NSS Labs Claims Its New Tool Can Detect All Duqu Drivers

Security research firm NSS Labs has released an open source scanning tool that is capable of detecting all malicious drivers used by the new Duqu threat, according to its engineers. However, other security vendors believe that the malware’s creators are capable of evading detection at any time.

According to NSS Labs, its scanner uses advanced pattern recognition techniques and was created to further research Duqu, the piece of malware that has captured the attention of the entire security industry in recent weeks.

Many experts believe that Duqu is closely related to the Stuxnet industrial sabotage worm discovered last year. The new threat borrows attack techniques and even code from what has been described as the most sophisticated piece of malware of all time.

The security research community has so far determined that Duqu infects systems by exploiting an unpatched vulnerability in the Windows kernel through rogue Word documents, that it has a modular architecture that includes a rootkit component operating as a system driver, and that it targets organizations with the purpose of exfiltrating sensitive information.

“This tool was developed in the hopes that additional drivers can be discovered to allow us to learn more about the functionality, capabilities and ultimate purpose of DuQu,” the NSS Labs engineers who created the open-source scanner said in a blog post.

The security company claims that the tool is capable of detecting Duqu drivers without any false positives and that it even picked up two samples discovered after its creation.

However, Costin Raiu, director of the global research and analysis team at antivirus vendor Kaspersky Lab, raised some concerns about the tool’s scope. “It’s useful, however I believe its heuristics rules are too narrow,” he said.

According to him, any heuristic tool that detects Duqu drivers should also detect the Stuxnet ones, because of the high similarity between them. This doesn’t appear to be the case with the new NSS Labs scanner.

Kaspersky Lab doesn’t currently offer a removal tool tailored specifically for Duqu, because of the threat’s complexity, said Raiu. “Just a single removal tool is simply not sufficient. Each infection case should be treated very seriously and we recommend the victims to contact us immediately for full forensics,” he added.

Analyzing the other components left by Duqu on infected systems, aside from the malicious drivers, is equally important according to the security expert, because they might provide information about what the attackers were after.

Raiu doesn’t believe that the open-source nature of the NSS Labs tool makes it easier for Duqu’s creators to evade detection. “Evidence shows that the authors of Duqu and Stuxnet made sure their malware was undetected at the time of the attack anyways, so they are already bypassing detections,” he said.

“Open source or not, it shouldn’t be a problem for them to create new undetected components in the future,” Raiu added.

His opinion is shared by Mikko Hypponen, the chief research officer at antivirus firm F-Secure. “Creators of Duqu are world class. They would have no problem evading detection of any scanner if they wanted to,” he said.

NSS Labs is not only offering the scanner for free, but also the complete reverse-engineered Duqu code and other resources. However, the code will only be available to researchers who contact the company and pass its vetting process.