The multi-vector network attack called Duqu made a splash a few weeks ago because of its strong resemblance to Stuxnet. Stuxnet, as you'll remember, was a multi-part targeted attack that's credited with damaging Iran's nuclear capabilities. Duqu's code resembles Stuxnet's closely enough that many security programs initial identified it as Stuxnet. However, the four zero-day exploits that made Stuxnet so powerful are old and harmless now. But wait; it turns out Duqu has a zero-day exploit of its own.

 

CrySyS, the group responsible for the original discovery of Duqu, managed to obtain an installer for the tool. This let them explore exactly how the threat spreads. It turns out that the initial attack comes in the form of a modified Microsoft Word document that exploits a kernel vulnerability hitherto unknown. According to Symantec, Microsoft is "working diligently towards issuing a patch and advisory."

In a post on Symantec's blog researchers detail exactly how the attack takes place. The document in question was designed specifically to target the receiving organization, made to look like something in the ordinary course of business. The report also notes that the shellcode they found ensures the attack will only be installed "during an eight-day window in August."

Once it gets a foothold in the organization, Duqu can spread within the network. Part of the attack is a 'bot-like component that gets instructions from a remote command-and-control (C&C) server. On encountering a computer with access to the network but not to the Internet (typical of computers needing extra security), Duqu creates a bridge that lets the C&C server issue orders despite the lack of a direct Internet connection.

Based on reported instances of Duqu infection researchers have identified six industrial control system manufacturers  (not identified by name in the report) that may have been targets. Two are in Iran and one each in Vietnam, Sudan, and India. The last one has a presence in several European countries. Experts at Symantec, CrySyS, and other organizations continue to work toward a thorough understanding of Duqu and to spot any active attacks against the target companies.