What is Duqu Virus

Just few days ago Hackers find a security hole on the Microsoft OS Software and used this to send virus. This virus targeted victims via email and attached with a Microsoft word document. [Microsoft software bug Tied to Duqu virus] 
News and analysis started coming out earlier this week about the Duqu Trojan and the threat which it represents. McAfee, Symantec and Venafi has highlighted some of the potential implications of Duqu.
According to SYMANTEC:-

Symantec stated that on October 14, 2011, a research lab with strong international connections alerted the company to a sample that appeared to be very similar to Stuxnet [Read More: What is Stuxnet and How does it Works?]. They named the threat ‘Duqu’ because it creates files with the filename prefix ‘~DQ’. The research lab provided Symantec with samples recovered from computer systems located in Europe, as well as a detailed report with their initial findings, including analysis comparing the threat to Stuxnet. Symantec has been able to confirm that ‘parts of Duqu are nearly identical to Stuxnet, but with a completely different purpose’. 
Symantec says that Duqu is ‘essentially the precursor to a future Stuxnet-like attack. The threat was written by the same authors (or those that have access to the Stuxnet source code) and appears to have been created since the last Stuxnet file was recovered. Duqu’s purpose is to gather intelligencedata and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party. The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility.’ 
Duqu does not contain any code related to industrial control systems and is primarily a remote access Trojan (RAT). The threat does not self-replicate and is highly targeted toward a limited number of organizations for their specific assets. However, says Symantec, ‘it’s possible that other attacks are being conducted against other organizations in a similar manner with currently undetected variants’. 
More details. 
According to MCAFEE:- 
McAfee says that Duqu is based on Stuxnet and is very similar. ‘Only a few sites so far are known to have been attacked by the code, and it does not have PLC functionality like Stuxnet. Instead, the code, delivered via exploitation, installs drivers and encrypted DLLs that function very similarly to the original Stuxnet code. In fact, the new driver’s code used for the injection attack is very similar to Stuxnet, as are several encryption keys and techniques that were used in Stuxnet.’ 
Duqu is very time sensitive says McAfee and ‘is controlled by an extended, encrypted configuration file. It communicates with a command server in India. This IP address has since been blacklisted at the ISP and no longer functions. Yet it was specially crafted to execute sophisticated attacks against key targets and has remote control functionality to install new code on the target. These include key loggers, which can monitor all actions on systems: running processes, window messages, and so on. Furthermore, the key logger component also contains functionality to hide files with a user-mode rootkit.’ 
McAfee also says the following: ‘It is highly likely that this key, just like the previous two known cases, was not really stolen from the actual companies, but instead directly generated in the name of such companies at a CA as part of a direct attack.’ 
More details. 
According to VENAFI:-
Venafi has been exploring whether Duqu is a private key or a certificate authority compromise. The company warns that since the certificate used in Duqu is used for authentication — much like SSL server – and client-sidecertificates — either cause should warrant that organizations look closely at their security and operations management processes and response plans.Certificates are used for authentication, in addition to encryption.
Venafi highlights the following: 
CA compromise
If the Duqu creator compromised a CA to get their certificate, they could have also fraudulently issued other certificates. The security of that CA could be called into question, as well as all the certificates it issued. 
If a CA was compromised, companies with certificates from that CA must replace them and all organizations must ensure they’re not trusting that CA. Going beyond this incident, if Duqu is targeting CAs, that reinforces the importance of preparing for a CA compromise, especially coming on the heels of the DigiNotar CA breach this summer. 
Private key compromise
If the Duqu creator stole the private key of C-Media Electronics (the Taiwanese company whose certificate is associated with Duqu), that pointsJust few days ago Hackers find a security hole on the Microsoft OS Software and used this to send virus. This virus targeted victims via email and attached with a Microsoft word document. [Microsoft software bug Tied to Duqu virus] 
News and analysis started coming out earlier this week about the Duqu Trojan and the threat which it represents. McAfee, Symantec and Venafi has highlighted some of the potential implications of Duqu.
According to SYMANTEC:-

Symantec stated that on October 14, 2011, a research lab with strong international connections alerted the company to a sample that appeared to be very similar to Stuxnet [Read More: What is Stuxnet and How does it Works?]. They named the threat ‘Duqu’ because it creates files with the filename prefix ‘~DQ’. The research lab provided Symantec with samples recovered from computer systems located in Europe, as well as a detailed report with their initial findings, including analysis comparing the threat to Stuxnet. Symantec has been able to confirm that ‘parts of Duqu are nearly identical to Stuxnet, but with a completely different purpose’. 
Symantec says that Duqu is ‘essentially the precursor to a future Stuxnet-like attack. The threat was written by the same authors (or those that have access to the Stuxnet source code) and appears to have been created since the last Stuxnet file was recovered. Duqu’s purpose is to gather intelligencedata and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party. The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility.’ 
Duqu does not contain any code related to industrial control systems and is primarily a remote access Trojan (RAT). The threat does not self-replicate and is highly targeted toward a limited number of organizations for their specific assets. However, says Symantec, ‘it’s possible that other attacks are being conducted against other organizations in a similar manner with currently undetected variants’. 
More details. 
According to MCAFEE:- 
McAfee says that Duqu is based on Stuxnet and is very similar. ‘Only a few sites so far are known to have been attacked by the code, and it does not have PLC functionality like Stuxnet. Instead, the code, delivered via exploitation, installs drivers and encrypted DLLs that function very similarly to the original Stuxnet code. In fact, the new driver’s code used for the injection attack is very similar to Stuxnet, as are several encryption keys and techniques that were used in Stuxnet.’ 
Duqu is very time sensitive says McAfee and ‘is controlled by an extended, encrypted configuration file. It communicates with a command server in India. This IP address has since been blacklisted at the ISP and no longer functions. Yet it was specially crafted to execute sophisticated attacks against key targets and has remote control functionality to install new code on the target. These include key loggers, which can monitor all actions on systems: running processes, window messages, and so on. Furthermore, the key logger component also contains functionality to hide files with a user-mode rootkit.’ 
McAfee also says the following: ‘It is highly likely that this key, just like the previous two known cases, was not really stolen from the actual companies, but instead directly generated in the name of such companies at a CA as part of a direct attack.’ 
More details. 
According to VENAFI:-
Venafi has been exploring whether Duqu is a private key or a certificate authority compromise. The company warns that since the certificate used in Duqu is used for authentication — much like SSL server – and client-sidecertificates — either cause should warrant that organizations look closely at their security and operations management processes and response plans.Certificates are used for authentication, in addition to encryption.
Venafi highlights the following: 
CA compromise
If the Duqu creator compromised a CA to get their certificate, they could have also fraudulently issued other certificates. The security of that CA could be called into question, as well as all the certificates it issued. 
If a CA was compromised, companies with certificates from that CA must replace them and all organizations must ensure they’re not trusting that CA. Going beyond this incident, if Duqu is targeting CAs, that reinforces the importance of preparing for a CA compromise, especially coming on the heels of the DigiNotar CA breach this summer. 
Private key compromiseIf the Duqu creator stole the private key of C-Media Electronics (the Taiwanese company whose certificate is associated with Duqu), that points to another risk that organizations need to address: providing better protection of private keys. to another risk that organizations need to address: providing better protection of private keys.

HOW TO FIX MICROSOFT OUTLOOK CAN’T CREATE FILE ERRORS

Microsoft Outlook users who receive many file attachments of the same name will run into a can’t create file error message eventually. This can happen for instance if voicemail or faxes are routed to email. The core problem is this. Outlook creates a temporary copy of each attachment in a directory, and appends a number behind the file name if the names are otherwise identical. The error message is displayed once that count reaches 100. If that is the case, users will get the following error message in Outlook for the next files with that filename.

Can’t Create file: [filename]. Right-Click the folder you want to create the file in, and then click properties on the shortcut menu to check your permissions for the folder

The only option? To clear the temporary storage space to make room for new attachments. Clearing the cache does not negatively affect the attachments in Outlook, it simply means that Outlook won’t be able to access them from hard drive cache but instead from MIME format directly which might take longer to process.

Outlook Cleanup Tool is a free program for Outlook that can clear the cache automatically or semi-automatically so that the can’t create file error does not pop up anymore in the email client.

Run the program after download to resolve the error. It displays a list of cached files. The information are taken from the Registry. A click on Clean Up clears the temporary cache which in turn resolves the error message.

It needs to be noted that the cache will be filled again by Outlook, and that it may be necessary to run the tool regularly to avoid the can’t create file error message.

The program can be run from the command line. It has a /silent switch which will clean up the cache automatically without user interaction. Handy to use the command in a batch file at log on for instance or log off.

Besides solving the can’t create file errors, it resolves a privacy issue as well, if other users have access to the computer system. Caching attachments as temporary files might give other users access to them in the temp folder, even if the original attachment has been deleted or detached from the email message. Cleaning the temporary data folder removes that possibility.

You can naturally locate and delete the temp folder manually. For that, you need to open the Windows Registry and search for the key OutlookSecureTempFolder.

It should be under HKEY_CURRENT_USER\Software\Microsoft\Office\x.x\Outlook\Security where x.x is the internal version of Outlook.