The Duqu Zero Day Exploit is evil! Not all virus signature files have caught up yet, so try these defenses!
Five Things To Do To Defend Against Duqu
“Whether Duqu is related to Stuxnet’s authors or its source code is the least of your worries if your organization ends up in the bull’s eye of this new targeted attack. Microsoft says it considers the threat ‘low risk’ at this point. Trouble is, the names of the organizations that have been targeted thus far have been kept confidential, so we don’t know just what Duqu is after exactly, and whether it’s focused on a particular industry or region.
‘I don’t expect Duqu to stop. It looks to be manned on the inside and not on autopilot — they are actively setting up new modules, etc., to keep the operation alive,’ says Don Jackson, a director with Dell Secureworks Counter Threat Unit. ‘So [right now] it’s an intelligence game.’
Even so, there are still some things organizations can do to protect themselves while the world waits for more information on this attack, as well as for Microsoft’s patch for the zero-day flaw that was exploited and used with Word to spread the infection. Microsoft late today issued a ‘hot fix’ along with an advisory about Duqu and assured users that antivirus vendors in its MAPP program would soon be updating their products with Duqu signatures very soon.
Even if you’re not a certificate authority or manufacturing firm — the two industries cited publicly so far as having Duqu victims — security experts say there are some steps you can take to help protect your infrastructure from this new targeted attack.
1. Install the just-released ‘hot fix’ from Microsoft and workaround.
Microsoft is working on a patch, and it will do so via its regular security bulletin release — just not in time for next week’s batch. So in the meantime, Microsoft today began offering a hot fix for the threat that blocks access to t2embed.dll used in the zero-day attack in Duqu.
The flaw lays in the Win32k TrueType font parsing engine, according to Microsoft: ‘An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. The attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. We are aware of targeted attacks that try to use the reported vulnerability; overall, we see low customer impact at this time. This vulnerability is related to the Duqu malware,’ Microsoft said in an advisory today.
Jerry Bryant, group manager for response communications in Microsoft’s Trustworthy Computing Group, says Microsoft is closely monitoring further developments with Duqu. ‘As previously stated, the risk for customers remains low. However, that is subject to change, so we encourage customers to either apply the workaround or ensure their anti-malware vendor has added new signatures based on the information we’ve provided them to ensure protections are in place for this issue,’ he says.
2. Run updated anti-malware — and use standard security best practices.
Not all antivirus products can detect Duqu yet, but security experts say to keep updating to be sure you get protection for Duqu as soon as it’s released.
‘Detections related to Duqu are mapped to the W32.Duqu family of signatures. We also highly encourage people not to click on attachments in email that seems suspicious, even if it comes from someone they know,’ says Kevin Haley, director of product management for Symantec.
Secureworks recommends using any host-based protection in addition to the typical network monitoring and user access controls that would help thwart Duqu. Tarek Saadawi, professor of electrical engineering at The City College of New York’s Grove School of Engineering, says because Duqu sniffs keyboard strokes and tries to steal passwords to internal systems, users should also protect their home computers and networks. Aside from updating AV and Windows, be sure to update third-party applications and shut down computers at night, he says.
3. Scan or filter Word documents from unknown sources.
One handy tool here is Microsoft’s MOICE (Microsoft Office Isolated Conversion Environment), which checks for malformed Word documents, Secureworks’ Jackson says. ‘That’s how Duqu starts: with a malformed Word file. It’s playing a trick on Microsoft Word to run this code,’ he says.
Jackson suggests filtering Word documents from unknown sources and scanning them with MOICE until there’s a patch for the new zero-day attack. Another option is to use something like FireEye’s software: ‘FireEye loads the Word document inside the VM and [executes] malicious detection,’ he says.
4. Monitor for traffic from potentially infected machines trying to ‘phone home’ to Duqu.
Be on the lookout for machines trying to connect to a Duqu command-and-control (C&C) server or trying to resolve to a Duqu-related domain. Two C&C servers have been taken down thus far, but there are likely new ones. The IP addresses of the C&Cs that were found and ultimately shuttered: 206.183.111.97 and 77.241.93.160.
‘I’m confident that there are other command-and-control servers either going up now or that are already up,’ Jackson says. ‘We are a step behind them in spotting new ones.
‘Duqu has a stay-alive module … and has the ability to change itself, so anything you can do to block IP addresses will help,’ he says.
5. Watch for any Port 443 traffic that’s unencrypted, and keep an eye out for ~DQ files.
Watching for unencrypted traffic on the HTTP-S or SSL-based traffic port can help detect malware, including a possible Duqu infection. ‘If it’s not encrypted [traffic there], it’s probably bad,’ says Secureworks’ Jackson.
Meanwhile, a Duqu-infected file may start with ‘~DQ’ in the Windows temporary file directory, so be on the lookout for that as well, Secureworks recommends.”
Have you ever wondered how your DNS system (usually provided by your ISP) is doing, speed-wise? When your PC queries the DNS for a domain name, if your DNS responds slowly, your perception is that “the Internet is slow” when, in fact, it may just be your DNS. You can always switch to another DNS provider by setting that option in your router (for instance)… I use OpenDNS myself. Anyway, this weeks GSotW is a way to test your DNS speed, for free! And, it is by Steve Gibson… so it is very compact, and tightly coded!
As a web site admin I am always looking for cool things to improve my web sites, especially my web sites search engine availability, and other technologies that will help folks find, and use, my sites. I had seen this tool in action on other web sites, and looked at those site’s source code to see what they were using to do what I was seeing. What was I seeing? Well, if I copy some text from a web site, boom! I see the site URL pasted with the text (at the bottom) into my document, notepad, etc. Very cool! Here’s what you need to do it! And it is FREE!