NSS Labs claims its new tool can detect all Duqu drivers

But other security vendors expect Duqu to continue to evade detection

Security research firm NSS Labs has released an open source scanning tool that is capable of detecting all malicious drivers used by the new Duqu threat, according to its engineers. However, other security vendors believe that the malware's creators are capable of evading detection at any time.

According to NSS Labs, its scanner uses advanced pattern recognition techniques and was created to further research Duqu, the piece of malware that has captured the attention of the entire security industry in recent weeks.

Many experts believe that Duqu is closely related to the Stuxnet industrial sabotage worm discovered last year. The new threat borrows attack techniques and even code from what has been described as the most sophisticated piece of malware of all time.

The security research community has so far determined that Duqu infects systems by exploiting an unpatched vulnerability in the Windows kernel through rogue Word documents, that it has a modular architecture that includes a rootkit component operating as a system driver, and that it targets organizations with the purpose of exfiltrating sensitive information.

"This tool was developed in the hopes that additional drivers can be discovered to allow us to learn more about the functionality, capabilities and ultimate purpose of DuQu," the NSS Labs engineers who created the open-source scanner said in a blog post.

The security company claims that the tool is capable of detecting Duqu drivers without any false positives and that it even picked up two samples discovered after its creation.

However, Costin Raiu, director of the global research and analysis team at antivirus vendor Kaspersky Lab, raised some concerns about the tool's scope. "It's useful, however I believe its heuristics rules are too narrow," he said.

According to him, any heuristic tool that detects Duqu drivers should also detect the Stuxnet ones, because of the high similarity between them. This doesn't appear to be the case with the new NSS Labs scanner.

Kaspersky Lab doesn't currently offer a removal tool tailored specifically for Duqu, because of the threat's complexity, said Raiu. "Just a single removal tool is simply not sufficient. Each infection case should be treated very seriously and we recommend the victims to contact us immediately for full forensics," he added.

Analyzing the other components left by Duqu on infected systems, aside from the malicious drivers, is equally important according to the security expert, because they might provide information about what the attackers were after.

Raiu doesn't believe that the open-source nature of the NSS Labs tool makes it easier for Duqu's creators to evade detection. "Evidence shows that the authors of Duqu and Stuxnet made sure their malware was undetected at the time of the attack anyways, so they are already bypassing detections," he said.

"Open source or not, it shouldn't be a problem for them to create new undetected components in the future," Raiu added.

His opinion is shared by Mikko Hypponen, the chief research officer at antivirus firm F-Secure. "Creators of Duqu are world class. They would have no problem evading detection of any scanner if they wanted to," he said.

NSS Labs is not only offering the scanner for free, but also the complete reverse-engineered Duqu code and other resources. However, the code will only be available to researchers who contact the company and pass its vetting process.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags NSS Labssecuritymalware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Deals on Good Gear Guide

Deals on Good Gear Guide


Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.


Latest Jobs


Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?