Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky: Duqu Trojan uses 'unknown programming language'

zdnet.com

Post reply on HN
Print view View original

11–20 of 122 posts

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#11

Post by viraptor »

Unless I'm mistaken it looks like a very dynamic language. The screenshot they're showing seems to point at initialisation of a new object, which actually copies function pointers for each of its methods. That's not needed for static languages which would just point to vtables. It looks like it doesn't use real GC though - object's destructor is called right away on a failed allocation. And the destructor is possible to change too...

So something like compiled javascript sans GC really. Or maybe like precompiled python.

Doesn't seem very obfuscated either imho - there's a bunch of static data copied in a series of moves. If someone really wanted to obfuscate those, this looks like a fairly low hanging fruit: grab a list of 5+ mov-s of constants and change them into xor+copy of a memory range to confuse pointer detection.

Can you see any more characteristics in that fragment?

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#12

Post by driverdan »

samstave wrote: post #8

This is one of the most interesting netsec (if not THE most) questions of our time. We have what is effectively an alien virus, given how advanced it was, its construction and spawing of duqu and being written in an unknown language. This is serious awesome cyberpunk stuff - but scary as hell at the same time. With the revelation of Stuxnet and Duqu, NOBODY should think anything they do/say online is safe.

Not necessarily. Occam's Razor. It's more likely that they used something obscure to compile or obfuscate the code or wrote a tool to do so. Creating a new language just to write this seems highly unlikely.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#13

Post by muyuu »

scottdw2 wrote: post #6

The payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86. http://www.grammatech.com/research/products/CodeSurferx86.ht... If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewritt…

As a part-time Schemer this does not surprise me... Schemers have a tendency to craft their own languages. It's only natural.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#14

Post by cag_ii »

p0ss wrote: post #3
computerbob wrote: post #2

The actual real blog which zdnet summarized from which is far more interesting: http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...

and from the comments on that blog: > The code your referring to .. the unknown c++ looks like the older IBM compilers found in OS400 SYS38 and the oldest sys36. > The C++ code was used to write the tcp/ip stack for the operating system and all of the communications. The protocols used were the following x.21(async) all modes, Sync SDLC, x.25 Vbiss5 10 15 and 25. CICS. RSR232. This was a very small and powerful commu…

But this comment doesn't ever mention specifically what makes his suggestion "look like" the given examples. I find it highly unlikely, given all the available networking/comm libraries available that old, proprietary IBM code would be used. Maybe there's something to it, but he certainly didn't mention anything convincing.

More unusual (to me) is that there are two separate comments suggesting it may be RPG (an OS400/iSeries language), which is very unlikely due to it not being an OOP language therefore not having constructor/destructor functionality, and otherwise a very high level language.

I'd guess some high level assembly, though this suggestion does look interesting.

http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#17

Post by darxius »

What driverdan said makes sense. It is much more likely that they obfuscated or masked their code instead of inventing an "unknown" programming language. Even so, the obfuscation method used I'm sure would be pretty cunning (seeing as these folk mean business).

It's interesting to see Kaspersky suggest that the state is behind this solely based on some unknown code. Does anyone know why that would be a likely conclusion on their part?

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#18

Post by jd »

Writing an unpolished programming language isn't that much work in comparison to writing a complex virus. Especially low level languages where instructions map pretty closely to the CPU instructions are easy to create.

I think it makes a lot of sense to write a custom programming language/compiler because virus scanners tend to use fingerprints to recognize dangerous pieces of code. So you want a compiler that deliberately obfuscates the code it writes and also outputs instructions in such a way that it avoids triggering known virus scanner fingerprints.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#19

Post by andrewcooke »

is it dumb to suggest that someone who understands c++ (or other compiled oo language) would/could write assembler in this way? just from reading the description (things like variable locations of method tables, various registers for "this", and lack of memory management) it sounds like it could be handwritten, but structured in a similar way to c++.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#20

Post by cpeterso »

anigbrowl wrote: post #10

The company has named it the Duqu Framework I am confident that within a week there will be 3 front page posts on HN along the lines of 'Why I use Duqu and you should too'.

Who will be the first to post a duqu project on github? :)
Post reply on HN