NSS Labs claims its new tool can detect all Duqu drivers

But other security vendors expect Duqu to continue to evade detection

Security research firm NSS Labs has released an open source scanning tool that is capable of detecting all malicious drivers used by the new Duqu threat, according to its engineers. However, other security vendors believe that the malware's creators are capable of evading detection at any time.

According to NSS Labs, its scanner uses advanced pattern recognition techniques and was created to further research Duqu, the piece of malware that has captured the attention of the entire security industry in recent weeks.

Many experts believe that Duqu is closely related to the Stuxnet industrial sabotage worm discovered last year. The new threat borrows attack techniques and even code from what has been described as the most sophisticated piece of malware of all time.

The security research community has so far determined that Duqu infects systems by exploiting an unpatched vulnerability in the Windows kernel through rogue Word documents, that it has a modular architecture that includes a rootkit component operating as a system driver, and that it targets organizations with the purpose of exfiltrating sensitive information.

"This tool was developed in the hopes that additional drivers can be discovered to allow us to learn more about the functionality, capabilities and ultimate purpose of DuQu," the NSS Labs engineers who created the open-source scanner said in a blog post.

The security company claims that the tool is capable of detecting Duqu drivers without any false positives and that it even picked up two samples discovered after its creation.

However, Costin Raiu, director of the global research and analysis team at antivirus vendor Kaspersky Lab, raised some concerns about the tool's scope. "It's useful, however I believe its heuristics rules are too narrow," he said.

According to him, any heuristic tool that detects Duqu drivers should also detect the Stuxnet ones, because of the high similarity between them. This doesn't appear to be the case with the new NSS Labs scanner.

Kaspersky Lab doesn't currently offer a removal tool tailored specifically for Duqu, because of the threat's complexity, said Raiu. "Just a single removal tool is simply not sufficient. Each infection case should be treated very seriously and we recommend the victims to contact us immediately for full forensics," he added.

Analyzing the other components left by Duqu on infected systems, aside from the malicious drivers, is equally important according to the security expert, because they might provide information about what the attackers were after.

Raiu doesn't believe that the open-source nature of the NSS Labs tool makes it easier for Duqu's creators to evade detection. "Evidence shows that the authors of Duqu and Stuxnet made sure their malware was undetected at the time of the attack anyways, so they are already bypassing detections," he said.

"Open source or not, it shouldn't be a problem for them to create new undetected components in the future," Raiu added.

His opinion is shared by Mikko Hypponen, the chief research officer at antivirus firm F-Secure. "Creators of Duqu are world class. They would have no problem evading detection of any scanner if they wanted to," he said.

NSS Labs is not only offering the scanner for free, but also the complete reverse-engineered Duqu code and other resources. However, the code will only be available to researchers who contact the company and pass its vetting process.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwareNSS Labs

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Lucian Constantin

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?