Dark Mount Keyboard

be quiet! Dark Mount Keyboard

Arctic Liquid Freezer III 420 - 360

Arctic Liquid Freezer III 420 - 360

be quiet! Light Mount Keyboard

be quiet! Light Mount Keyboard

Soundpeats Pop Clip

Soundpeats Pop Clip

Noctua NH-D15 G2

Noctua NH-D15 G2

Crucial T705 2TB NVME White

Crucial T705 2TB NVME White

be quiet! Light Base 600 LX

be quiet! Light Base 600 LX

Main menu

  • Home
  • News
  • Reviews
  • Essays
  • Forum
  • Legacy
  • About
    • Submit News

    • Contact Us
    • Privacy

    • Promotion
    • Advertise

    • RSS Feed
    • Site Map
  • About
  • Privacy
  • Contact Us
  • Promotional Opportunities @ CdrInfo.com
  • Advertise on out site
  • Submit your News to our site
  • RSS Feed