plc.myforum.ro

mayo · Administrator Joined: 14 Jun 2009 Posts: 700

The DuQu installer file is a Microsoft Word document (.doc) that exploits a previously unknown kernel vulnerability that allows code execution
The new computer virus "duqu", which is compared with 2006 virus "stuxnet" which was used in attacks against Iranian nuclear energy programme, has been detected in eight countries, the company announced Thursday by Symantec computer security, reports AFP.

"The threat DuQu making progress" announced Symantec in a press release stating that the've seen virus in enterprises or administrations present "in eight countries", namely France, Netherlands, Switzerland, Ukraine, India, Iran, Sudan and Vietnam.

"DuQu", named by the laboratory research which found him in October, since generate files with extension "dq", divides a good part of its code source with "stuxnet". It represents a threat "almost similar", but it has a purpose "completely different".

Being a tool for access to the distance it doesn't replicated itself, its aim is not a directly attack of a system of industrial control, but rather to collect data from entities and producers of control systems in industry, to launch attacks easier against third parties, "explained Symantec".

In addition to its presence in eight countries found, Symantec announced "unconfirmed reports" on a possible contamination with "DuQu" in four other countries, namely Britain, Austria, Hungary and Indonesia.

Detected in 2010, "stuxnet" virus infected a programme of Siemens industrial control (PLCs) used in water sectors, platforms and oil power stations.

Currently, this virus DuQu does not pose a direct threat to control systems.
It does not contain the module antiPLC but beware...

Symantec
http://www.symantec.com/connect/blogs/duqu-status-update-1
http://www.symantec.com/connect/blogs/duqu-updated-targeting-information
The latest version of Symantec white paper includes new information, such as details on further components we observed being downloaded onto a compromised machine.
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf

Gostev from Kaspersky about DuQu http://www.securelist.com/en/blog/208193182/The_Mystery_of_Duqu_Part_One

Microsoft confirmed yesterday that it's working on to repair a 0 day vulnerability affecting windows kernel which has been used in the recent attack "duqu".

Once installed, it launches a file conțaining an exploit of 0 day vulnerability in windows kernel! After the exploit is applied it may obtain rights of execution to the remote infected system.

DuQu Virus DuQu Virus