Haskell or Lisp, perhaps?
It could also be Erlang, but no mentions so far.
Kaspersky: Duqu Trojan uses 'unknown programming language'
21–30 of 122 posts
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#22They doing it wrong.
Instead of trying to compile code examples in every candidate PL, they should:
1. Crawl x86 binaries from the Internet / download sites / code archives.
2. Write M/R job, which will disassemble and look for patterns they discovered.
3. Once patterns found - investigate the source of binary (i.e. who uploaded it to download site, maybe it was on university FTP server or maybe it's part of commercial driver released by company XYZ).
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#23Why would creating your own programming language for a virus be a good thing? If viruses are the only thing written in this language, wouldn't the language make it easier for the anti-virus companies to detect it without having to worry as much about false positives?
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#24Maybe this language should be called "Dufuq?" for reasons that become clear when the name is read aloud.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#25Why would creating your own programming language for a virus be a good thing? If viruses are the only thing written in this language, wouldn't the language make it easier for the anti-virus companies to detect it without having to worry as much about false positives?
I don't know, maybe they thought that the virus would be harder to remove, or perhaps the person created it to just to see if he could!
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#26Please forgive, and correct, me if I have this wildly wrong:
This is referred to as Stuxnet 2. And the original was "proven" to have been made to attack Iranian nuclear labs, and what not. Conclusion being that it was made by some government agency. I suppose foil hat theory would point fingers at CIA/NSA type people.
Assuming the above is correct, or correct enough, its it not surprising to see what might be a new language for this virus, if it has a nation state's resources behind it? If that is the case, what chance is there that any one will be able to crack this mystery?
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#27Maybe they just embedded something like RTOS-32. The company that makes it (www.On-Time.com) say it can be integrated with Visual Studio and used along side Visual C++.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#28The payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86. http://www.grammatech.com/research/products/CodeSurferx86.ht... If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewritt…
Also interesting that the CodeSurfer product referenced above is "sponsored by several government agencies, including the US Air Force, the US Navy, the Office of the Secretary of Defense, and the Department of Homeland Security", according to its own website.
Looks like a cool product.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#29What driverdan said makes sense. It is much more likely that they obfuscated or masked their code instead of inventing an "unknown" programming language. Even so, the obfuscation method used I'm sure would be pretty cunning (seeing as these folk mean business). It's interesting to see Kaspersky suggest that the state is behind this solely based on some unknown code. Does anyone know why that would be a likely conclus…
From what I gathered from the article, this doesn't appear to be obfuscated since the purpose/method is transparent in the decompiled code, it simply doesn't match the constructs you would expect to see in common programming languages when decompiled.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#30Why would creating your own programming language for a virus be a good thing? If viruses are the only thing written in this language, wouldn't the language make it easier for the anti-virus companies to detect it without having to worry as much about false positives?
It may not have been done for that reason alone. NIHS is pretty common among hackers:
http://en.wikipedia.org/wiki/Not_invented_here#In_computing
It also seems to me that a new language for this exact purpose is unlikely, however, it could very well be a proprietary or otherwise unknown language that may have been built for another purpose (internal company, domain-specific development, etc) and not often seen in this context.