Duqu 2.0 Hits Kaspersky Lab
securelist.com
Duqu 2.0 Hits Kaspersky Lab
1–10 of 60 posts
Re: Duqu 2.0 Hits Kaspersky Lab
#2"By targeting Kaspersky Lab, the Duqu attackers probably took a huge bet hoping they’d remain undiscovered; and lost."
That seems like a very nice spin on a successful attack that was eventually detected. How long were the attackers able to spy on their internal systems? Perhaps they didn't need ongoing access and simply wished to steal client files or documents.
Re: Duqu 2.0 Hits Kaspersky Lab
#3"By targeting Kaspersky Lab, the Duqu attackers probably took a huge bet hoping they’d remain undiscovered; and lost." That seems like a very nice spin on a successful attack that was eventually detected. How long were the attackers able to spy on their internal systems? Perhaps they didn't need ongoing access and simply wished to steal client files or documents.
That was my first thought aswell. One of the main takeaways from this is that Kaspersky Labs was probably compromised. Or at least there was an attempt. And the attacker is related to Stuxnet in some way. At least according to Kaspersky Lab.
Re: Duqu 2.0 Hits Kaspersky Lab
#4Related report from Symantec:
http://www.symantec.com/connect/blogs/duqu-20-reemergence-ag...
Eugene Kaspersky: "Why Hacking Us Was A Silly Thing To Do"
http://www.forbes.com/sites/eugenekaspersky/2015/06/10/why-h...
Re: Duqu 2.0 Hits Kaspersky Lab
#5I cannot but wonder what would have been the response here if similar attack had occurred inside Google or Facebook.
Re: Duqu 2.0 Hits Kaspersky Lab
#6"By targeting Kaspersky Lab, the Duqu attackers probably took a huge bet hoping they’d remain undiscovered; and lost." That seems like a very nice spin on a successful attack that was eventually detected. How long were the attackers able to spy on their internal systems? Perhaps they didn't need ongoing access and simply wished to steal client files or documents.
That was my first thought aswell. One of the main takeaways from this is that Kaspersky Labs was probably compromised. Or at least there was an attempt. And the attacker is related to Stuxnet in some way. At least according to Kaspersky Lab.
>Kaspersky Labs was probably compromised
Relevant quote:
"Company officials were unable to provide Ars with an estimate of how many megabytes or gigabytes of data were extracted from their network, in part because the custom network connections Duqu used may have bypassed normal logging procedures. The company hasn't ruled out the possibility the attackers obtained Kaspersky Lab source code, but there are no signs they tried to compromise any of Kaspersky's 400 million users."
from http://arstechnica.com/security/2015/06/stepson-of-stuxnet-s...
Re: Duqu 2.0 Hits Kaspersky Lab
#7Impressive to see most of the infections lived solely in memory. Along with the zerodays burned for this attack, you can tell this is a very professional team.
Re: Duqu 2.0 Hits Kaspersky Lab
#8So, correct me if I'm wrong: A non-technical user on their network DIDN'T have EMET running? Or did they, perhaps, have an EMET bypass in their shellcode?
If it's the latter, that's what I would be more interested in.
Re: Duqu 2.0 Hits Kaspersky Lab
#9This appears to be Israel from the technical report both because of the targets (Iran) and also the timezone data.
Re: Duqu 2.0 Hits Kaspersky Lab
#10The Windows 0-day is CVE-2015-2360 from MS15-061, it appears to be the only one Microsoft admits to have been exploited or used to attack it's customers.