Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Microsoft unlikely to patch Duqu kernel bug next week

Expect a security advisory concerning sophisticated remote-access Trojan

Article comments

Microsoft will probably not patch the Windows kernel bug next week that the Duqu remote-access Trojan exploits to plant itself on targeted PCs, according to a leading researcher.

"Probably not," said Andrew Storms, director of security operations at nCircle Security, when asked what chance he gave Microsoft fixing the flaw on November 8,  this month's regular Patch Tuesday.

"I think we'll see an advisory, but patching next week would really be pushing it for Microsoft," said Storms.

He based his assumption on Microsoft's apparently reactive move to news today from Symantec, which said that additional analysis showed the Duqu malware is installed after a Windows kernel bug is exploited .

Trojan launched through Word

"If Microsoft had information about the vulnerability before this, it would have been faster either patching or with an advisory," said Storms. "They're in reaction mode now, and probably working up an advisory."

Storms took a stab at what the advisory will contain.

"They'll likely recommend filtering Word documents, and using tools to change older documents to the newer file format," said Storms.

According to Symantec, the Duqu samples it's acquired rely on a malformed Word document to launch the kernel exploit.

Duqu, which Symantec first publicised last month, was characterised by the security firm as a possible precursor to the next Stuxnet , the ultra-sophisticated worm that last year was pegged as an attack tool aimed at Iran's nuclear programme.

Some analysts, however, have disagreed, and have dismissed the idea that Duqu can be reliably linked to Stuxnet.

Today, Storms said that the hackers' exploit of the Windows kernel vulnerability reinforces the latter view.

Sophisticated attack

"They're using the kernel bug to deploy the Trojan," said Storms, pointing to Symantec's explanation and accompanying diagramme of Duqu's infection process. "That tells me Duqu may not be a very sophisticated attack."

Leveraging kernel vulnerabilities - which typically let attacks gain the rights necessary on the targeted PC to install further malware - is "pretty common," noted Storms.

Microsoft has patched scores of kernel vulnerabilities this year, including a whopping 30 in April 2011 alone.

Today, Microsoft said it's on the case.

"Microsoft is collaborating with our partners to provide protections for a vulnerability used in targeted attempts to infect computers with the Duqu malware," said Jerry Bryant of the Microsoft Trustworthy Computing group. "We are working diligently to address this issue and will release a security update for customers through our security bulletin process."

A Microsoft spokeswoman later declined to comment on when the company would patch the kernel vulnerability.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *