Focus 2011: McAfee dissects Duqu targeted attack

LAS VEGAS: McAfee is shedding light on a recently discovered malware attack that could be connected to the Stuxnet malware.

Known as "Duqu", the malware has been found to be targeting industrial control systems in Southeast Asia and Northern Africa.

According to McAfee researchers, the Duqu infection has been spread using rogue security certificates. They believe the malware's creators were able to compromise the systems of a certificate authority (CA) firm and then generate certificates for use in the attacks.

VeriSign has since invalidated the certificates used in the attacks and the malware's command and control servers have been blacklisted by McAfee.

Dave Marcus, McAfee Labs head of research and communications, told reporters that while there is no proof Duqu is connected to Stuxnet, the two infections share a number of traits.

Much like Stuxnet, the Duqu malware makes use of multiple encryption keys and rootkit functionalities as well as similar coding techniques. Additionally, the compromised certificate authority and Duqu-infected systems are in the same region as those hit by Stuxnet.

Marcus noted that the compromise of the certificate authority was a key component of the attack. He said that when a CA is compromised and rogue certificates issued, the entire system is undermined.

He suggested CAs need to do more to test their systems and protect themselves from attacks.

"I think you are talking about an area that they may not have fully understood before," Marcus said.

"They need to get together as a group and say our industry is being targeted, what can we do as a group?"

Meanwhile, Marcus suggested that the rest of the industry adjust its perception of targeted attacks. He noted that while Duqu appeared to be a sophisticated attack, many targeted operations rely on relatively simple techniques to infect systems and steal data.

"Just because you are a script kiddie infecting machines for fun does not mean you are not using sophisticated techniques," Marcus explained.

"On the other side, just because you are engaging in nation state attacks does not mean you are using Stuxnet every time."