Duqu infection linked to Microsoft Word exploit Skip to main content

Duqu infection linked to Microsoft Word exploit

BBC

The Duqu computer infection was spread with the help of an infected Microsoft Word document, according to a report.

The research says the Trojan exploited a previously unknown vulnerability embedded in Word files, allowing Duqu to modify computers' security protection.

The code is believed to have been designed to gather intelligence from industrial control-systems.

Microsoft says it is preparing a software patch to address the issue.

The Laboratory of Cryptography and Systems Security (Crysys) at Budapest University made the discovery.

"We carefully analysed the available forensics data from the original incident where Duqu was uncovered," Dr Boldizsar Bencsath, who led the investigation, told the BBC.

"We found suspicious files that we further analysed, and in one case, we were able to prove that the file contains the installer of Duqu and it uses a zero-day exploit."

A zero-day exploit is a computer threat that make use of a previously unknown software error to allow the attacker to gain permissions they should not have.

Dr Bencsath added that it is possible that Duqu may also be installed by other means, but he had not found any evidence to suggest it.
Global attack

The news is being publicised by the internet security firm Symantec.

It says that it has confirmed the Duqu infection at six different computer networks belonging to unidentified organisations across a total of eight countries. They include Iran, India, France and Ukraine.

In addition other security firms have reported suspected infections in a further four countries, including the UK.

Duqu has been compared to last year's Stuxnet worm attack, but Symantec says they operate in two distinct ways.

"Stuxnet was about spreading as far and as wide as possible to hunt down systems that could pass on control of industrial organisations - such as nuclear power plants," said Greg Day, Symantec's director of security strategy.

"Duqu has specifically targeted a number of organisations looking to scan across their internal systems, gather intelligence and pass it back out.

"The sort of things it's collecting are design documents and other information that could be the reconnaissance for a further attack."
Patch

So far neither Symantec nor Crysys have been able to trace who is receiving the data. Efforts to address the exploit are ongoing.

"Microsoft is working with our partners to provide protections for a vulnerability used in targeted attempts to infect computers with the Duqu malware," a company statement said.

"We will be providing a security update for customers through our update process."

Experts say these types of focused attacks appear to be on the rise.

Earlier this week Symantec reported that 29 chemicals firms had been targeted by a separate Trojan named PoisonIvy.

"Industrial espionage is the natural evolution from cybercrime," said Mr Day.

"Cybercrime is like pick pocketing. But these latest threats are like great train robberies, where the attackers have taken time to understand the intended victim and have a carefully constructed plan to rob them."

Comments

Popular posts from this blog

Chronology of the Press in Burma

1836 – 1846 * During this period the first English-language newspaper was launched under British-ruled Tenasserim, southern  Burma . The first ethnic Karen-language and Burmese-language newspapers also appear in this period.     March 3, 1836 —The first English-language newspaper,  The Maulmain Chronicle , appears in the city of Moulmein in British-ruled Tenasserim. The paper, first published by a British official named E.A. Blundell, continued up until the 1950s. September 1842 —Tavoy’s  Hsa-tu-gaw  (the  Morning Star ), a monthly publication in the Karen-language of  Sgaw ,  is established by the Baptist mission. It is the first ethnic language newspaper. Circulation reached about three hundred until its publication ceased in 1849. January 1843 —The Baptist mission publishes a monthly newspaper, the Christian  Dhamma  Thadinsa  (the  Religious Herald ), in Moulmein. Supposedly the first Burmese-language newspaper, it continued up until the first year of the second Angl

ARSA claims ambush on Myanmar security forces

Arakan Rohingya Salvation Army (ARSA) on Sunday claimed responsibility for an ambush on Myanmar security forces that left several wounded in northern Rakhine state, the first attack in weeks in a region gutted by violence. Rakhine was plunged into turmoil last August, when a series of ARSA raids prompted a military backlash so brutal the UN says it likely amounts to ethnic cleansing of the Muslim Rohingya minority. The army campaign sent some 650,000 Rohingya fleeing for Bangladesh, where refugees have given harrowing accounts of rape, murder and arson at the hands of security forces and vigilantes. Myanmar's military, which tightly controls information about Rakhine, denies any abuses and insists the crackdown was a proportionate response to crush the "terrorist" threat. ARSA have launched few attacks in recent months.  But the army reported that "about ten" Rohingya terrorists ambushed a car with hand-made mines and gunfire on Friday morning

Thai penis whitening trend raises eyebrows

Image copyright LELUXHOSPITAL Image caption Authorities warn the procedure could be quite painful A supposed trend of penis whitening has captivated Thailand in recent days and left it asking if the country's beauty industry is taking things too far. Skin whitening is nothing new in many Asian countries, where darker skin is often associated with outdoor labour, therefore, being poorer. But even so, when a clip of a clinic's latest intriguing procedure was posted online, it quickly went viral. Thailand's health ministry has since issued a warning over the procedure. The BBC Thai service spoke to one patient who had undergone the treatment, who told them: "I wanted to feel more confident in my swimming briefs". The 30-year-old said his first session of several was two months ago, and he had since seen a definite change in the shade. 'What for?' The original Facebook post from the clinic offering the treatment, which uses lasers to break do