Analysis and diversion of Duqu's driver

2013 8th International Conference on Malicious and Unwanted Software: "The Americas" (MALWARE) Pub Date : 2013-10-01 DOI:10.1109/MALWARE.2013.6703692

Guillaume Bonfante, J. Marion, Fabrice Sabatier, Aurélien Thierry

引用次数: 10

Abstract

The propagation techniques and the payload of Duqu have been closely studied over the past year and it has been said that Duqu shared functionalities with Stuxnet. We focused on the driver used by Duqu during the infection, our contribution consists in reverse-engineering the driver: we rebuilt its source code and analyzed the mechanisms it uses to execute the payload while avoiding detection. Then we diverted the driver into a defensive version capable of detecting injections in Windows binaries, thus preventing further attacks. We specifically show how Duqu's modified driver would have detected Duqu.

查看原文本刊更多论文

杜曲司机的分析与分流

在过去的一年里，Duqu的传播技术和有效载荷已经被密切研究，据说Duqu与震网具有相同的功能。我们专注于Duqu在感染期间使用的驱动程序，我们的贡献包括对驱动程序进行逆向工程:我们重建了它的源代码，并分析了它在避免检测的情况下执行有效负载的机制。然后我们将驱动程序转换为能够检测Windows二进制文件中的注入的防御版本，从而防止进一步的攻击。我们特别展示了Duqu修改后的驱动程序是如何检测到Duqu的。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

2013 8th International Conference on Malicious and Unwanted Software: "The Americas" (MALWARE)

自引率

0.00%

发文量