Wednesday, July 8, 2015

Duqu 2.0 Technical Analysis


Last month, Kaspersky released a report for Duqu 2.0, which was used to compromise Kaspersky Lab.












The following sequence summarizes the attack.

Lets get into the technical details of the attack.

Lateral Movement

The attack utilized MS14-068, CVE-2014-6324 Elevation of Privilege Vulnerability in Kerberos KDC.
The exploit allows an unprivileged domain user to elevate the privileges to that of a Domain Admin.
The attacker as a Domain Admin, was able to launch the malicious MSI packages remotely to other systems.
Pass The Hash Technique was also observed to be used, in order to move laterally. Using this technique, the attacker was able to dump the user hashes and steal them to perform NTLM authentication without providing the password.

MS15-061 CVE-2015-2360

This was a vulnerability in win32k.sys kernel-mode driver that allows a local user to gain privilege escalation or memory corruption.

Lets take a look at some of the interesting patterns in the Malware Disassembly

Here we can see some interesting strings like HTTP Methods, HTTP Headers., content-type.


Here we can see the use of Proxy Headers too.


This shows the exported functions used by one of the DLLs.



Here we can see how MsiGetProperty pulls the values of PROP and HASHVAL which are later used for decrypting and loading other binaries.







Here we can see how proxy authentication is used in the disassembly.







We can observe the CONNECT Method too.




This shows the use of a Self Signed Certificate.





Here we can see the use of NamedPipe. The article points out the use of Named Pipe Based Backdoor




Kaspersky has released a bunch of IOCs which indicate the presence of the attack.
Since Microsoft has already patched the Vulnerabilities used in the attack, make sure your systems are fully patched. The sophistication of this attack calls for a much more sophisticated Security Platform that can identify, detect and remediate such an attack at an early stage.


10 comments:

  1. There are lots of information about latest technology and how to get trained in them, like this have spread around the web, but this is a unique one according to me. The strategy you have updated here will make me to get trained in future technologies. By the way you are running a great blog. Thanks for sharing this.
    Dotnet training in chennai

    ReplyDelete
  2. the blog is very useful, interesting and informative. thank you for sharing the blog with us. keep on updating.
    ROI Services in Chennai

    ReplyDelete


  3. What an awesome post, I just read it from start to end. Learned something new after a long time.

    datawarehousing training in Chennai

    ReplyDelete
  4. Great site for these post and i am seeing the most of contents have useful for my Carrier.Thanks to such a useful information.Any information are commands like to share him.

    digital marketing course in chennai

    ReplyDelete
  5. Such a great articles in my carrier, It's wonderful commands like easiest understand words of knowledge in information's.
    GRE Coaching in Chennai

    ReplyDelete
  6. This blog is having the general information. Got a creative work and this is very different one.We have to develop our creativity mind.This blog helps for this. Thank you for this blog. This is very interesting and useful.

    Fresher Jobs in Chennai
    Fresher Jobs in Delhi
    Fresher Jobs in Bangalore
    Fresher Jobs in Kolkata

    ReplyDelete
  7. This post is really nice and informative. The explanation given is really comprehensive and informative...
    Android app development company in Chennai

    ReplyDelete

  8. Wonderful blog.. Thanks for sharing informative Post. Its very useful to me.

    Installment loans
    Payday loans
    Title loans

    ReplyDelete
  9. Someone essentially lend a hand to make severely posts I would state. That is the very first time I frequented your website page and thus far? I surprised with the analysis you made to create this particular submit incredible. Fantastic job!
    Office Interiors in Chennai
    Interior Decorators in Chennai

    ReplyDelete
  10. It’s amazing in support of me to have a site, which is useful in support of my know-how. thanks admin, you surely come with remarkable articles. Cheers for sharing your website page.Excellent blog here...

    Professional movers singapore
    Movers company in singapore
    Office movers singapore

    ReplyDelete