As you may know (or maybe not) Duqu, the virus arrived on the French net a few days ago I present to you a software that could be very very useful to you
Indeed NSS Labs has made a new free tool that detects Duqu and its new updates.
Duqu is a notorious worm that exploits the Windows Zero-Day vulnerability (already posted here).
Microsoft released a workaround for this vulnerability yesterday.
According to the test, the NSS tool success rate is 100%, zero false positives.
It is also able to detect new drivers as they are discovered.
Two new drivers were discovered after the tool was completed, and both were detected by the tool NSS with no update needed. It seems that Duqu contains similar code and uses techniques similar to Stuxnet.
More specifically, it appears to make use of certificates that appear to be legitimate, but it is far too early to describe it as Stuxnet 2.
DuQu contains code similar to that used by Stuxnet.
DuQu uses techniques similar to Stuxnet, in particular the use of drivers signed by "legitimate" digital certificates. It is unknown whether these certificates were stolen or fabricated by the attackers following the compromise of a certification authority (CA)
DuQu is not self-replicating (although some theorize it may be commanded to replicate via network shares), it requires the use of a "dropper"-based exploit to install on a system.
The installer, which used a kernel zero-day exploit delivered via a Microsoft Word document, was recovered and is currently being analyzed.
DuQu installs a keylogger to record keystrokes and collect other system information.
Stolen information is packed in encrypted and compressed image files for later exfiltration.
DuQu was communicating via HTTP/HTTPS with its initial command and control (CC) server in India; a custom CC protocol was implemented using modified image files. As of writing these lines, the CC server has been disabled.
DuQu was initially configured with a fixed lifetime, set to disable after 36 days, although additional components may be installed to extend this as needed.
This content is for members only. Log in or register for free to see it.
Windows FixThis script was written to help you find more DuQu drivers. For experienced users
This content is for members only. Log in or register for free to see it.
This content is for members only. Log in or register for free to see it.
This very simple to use toolkit will help you find Duqu on your PC if you are infected