That MYSTERY Duqu Trojan language: Plain old C
An appeal for help from the programming community has allowed antivirus analysts to classify the unknown language used to develop key components of the Duqu Trojan.
Duqu creates a backdoor on compromised SCADA-based industrial control systems. The malware is closely related to the nuke plant centrifuge-busting Stuxnet worm and was probably developed by the same group. Security researchers at Kaspersky Lab found that Duqu uses the mystery code to communicate with its command-and-control (C&C) servers from infected machines. Unlike the rest of Duqu, the so-called Duqu Framework is not written in C++ and it's not compiled with Microsoft's Visual C++ 2008.
The code was not written using Delphi or .Net, other virus-writing favourites, either. Hardcore VXers use assembler to write malicious code but it wasn't that either.
After going some way in unraveling the mystery language used by the Duqu Framework, Kaspersky Lab researchers appealed for help from the programming community.
During a webcast on Monday, Kaspersky Lab chief malware expert Vitaly Kamluk said that a variety of programming languages had been suggested in response for this appeal for help, including Lisp and Ada.
However the suggestion that the Duqu Framework might have been developed using old-school Object Oriented C (OO C) hit the bullseye. Code compiled using C and Microsoft Visual Studio 2008 was a close match for the code in the Duqu framework, allowing Kaspersky researchers to conclude that the framework had been written using a custom object-oriented extension to C or plain C with a changed dialect, as Kamluk described it.
"It's old school C. These are techniques used by professional software developers but not malware writers," Kamluk explained.
Kamluk said the whoever created the framework had reapplied an approach most often encountered in professional Mac OS applications development to create Windows malware.
Using the approach offered several advantages compared to using conventional malware writing techniques, Kamluk explained. He said that the approach created code that was "more efficient, smaller, faster, more flexible and re-useable".
Knowing the techniques used to develop the malware allows Kaspersky's researchers to make better guesses about who might be behind the code. The security researchers said that the Duqu framework was probably created by old school professional developers who were well used to making software using Object Oriented C.
"The developers of the framework prefer to extend an 'old-school' language with contemporary techniques," the Kaspersky boffins conclude. "The framework could have been reused from an existing software project. [The approach is] common for professional software developers, but unique for malware writers."
"The code was written by a team of experienced ‘old-school’ developers who wanted to create a customised framework to support a highly flexible and adaptable attack platform. The code could have been reused from previous cyber-operations and customised to integrate into the Duqu Trojan,” said Igor Soumenkov, Kaspersky Lab malware expert. “However, one thing is certain: these techniques are normally seen by elite software developers and almost never in today’s general malware.”
Creating Duqu was a major project, so it’s possible that an entirely different team was responsible for creating the Duqu Framework, while others worked on creating drivers and system infection exploits. In this scenario it's even possible that those who created the Duqu framework were ignorant of the real purpose of their work.
Compiling source code is a one-way transformation. Virus analysts are skilled at going from machine code to assembler but are unable to go any further. By experience the researchers can tell which language and compiler is likely used to write an item of malware, but the techniques used in the Duqu framework were not out of the regular VXer cookbook, hence the appeal for help from the wider programming community.
Researchers at Kaspersky were the first to find the "smoking code" linking Stuxnet and Duqu. A detailed analysis of the Duqu code by Kaspersky researchers, can be found here.
More on how the language behind the Duqu language was deduced can be found here. ®