Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

166 8. DUQU, FLAME, GAUSS, THE NEXT GENERATION OF CYBER EXPLOITATIONAdditionally, the client software, which would be installed on desktop computers containinginformation that the controllers wished to extract, was focused in specific geographic areas.Where Duqu is deployed is also a choice wholly left up to its controllers, so where it is found isindicative of, to a least a broad degree, the type of information that its operators are looking tosteal. Kaspersky reported finding Duqu only in Iran and in Sudan. 17Kaspersky, while researching the command and control structure for Duqu, discoveredthat at least 12 command and control servers had been used by the controllers of Duqu overthe past 3 years. On every server that Kaspersky examined, large portions of informationrelevant to Duqu’s activities had been erased days prior. This action does communicatea signal—the controllers of the operation were cognizant of their exposure and were willingand capable to take actions to mitigate the compromise. 18TDL3 AND OTHER MALWAREThere are other pieces of malicious software that are multistage and perform injection. TheTDL3 rootkit (ca. 2009) included many of the features that Stuxnet and Duqu possess. TDL3used a nonpublic exploit in Windows to elevate its privilege to kernel-mode in a way thatbypassed antivirus software. TDL3 would also make changes to existing device drivers presenton the operating system that would cause TDL3 to load and start every time the operatingsystem loaded. TDL3 is a generic rootkit framework that allows customers who purchase theTDL3 software from its authors to assemble malware that can be installed onto compromisedcomputers for a variety of reasons. Some pieces of malware that are built using TDL3 are informationstealers, while others send spam or attempt to entice the user of the compromisedcomputer to purchase fake antivirus software.TDL3 evaded detection by exploiting a weakness in the algorithm that antirootkit technologiesuse. TDL3’s successful evasion of detection was the result of studying antivirussoftware’s responses to previous rootkits and exploiting weaknesses in those responses. 19The media has emphasized these and other advanced techniques that are employed byDuqu, but when viewed alongside other pieces of malware, the techniques used by Duqudo not seem particularly advanced, while many other successful pieces of malware incorporatesimilar effective techniques.OBJECT-ORIENTED MALWARE: STUXNET, DUQU, FLAME,AND GAUSSOne aspect about Duqu and Stuxnet that has led some researchers to consider the twopieces of malware as “cousins” is that both pieces of software were written with the extensiveuse of a paradigm known as object-oriented programming (OOP). In more traditional methodsof computer programming, software is designed to resemble a series of tasks that the computermust accomplish to achieve a desired outcome. In object-oriented programming, onthe other hand, the programmer creates objects that manipulate data in various ways to reacha desired end state. One of the main advantages to using the object-oriented approach is that itis easier for a developer to create and maintain a large and complex piece of software. The use