161–164 of 164 posts
Anyone know someone at the Tor Project? Based on a breakdown I read, it downloads the Tor client from https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9... It would be simple to rename this link (or perform a referer check or something else to stop automated downloads), at least temporarily. Yes, the malware authors will release an update with the different URL (or another hosting site entirely, or embedded…
Earlier quoted context omitted.
The whole point of this "kill switch" is that it’s NOT registered. The malware uses it to detect if it runs in the sandbox, as researchers often make all DNS requests succeed in their sandbox. Checking for an domain known to be unregistered is one way of checking that.
How trivial it would be to append a random number at the end, or otherwise randomise it just a little bit.. Quite lucky the programmer didn't think this one through.
Earlier quoted context omitted.
The initial attack vector is via an email attachment. Once it's infected a host, the SMB scanning for vulnerable hosts is launched and secondary infections begin with no further user action required.
> The initial attack vector is via an email attachment. So far it seems an hypothesis and nobody has shown such an email attachment, which is strange considering all the systems out there which save and archive attachments. Especially hospitals and gov't sites saves it all.
If so, you wouldn't need a very high phish:total infected hosts ratio to explain the numbers. And given that whoever was originally phished didn't know it was an illegitimate email... not betting we'll see many examples of the initial vector.
Earlier quoted context omitted.
The point of the killswitch is to detect if the worm is running inside a sandbox. Some sandboxes will resolve any domain you try to ping, so an easy way to detect this is to ping a non-existent domain name. I'm not totally sure how pinging an existing domain would give you the same behavior, but doing something like checking a handful of random non-existent domains from a large list could do the trick. From the sound…
I wonder why there are multiple kill switches?