Analysis and Diversion of Duqu's Driver - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2013

Analysis and Diversion of Duqu's Driver

Abstract

The propagation techniques and the payload of Duqu have been closely studied over the past year and it has been said that Duqu shared functionalities with Stuxnet. We focused on the driver used by Duqu during the infection, our contribution consists in reverse-engineering the driver: we rebuilt its source code and analyzed the mechanisms it uses to execute the payload while avoiding detection. Then we diverted the driver into a defensive version capable of detecting injections in Windows binaries, thus preventing further attacks. We specifically show how Duqu's modified driver would have detected Duqu.
Fichier principal
Vignette du fichier
malware2013.pdf (310.14 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-00925517 , version 1 (08-01-2014)

Identifiers

Cite

Guillaume Bonfante, Jean-Yves Marion, Fabrice Sabatier, Aurélien Thierry. Analysis and Diversion of Duqu's Driver. Malware 2013 - 8th International Conference on Malicious and Unwanted Software, Oct 2013, Fajardo, Puerto Rico. ⟨hal-00925517⟩
264 View
309 Download

Altmetric

Share

Gmail Facebook Twitter LinkedIn More