Archived MSDN and TechNet Blogs
If you were looking for MSDN or TechNet blogs, please know that MSDN and TechNet blog sites have been retired, and blog content has been migrated and archived here. How to use this site Archived blogs are grouped alphabetically by the initial letter of the blog name. Select the initial letter from the TOC to see the full list of the blogs. You can also type the name of the blog or the title of the
Endpoint Protection - Symantec Enterprise
We recently received a file that looked very familiar. A quick investigation showed it to be a new version of W32.Duqu. The file we received is only one component of the Duqu threat however—it is the loader file used to load the rest of the threat when the computer restarts (the rest of the threat is stored encrypted on disk). The component we received has been highlighted below (Driver file .sys)
The mystery of Duqu Framework solved
The Quest for Identification In my previous blogpost about the Duqu Framework, I described one of the biggest remaining mysteries about Duqu – the oddities of the C&C communications module which appears to have been written in a different language than the rest of the Duqu code. As technical experts, we found this question very interesting and puzzling and we wanted to share it with the community.
The Mystery of the Duqu Framework
While analyzing the components of Duqu, we discovered an interesting anomaly in the main component that is responsible for its business logics, the Payload DLL. We would like to share our findings and ask for help identifying the code. Code layout At first glance, the Payload DLL looks like a regular Windows PE DLL file compiled with Microsoft Visual Studio 2008 (linker version 9.0). The entry poi
The Mystery of Duqu: Part Five
Driver The driver is the first component of Duqu to be loaded in the system. As we discovered, the driver and other components of malware are installed with a dropper exploiting a 0-day vulnerability (CVE-2011-3402). The driver is registered in the HKLMSystemCurrentControlSetServices registry path. The exact name of the registry key varies in different versions of Duqu drivers. Once the driver is
Duqu First Spotted as ‘Stars’ Malware in Iran
As we continue to investigate the Duqu targeted attack, there is new information that suggests the malware was created to spy on Iran’s nuclear program. Some background and facts: Back in April this year, Iran announced it was victim to a cyber-attack with a virus called “Stars.” This article offers some additional details on that attack. We can now confirm that some of the targets of Duqu were hi
News from the Lab Archive : January 2004 to September 2015
Due to its complexity, case Duqu is challenging to understand. Here are some questions and answers that we hope will help. Q: What is Duqu? A: Because of the news and ongoing developments surrounding Duqu, that's actually a very broad question. Here's a narrow answer: Duqu is a Windows bot (not worm) that has been used as part of highly targeted attacks against a limited number of organizations, i
The Mystery of Duqu: Part Three
First things first, I have to point out a mistake in the previous text. When analyzing the fourth incident in Iran, we stated that there were two network attacks on a victim machine from the IP address 63.87.255.149. It could have been an exclusive version of Duqu, but it turned out to be a big mistake. Judge for yourself – Duqu checks for Internet connections and attempts to reach the server kasp
Home - Broadcom Community - Discussion Forums, Technical Docs, Ideas and Blogs
Broadcom Software Academy We are pleased to announce the launch of the redesigned and upgraded Broadcom Software Academy. Enterprise Software Industry analysts agree: a scalable, open and flexible digital business technology platform is mandatory for digital business success. Explore our capabilities NetOps Virtual Summit Discover how leading organizations are using DX NetOps and AppNeta to assure
The Mystery of Duqu: Part Two
Our investigation and research of Duqu malware continues. In our previous report, we made two points: there are more drivers than it was previously thought; it is possible that there are additional modules. Besides those key points, we concluded that unlike the massive Stuxnet infections, Duqu attacks are limited to an extremely small number of targets. But before informing you about our new findi
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Mystery of Duqu Programming Language Solved
Wait ! It's not just Stuxnet or DuQu , Kaspersky reveals 5 more cousins
The Mystery of Duqu: Part Six (The Command and Control servers)
CrySyS Duqu Detector Open source Toolkit Released
Duqu malware was created to spy on Iran's nuclear program
Duqu malware was created to spy on Iran's nuclear program
Naked Security – Sophos News
Windows Kernel Zero Day Vulnerability Found in Duqu Installer
Duqu Trojan found in Indian Server
Endpoint Protection - Symantec Enterprise