Duqu: Stuxnet's Spy Sibling Hidden in a Word Font and a Hubble Photo

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

In April 2011 Iran announced its systems had been hit by a new attack it called the Stars virus, but released no code. On September 1, 2011, the CrySyS Lab at the Budapest University of Technology and Economics named a new piece of malware Duqu, after the ~DQ prefix on the temporary files it created, and published a 60-page report. Researchers found a keylogger hidden after the end-of-file marker of a JPEG of colliding galaxies from the Hubble Space Telescope, and Symantec and Kaspersky concluded that Stars and Duqu were the same. Duqu was built on the same Tilde-D platform as Stuxnet, and F-Secure's Mikko Hyppönen noted its kernel driver, jminet7.sys, was so close to Stuxnet's that F-Secure's systems first classified it as a Stuxnet variant.

Duqu entered machines through a Word document that exploited a zero-day flaw in the Win32k TrueType font parsing engine, and its driver carried a valid digital signature stolen from Taiwanese hardware maker C-Media, revoked in October 2011. Much of the code was written in a custom object-oriented C framework compiled in Visual Studio 2008 to slow reverse engineering. Unlike Stuxnet, which sabotaged centrifuges, Duqu gathered reconnaissance on a small number of industrial control system manufacturers, smuggled data out in tiny JPEGs, and erased itself after 36 days. Researchers attribute it to a well-funded state operation, with some reports pointing to Israel's Unit 8200.

• Microsoft's interim workaround disabled TrueType font parsing in Windows until patch MS11-087 shipped in December 2011.
• Stolen data was encrypted and appended to 54-by-54-pixel JPEG images to blend into normal traffic.
• On some personal computers Duqu deleted recent data or wiped the entire hard drive.
• Command servers were found in Germany, Belgium, the Philippines, India and China, mostly running CentOS 5.
• Researchers suspect the attackers used a second zero-day to compromise those CentOS servers.