Duqu Case Study

845 Words2 Pages

Duqu is composed of Computer Malware that seems to be very similar to the Stuxnet worm. This malware is a very intriguing Trojan that was probably invented by the same people who created the Stuxnet worm. The whole goal of this Trojan is to steal private information from systems. The first time Duqu attacked antivirus vendors was in 2011 on September 1. Someone from Hungary decided to send a file with the name ~DN1.tmp. Because of the attack the file was added by more than antivirus companies to the company database. Duqu attacks computers by infecting them with a Word document send by email. They used a word document to take full advantage of the CVE-2011-3402 weaknesses. CVE-2011-3402 is a buffer overflow that connects with True Type fonts. This specific attack was a shock to Kaspersky, an anti-virus, because Duqu was the only malware to take advantages of the weaknesses of the systems information assurance. Now Kaspersky detects this weakness with the name Exploit.Win32.CVE-2011-3402. One of the main goals of Duqu is to not be destructive. This malware will try to gather private information. It can delete all recent information and sometimes the whole computer hard drive. Duqu has even been used to steal private keys used in cryptography to cause viruses to appear as secure software.
Duqu was given this certain name because the files it created had the prefix “~DQ”. Duqu is very similar to Stuxnet. They both use various encryption keys and injection techniques. Also, the use of zero-day exploits and stolen certificates are similar. Just like Stuxnet, Duqu engages in attacking Microsoft Windows by the use of a zero-day- vulnerability. A zero-day-attack is an attack that a developer will zero time to approach. The ...

... middle of paper ...

... decrypted in memory. The only file that is ever written to the disk is the unencrypted file. The file is the load – point driver. If all of these steps of the process are completed, then the Duqu virus will almost be undetectable. Clearly the virus was designed to not leave any detectable footprints behind.
By many features and evidence, security researchers believe that Duqu was written by old school programmers who are very experienced. While the majority of the Duqu code was written in C++, there were certain parts written in C. This is more than likely because they are old school. When C++ was published for the first time, there were many old school programmers who decided to stay away from it. So, the whole goal of the Duqu virus was to steal valuable information from certain systems. Clearly the guys behind this Trojan thought it was a successful virus.

More about Duqu Case Study

Open Document