Microsoft Airs Temporary Fix to Defeat Duqu Worm
November 4, 2011 4:00 PM
Worm is exploiting zero-day exploit in the TrueType Windows component
The Duqu [dyü-kyü] worm
, containing parts of
the Stuxnet code
, is a sophisticated piece of malware that's wreaking havoc on Windows machines worldwide. The authors appear to be specially targeting business and governmental entities in what may be a cyberespionage or cybersabotage attempt.
A Fix for Duqu:
Duqu is essentially the precursor to a future Stuxnet-like attack. The threat was written by the same authors, or those that have access to the Stuxnet source code, and the recovered samples have been created after the last-discovered version of Stuxnet. Duqu’s purpose is to gather intelligence data and assets from entities such as industrial infrastructure and system manufacturers, amongst others not in the industrial sector, in order to more easily conduct a future attack against another third party. The attackers are looking for information such as design documents that could help them mount a future attack on various industries, including industrial control system facilities.
The malware piggybacks inside seemingly legitimate documents from Microsoft Corp.'s (
) Word application. Once infected, the malware takes complete control of the affected system and accesses the address book, sending out infected Word documents to your contacts along with brief, innocuous seeming messages. Microsoft listed the threat as "severe".
Usually Microsoft has a pretty fast turnaround, when it comes to addressing such serious threats, and it did not disappoint here. Just days after the zero-day vulnerability was discovered, Microsoft has published new details of what's going on, along with a temporary fix to remove Duqu.
Microsoft's TechNet Security TechCenter and
in the Microsoft Knowledge Base the Duqu virus is exploiting a zero-day vulnerability in the Win32k TrueType font-parsing engine. The vulnerability allows arbitrary code to be executed in kernel mode (a so called "privileges escalation" exploit).
A peak at the code of Duqu's malware payload [Source: Symantec]
Microsoft has also released a QuickFix tool, available in the above linked Knowledge Base post, which scrounges around and removes the vestiges of known Duqu variants
Symantec Corp. (
) -- one of the world's largest security firms -- is currently working with Microsoft to combat the threat and identify variants of the growing malware threat. The company has published a detailed report on Duqu, which is available
Symantec has chronicled Duqu's sophisticated remote command & control (CaC) scheme. [Source: Symantec]
Symantec researchers say they first received a copy of Duqu from the
Budapest University of Technology and Economics
(BME). BME obtained that piece on Oct. 14.
Some argue that Microsoft
rushes patches for vulnerabilities to market too fast
. They say that rushed patches often fail to completely protect against various variants of a malware threat, hurting the user in the long run. Still, the majority of security firms seem supportive of Microsoft's approach.
In related news chipmaker Intel Corp. (
) is working with recent acquisition McAfee to include
hardware-level protection against escalation of privileges attacks
. The technology seems very promising as it could protect against so-called zero-day vulnerabilities like the TrueType parsing exploit used by Duqu. While it might seem improbable to be able to protect against an attack you've never encountered before, Intel is looking to do this by detecting the kinds of escalation behavior that are ubiquitous among many malware programs.
"Folks that want porn can buy an Android phone." -- Steve Jobs
Nasty "Duqu" Worm Exploits Same Microsoft Office Bug as Stuxnet
November 2, 2011, 12:32 PM
Intel Gets EU Approval to Purchase McAfee
January 28, 2011, 9:16 AM
Israel Suspected in Worm Sabotage of Iran's First Nuclear Plant
September 27, 2010, 10:45 AM
Debate Continues Over Whether Microsoft Should Hurry Patches for Vulnerabilities
December 29, 2008, 12:31 PM
Google plans ultra-fast wireless Internet for Research Triangle Park, N.C.
August 12, 2016, 6:30 AM
Twitter Senior VP: "Diversity is Important, But We Can’t Lower the Bar"
November 9, 2015, 9:59 AM
CNN Resorts to Internet Censorship to Promote Clinton Over Senator Sanders
October 15, 2015, 2:47 PM
Breaking Bad: How to Crash Google's Chrome Browser With Just 8 Characters
September 23, 2015, 11:08 AM
Quick Note: Amazon UK Offers £10 Back on Any Order £50 or Over
August 3, 2015, 12:05 PM
Editorial: Reddit Allows Itself to be Hijacked as a Hate Platform For Racist Bigots
July 21, 2015, 6:32 PM
Most Popular Articles
Apple iOS Contains Secret One-handed Keyboard Code
October 22, 2016, 5:00 AM
The Unlocked Moto Z Play Launches for $449.99 Today.
October 22, 2016, 5:00 AM
The New HP Spectre: Revamped and Ready
October 23, 2016, 6:00 AM
New Way to Read Data on Ulta Hard Drives
October 23, 2016, 9:38 AM
Car Insurance - The Hidden Discriminatory Practise
October 18, 2016, 5:00 AM
Latest Blog Posts
From Time to Time, The Unbelievable and Unimaginable Happens!!!!
Oct 28, 2016, 4:56 AM
Key EpiPen Competitor Out in 2017 At ' Very Low' Cost
Oct 27, 2016, 5:30 AM
Researchers use CRISPR to Accelerate Search for HIV Cure
Oct 26, 2016, 5:00 AM
Medical Council of India Makes Generic Medicines Mandatory
Oct 25, 2016, 5:00 AM
MacBoo Pro 2016: Release date Oct. 27
Oct 24, 2016, 7:16 AM
Mac Users, Try this if Your Mac is Infected?
Oct 23, 2016, 7:00 AM
Tips to Prevent Smartphones From Overheating:
Oct 22, 2016, 5:00 AM
Nasa Flies Drones at Nevada Airport
Oct 21, 2016, 8:21 AM
T-Mobile Data Problems
Oct 20, 2016, 10:17 AM
Annoying Apple Watch Problems and How to Fix Them
Oct 20, 2016, 5:00 AM
Your Mail May Soon Be Delivered By Robot
Oct 19, 2016, 9:34 AM
2018 Jeep Wrangler Prototype Sells At Junkyard
Oct 18, 2016, 5:00 AM
Samsung Shines with Gold Edition Tablet
Oct 17, 2016, 9:24 AM
Tesla Hints Mysterious Product Debut for October 17th
Oct 16, 2016, 10:14 AM
Samsung Galaxy Note 7 Phones on US flights
Oct 15, 2016, 5:00 AM
Comcast Fined $2.3 Million For Unconfirmed Services Charged To Customers
Oct 14, 2016, 5:00 AM
“American singer / songwriter “Bob Dylan is awarded 2016 Nobel Prize in Literature.
Oct 13, 2016, 10:33 AM
More Blog Posts
Copyright 2016 DailyTech LLC. -
Terms, Conditions & Privacy Information