Slashdot Mirror
Open Source Tool Scans For Duqu Drivers
wiredmikey writes "A new open source scanning tool has been released by engineers at independent security testing firm NSS Labs that can be used to detect Duqu drivers installed on a system. The tool was developed with the goal of discovering any additional drivers, and to enable researchers to learn more about the functionality, capabilities and ultimate purpose of the Duqu malware."
I like the effort, and appreciate the tool, but how many windows users have python installed? ;>
Look, whoever is doing this...
1. is doing good
2. probably will resort to bombs, cruise missiles, and/or sneaky poisoning if this doesn't work
If you have Gimp installed on a windows system, it has a Python executable in its Python directory. Gimp uses Python for its plugins
In Suriname / Dutch slang, "doekoe" (pronounced as "duku") means money.
So, what would be the ultimate purpose of "Duqu"?
To make heaps of money with it!
The GP is correct: Python is not common on Windows systems, particularly desktops. Means most users can't grab the tool and use it, which is really what you want. The more steps required for a tool to be used, the less likely people are to use it.
non-diverse corporate systems are the easiest to attack, right behind Windows
Seriously... what sort of a virus/trojan/worm makes its presence known by leaving the driver files around for any old userspace app to peruse???
Every time I come across a virus I am kind of disappointed at how easy they are to detect. They hook this and that, but then go and kill your antivirus software - a dead giveaway. That wouldn't trip up most home users, but then the malware also makes so many TCP connections that internet browsing doesn't work anymore, which means the user either wipes it and reinstalls, or takes it into the shop to get fixed. Actually finding where the thing is hiding is still a bit of a challenge, but the fact that they kill AV tools and pretty much anything from sysinternals, and the egress traffic they generate, is a dead giveaway that something is hiding there.
OTOH... maybe the perfect virus does exist and it's everywhere but nobody knows they have it...
Didn't Microsoft promise that they were going to run their exploit detection tools on all their software.
What ever came of that ?
File "DuquDriverPatterns.py", line 991
patternsFound = {}
^
TabError: inconsistent use of tabs and spaces in indentation
download 1
Win XP, Python 3.2.2, script downloaded by 'save as' clicked on file name. Result - parts html of website included in PY file.
c:\Program Files\python32>python.exe DuquDriverPatterns.py
File "DuquDriverPatterns.py", line 4
^
SyntaxError: invalid syntax
==-=-=-=
download 2
Script copied
c:\Program Files\python32>python.exe du.py
File "du.py", line 991
patternsFound = {}
^
IndentationError: expected an indented block
=-=--=-=
download 3
ahhh i found it, download and zipped version!! AND FAIL AGAIN?
c:\Program Files\python32>python.exe DuquDriverPatterns.py
File "DuquDriverPatterns.py", line 991
patternsFound = {}
^
TabError: inconsistent use of tabs and spaces in indentation
-=-=-=-=-=-=-
SIMPLE QUESTION. HOW CAN I DOWNLOAD AND EXECUTE THIS FILE WITHOUT ERRORS????
I co-wrote & use a PyThon 2.7x based system for populating a custom HOSTS file from many reputable & reliable sources (around 15 total), & it works non-stop, every 15 minutes here (which the system also removes duplicates/normalizes the data also) doing so... I moved from a system built in Delphi (2002-2010) & before that, from Access (only did part of the FULL job the last 2 did though, 1997-2002).
Why'd I go Python?
Well... because it's pretty much "write once/run anywhere" multi-platform capable, & I tend to stick by 2.7x compatible code (as I heard there's still "1/2 baked-ness" type issues w/ 3.x series still)... & there you are.
* Anyhow/anyways: So - Yes, there ARE Windows users who ave it online, myself being one of them!
APK
P.S.=> Still, I'll give you 1 thing - I'm probably a rarity though, I'll give you that!
...apk
You can use your installation media to clear bootsector malware of any kind!
---
1.) Boot up to RECOVERY CONSOLE (read only environs of the install media, use this)
2.) Use FixMBR to FIRST fix a bootsector
3.) OPTIONAL: IF a bogus rootkit protects that with a driver (ala hello_tt.sys, from "the indestructible rootkit" a month or so ago)? You can use the DISABLE command to stop said "bogus bootsector protector" driver (again, hello_tt.sys in the case above), which upon reboot disables the protective driver from loading and protecting its bogus bootsector!
---
The KNOWN drivers to disable, are as follows:
cmi4432.sys, jminet7.sys, nfrd965.sys, & adpu321.sys 4 drivers & NETP191.PNF DLL is the usermode lib to destroy & that's covered below too on its removal a couple ways!
(The files noted are per Symantec's updated research on it here -> http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf )
(After this "optional step" (optional for rootkits that just use a bogus bootsector that is), because this thing uses drivers, perform step #1 once more, & you SHOULD be ok - this is how you kill these types of rootkits from a read-only inviolate environs, & one that works PRIOR to a rootkit being able to deceive usermode antivirus/antispyware/antimalware tools in general!)
Mind you - This is about a 5 MINUTE FIX too, very fast...
* You do those steps, in THAT exact order, with most ANY rootkit (provided their drivers do NOT protect the reg init. area for drivers (which isn't always the case in rootkits, using drivers for that))?
It's history!
(AND, yes, with tools you already OWN if you're a Windows user!)
NOW - Should the rootkit "haul in" more malware while you're in usermode operations?
Well, 2 ways to kill that too (sometimes, rootkits do that also in usermode):
---
A.) RECOVERY CONSOLE bootup, use the DEL command on the offending malware's files...
OR
B.) ProcessExplorer.exe (to first find the offending exe or, dll/lib even if loaded under another process, infesting/infecting it, to first halt the parent callng process & delete the malware dll/lib on disk being called on).
---
"Here endeth the lesson"...
APK
P.S.=> LINUX IS NOT NEEDED AT ALL TO KILL THIS THING & as long as this thing's drivers DO NOT PROTECT THE REGISTRY INIT./LOAD AREAS FOR THOSE DRIVERS (& as far as I have read about its current design, it does not)? This technique will work to make it "history" ... apk
CrySys Lab released a new open-source toolkit to detect duqu traces (possibly some file left after duqu uninstalled itself after 30-36 days) and running Duqu instances. .PNF files and reports those suspiciously random ones.
http://www.crysys.hu/duqudetector/
Our tool combines heurestic and signature based approach, e.g. it calculates entropy for