FAQ on Son of Stuxnet

What is Duqu?

Duqu (pronounced dyu kyu) is primarily a remote-access Trojan targeted at a limited number of organizations in Europe, Africa and the Middle East to gather intelligence that can help plan a future attack.

Why is it called Duqu?

It creates files with the prefix ~DQ.

Why is it called Son of Stuxnet?

Much of its code is identical to Stuxnet code, the malware that took over control of machinery in Iran’s nuclear refinement program and wore it out.

How long has it been in use?

It was discovered Sept. 1 but might have been in use since December 2010.

MORE: Symantec, McAfee differ on Duqu threat

What has it done?

It has performed reconnaissance on the networks it infects.

How does it do that?

First, it infects a system. The mechanism for getting in — thumb drive, social engineering, etc. — is not known.

Once it is running on a system, it connects with a command and control server in India (since blocked by its ISP) from which it downloads other malware. This includes information-stealing programs that can copy keystrokes, gather system information and scan networks for vulnerabilities. It could download other types of malware as well.

What is its purpose?

That’s uncertain. Experts think it is laying the groundwork for an attack of unspecified intent. Duqu had no offensive capabilities but could reach out to a command and control server for them. Stuxnet’s capabilities included exploiting vulnerabilities in Siemens gear that controlled industrial systems.

Who is targeted?

Experts differ. Some say it was after certificate authorities, some say it was after a maker of control systems based in Europe.

Who’s behind it?

Likely the same group that was behind Stuxnet because it uses so much identical code. No one knows for sure who was behind Stuxnet but the sophistication indicates a nation, possibly the U.S. and Israel.

How do you know if you’ve got it?

Anti-malware vendors should develop signatures for it that will find it and remove it. It’s also likely that if it is used again, its creators will alter the signature to avoid detection.

Is it a major worry?

At the moment, it seems to have been put out of business by knocking out its command and control server. It’s possible, though, that if it can’t reach its primary C&C server, it may try a backup. The code hasn’t all been deciphered and reviewed, so not all of its capabilities are known.

Who discovered it?

That’s secret, but it’s described as an independent research group.

Read more about wide area network in Network World’s Wide Area Network section.