Kaspersky: Duqu Trojan uses 'unknown programming language' • Hacker News Board

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#31

Post by apaprocki » Fri, Mar 09, 2012, 1:38 AM UTC

To me this just seems like someone wrote their own little OO system in C, similar to how GObject works. The book Object Oriented Programming with ANSI by Axel-Tobias Schreiner[1] even has example types which use the nomenclature 'ctor' and 'dtor' as in the snippet of code they show (See section 2.5, page 17). It isn't hard to write a little class generator that writes out all this boilerplate code[2] from a C++/C# like input file. The benefit is, of course, the resulting code size and avoiding any linkage to the std C++ library.

[1] http://www.planetpdf.com/codecuts/pdfs/ooc.pdf [2] http://www.jirka.org/gob.html

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#32

Post by louthy » Fri, Mar 09, 2012, 1:39 AM UTC

cpeterso wrote: post #20

anigbrowl wrote: post #10

The company has named it the Duqu Framework I am confident that within a week there will be 3 front page posts on HN along the lines of 'Why I use Duqu and you should too'.

Who will be the first to post a duqu project on github? :)

duqu.js is my goto script.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#33

Post by bhrgunatha » Fri, Mar 09, 2012, 1:43 AM UTC

muyuu wrote: post #13

scottdw2 wrote: post #6

The payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86. http://www.grammatech.com/research/products/CodeSurferx86.ht... If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewritt…

As a part-time Schemer this does not surprise me... Schemers have a tendency to craft their own languages. It's only natural.

But surely the compiler (assuming a compiler is used) would convert the new high level language into regular Scheme primitives - I think it's unlikely that the result wouldn't be identifiable.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#34

Post by kiiski » Fri, Mar 09, 2012, 1:46 AM UTC

driverdan wrote: post #12

samstave wrote: post #8

This is one of the most interesting netsec (if not THE most) questions of our time. We have what is effectively an alien virus, given how advanced it was, its construction and spawing of duqu and being written in an unknown language. This is serious awesome cyberpunk stuff - but scary as hell at the same time. With the revelation of Stuxnet and Duqu, NOBODY should think anything they do/say online is safe.

Not necessarily. Occam's Razor. It's more likely that they used something obscure to compile or obfuscate the code or wrote a tool to do so. Creating a new language just to write this seems highly unlikely.

"Creating a new language just to write this seems highly unlikely."

Of course, it might be that they didn't create a new language "just to write this", but because they're planning/already written other things in it.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#35

Post by cjensen » Fri, Mar 09, 2012, 1:48 AM UTC

Yxven wrote: post #23

Why would creating your own programming language for a virus be a good thing? If viruses are the only thing written in this language, wouldn't the language make it easier for the anti-virus companies to detect it without having to worry as much about false positives?

Normally compilers compile each operation into a single destination machine code chunk. If you ignore efficiency, there are many ways to implement the same operation in machine code. A Cracker Compiler could contain multiple destination chunks and randomly choose one at compile time.

Writing a detector for a virus with infinite code representations would be difficult.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#36

Post by scottdw2 » Fri, Mar 09, 2012, 1:50 AM UTC

bhrgunatha wrote: post #33

muyuu wrote: post #13

Earlier quoted context omitted.

As a part-time Schemer this does not surprise me... Schemers have a tendency to craft their own languages. It's only natural.

But surely the compiler (assuming a compiler is used) would convert the new high level language into regular Scheme primitives - I think it's unlikely that the result wouldn't be identifiable.

No... the product allows you to write scripts to manipulate its machine code IR database in scheme, and then spit out the machine code as nasm assembly, assembly them, and then run the appropriate linker in the same way that was used to produce the original exe. Scheme is used as a macro language. So you use scheme to say: change the code at EA 0xdeadbeef from a mov to a jmp. You can reorder functions, insert and remove code, etc. It works because it has very high quality disassembly based on observing compiler and linker invocations and introspecting the artifacts involved.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#37

Post by flabberghast » Fri, Mar 09, 2012, 1:59 AM UTC

Well, given that Unit 8200 is up, and the U.S. Cyber Command is active this looks exactly like what they'd do.

Just wait until they let the A.I. make the language as so it is not human decipherable.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#38

Post by mahmud » Fri, Mar 09, 2012, 2:12 AM UTC

muyuu wrote: post #13

scottdw2 wrote: post #6

The payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86. http://www.grammatech.com/research/products/CodeSurferx86.ht... If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewritt…

As a part-time Schemer this does not surprise me... Schemers have a tendency to craft their own languages. It's only natural.

GrammaTech is an Scheme shop and employs several Lispers :-)

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#39

Post by daeken » Fri, Mar 09, 2012, 2:14 AM UTC

This makes fairly little sense to me. Why wouldn't one write such a virus using straight ASM, or possibly write a VM in ASM and write the payload in the VM's bytecode (this option makes it particularly easy to do metamorphic code, though doing it with well-written ASM is also very possible)? It seems like creating a custom language -- or hacking up compiled C++ or whatnot -- is a bit of overkill considering that the basic tenets of virus writing are: keep it simple, don't get caught; this wouldn't aid in either of those.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#40

Post by mahmud » Fri, Mar 09, 2012, 2:15 AM UTC

louthy wrote: post #32

cpeterso wrote: post #20

Earlier quoted context omitted.

Who will be the first to post a duqu project on github? :)

duqu.js is my goto script.

I don't like unstructured code: disassemblies are goto-filled spaghetti. That's why I use modern Assembly language tools, like comefrom.coffee.