Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky: Duqu Trojan uses 'unknown programming language'

zdnet.com

Post reply on HN
Print view View original

1–10 of 122 posts

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#3

Post by p0ss »

computerbob wrote: post #2

The actual real blog which zdnet summarized from which is far more interesting: http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...

and from the comments on that blog:

> The code your referring to .. the unknown c++ looks like the older IBM compilers found in OS400 SYS38 and the oldest sys36.

> The C++ code was used to write the tcp/ip stack for the operating system and all of the communications. The protocols used were the following x.21(async) all modes, Sync SDLC, x.25 Vbiss5 10 15 and 25. CICS. RSR232. This was a very small and powerful communications framework. The IBM system 36 had only 300MB hard drive and one megabyte of memory,the operating system came on diskettes.

> This would be very useful in this virus. It can track and monitor all types of communications. It can connect to everything and anything.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#5

Post by moondowner »

p0ss wrote: post #3
computerbob wrote: post #2

The actual real blog which zdnet summarized from which is far more interesting: http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...

and from the comments on that blog: > The code your referring to .. the unknown c++ looks like the older IBM compilers found in OS400 SYS38 and the oldest sys36. > The C++ code was used to write the tcp/ip stack for the operating system and all of the communications. The protocols used were the following x.21(async) all modes, Sync SDLC, x.25 Vbiss5 10 15 and 25. CICS. RSR232. This was a very small and powerful commu…

> This would be very useful in this virus. It can track and monitor all types of communications. It can connect to everything and anything.

When I read these kind of sentences I always think of Plan9 first

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#6

Post by scottdw2 »

The payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86.

http://www.grammatech.com/research/products/CodeSurferx86.ht...

If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewritten parts out as nasm, and even relink with the object files you don't have source for.

It works with any build system, and supports gcc / as / ld and cl / link.

So it may not have actually been written using a custom pl.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#8

Post by samstave »

This is one of the most interesting netsec (if not THE most) questions of our time.

We have what is effectively an alien virus, given how advanced it was, its construction and spawing of duqu and being written in an unknown language.

This is serious awesome cyberpunk stuff - but scary as hell at the same time.

With the revelation of Stuxnet and Duqu, NOBODY should think anything they do/say online is safe.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#9

Post by [deleted] »

p0ss wrote: post #3
computerbob wrote: post #2

The actual real blog which zdnet summarized from which is far more interesting: http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...

and from the comments on that blog: > The code your referring to .. the unknown c++ looks like the older IBM compilers found in OS400 SYS38 and the oldest sys36. > The C++ code was used to write the tcp/ip stack for the operating system and all of the communications. The protocols used were the following x.21(async) all modes, Sync SDLC, x.25 Vbiss5 10 15 and 25. CICS. RSR232. This was a very small and powerful commu…

[deleted]
Post reply on HN