Duqu attacks Windows via fonts; fix could harm display
Connecting state and local government leaders
The Stuxnet-like Duqu worm exploits a zero-day vulnerability in the handling of TrueType fonts; Microsoft's workaround suggests disabling access to the driver managing font displays.
The Duqu worm can install itself on Windows machines by exploiting a vulnerability in the handling of TrueType fonts, which Microsoft addresses with a workaround that denies access to the graphics driver managing font displays.
The company said it is investigating the vulnerability, originally reported by Symantec and researchers in Budapest, and that a more permanent patch might be issued in the future. In the meantime, applications relying on embedded font technology could fail to display properly when using the workaround.
Duqu has gained attention because it appears to include source code from the Stuxnet worm, a sophisticated cyber weapon believed to have successfully attacked and damaged uranium refining equipment in Iran. Researchers from Symantec Security Response confirmed that Duqu is nearly identical to Stuxnet but initially were not able to determine how the malware installed itself.
Related story:
Duqu exploits zero-day Windows vulnerability to install itself
The installer was recovered by the Laboratory of Cryptography and System Security at the Budapest University of Technology and Economics and analyzed by Symantec. The exploit in at least one case was delivered with the installer file in a Microsoft Word document attachment that had targeted the recipient.
The vulnerability is caused when a Windows kernel-mode driver, the Win32k TrueType font parsing engine, fails to properly handle the TrueType font type, Microsoft said. Microsoft said the vulnerability could be exploited various ways, such as providing documents or luring users to a Web page that embeds TrueType. A specially crafted TrueType font could then exploit the vulnerability.
The company said the vulnerability cannot be exploited automatically through e-mail; a user must open an attachment or visit a site to become infected.
According to the Common Vulnerabilities and Exposures database, the vulnerability is as yet unspecified but exists in the kernel in Microsoft Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista SP2; Windows Server 2008 SP2, R2, and R2 SP1; and Windows 7 Gold and SP1. It allows the remote execution of arbitrary code via crafted font data in a Word document, and it has been exploited in the wild by Duqu.
The Microsoft advisory provides instructions for denying access to the driver and for undoing the workaround, along with the option of having the workaround automatically applied through Microsoft Fix It.
Symantec has called Duqu “essentially the precursor to a future Stuxnet-like attack,” which now is operating in an information-gathering phase. The number of confirmed infections is limited, but it has spread in six possible organizations in eight countries: France, the Netherlands, Switzerland, Ukraine, India, Iran, Sudan and Vietnam. Other security vendors have reported infections in Austria, Hungary, Indonesia, the United Kingdom and Iran.
The exact number of organizations and their identities are not known because some addresses are traceable only to a service provider. This also makes it difficult to say why these organizations have been targeted and what the goal of the campaign is, Symantec researchers said.
Duqu can spread within networks, and one of its interesting features is the ability to communicate with a command and control server when installed on a computer without direct Internet access. It creates a bridge using other infected computers as proxies with Internet access, allowing attackers to control infections in secure zones.