NSS Labs claims its new tool can detect all Duqu drivers

But other security vendors expect Duqu to continue to evade detection

Security research firm NSS Labs has released an open source scanning tool that is capable of detecting all malicious drivers used by the new Duqu threat, according to its engineers. However, other security vendors believe that the malware's creators are capable of evading detection at any time.

According to NSS Labs, its scanner uses advanced pattern recognition techniques and was created to further research Duqu, the piece of malware that has captured the attention of the entire security industry in recent weeks.

Many experts believe that Duqu is closely related to the Stuxnet industrial sabotage worm discovered last year. The new threat borrows attack techniques and even code from what has been described as the most sophisticated piece of malware of all time.

The security research community has so far determined that Duqu infects systems by exploiting an unpatched vulnerability in the Windows kernel through rogue Word documents, that it has a modular architecture that includes a rootkit component operating as a system driver, and that it targets organizations with the purpose of exfiltrating sensitive information.

"This tool was developed in the hopes that additional drivers can be discovered to allow us to learn more about the functionality, capabilities and ultimate purpose of DuQu," the NSS Labs engineers who created the open-source scanner said in a blog post.

The security company claims that the tool is capable of detecting Duqu drivers without any false positives and that it even picked up two samples discovered after its creation.

However, Costin Raiu, director of the global research and analysis team at antivirus vendor Kaspersky Lab, raised some concerns about the tool's scope. "It's useful, however I believe its heuristics rules are too narrow," he said.

According to him, any heuristic tool that detects Duqu drivers should also detect the Stuxnet ones, because of the high similarity between them. This doesn't appear to be the case with the new NSS Labs scanner.

Kaspersky Lab doesn't currently offer a removal tool tailored specifically for Duqu, because of the threat's complexity, said Raiu. "Just a single removal tool is simply not sufficient. Each infection case should be treated very seriously and we recommend the victims to contact us immediately for full forensics," he added.

Analyzing the other components left by Duqu on infected systems, aside from the malicious drivers, is equally important according to the security expert, because they might provide information about what the attackers were after.

Raiu doesn't believe that the open-source nature of the NSS Labs tool makes it easier for Duqu's creators to evade detection. "Evidence shows that the authors of Duqu and Stuxnet made sure their malware was undetected at the time of the attack anyways, so they are already bypassing detections," he said.

"Open source or not, it shouldn't be a problem for them to create new undetected components in the future," Raiu added.

His opinion is shared by Mikko Hypponen, the chief research officer at antivirus firm F-Secure. "Creators of Duqu are world class. They would have no problem evading detection of any scanner if they wanted to," he said.

NSS Labs is not only offering the scanner for free, but also the complete reverse-engineered Duqu code and other resources. However, the code will only be available to researchers who contact the company and pass its vetting process.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags NSS Labssecuritymalware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?