Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky: Duqu Trojan uses 'unknown programming language'

zdnet.com

Post reply on HN
Print view View original

51–60 of 122 posts

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#51

Post by adriand »

runn1ng wrote: post #50

I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that. We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got inv…

You seem to be pretty enthusiastic about rather worrying and even disturbing developments. This is not a science fiction novel, this is real life. One day it is Israeli hackers destroying Iranian centrifuges, perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#52

Post by RodgerTheGreat »

jd wrote: post #18

Writing an unpolished programming language isn't that much work in comparison to writing a complex virus. Especially low level languages where instructions map pretty closely to the CPU instructions are easy to create. I think it makes a lot of sense to write a custom programming language/compiler because virus scanners tend to use fingerprints to recognize dangerous pieces of code. So you want a compiler that delibe…

Agreed. Writing compilers is easy; The "hard" aspects of creating a new language usually boil down to issues like tooling, documentation and support libraries. In the case of a virus, the only users of the language are the virus authors and the language can be highly tailored to the domain.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#53

Post by sheraz »

adriand wrote: post #51
runn1ng wrote: post #50

I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that. We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got inv…

You seem to be pretty enthusiastic about rather worrying and even disturbing developments. This is not a science fiction novel, this is real life. One day it is Israeli hackers destroying Iranian centrifuges, perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.

...I guess some guys just want to watch the world burn.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#54

Post by runn1ng »

adriand wrote: post #51
runn1ng wrote: post #50

I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that. We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got inv…

You seem to be pretty enthusiastic about rather worrying and even disturbing developments. This is not a science fiction novel, this is real life. One day it is Israeli hackers destroying Iranian centrifuges, perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.

As I think about it, you are probably right.

And yet, I can't help myself but watch in fascination as all this happens. Maybe it's because this time, the war is fought with means and tools I understand (if only a little)? Maybe.

Maybe it has something to do with the morbid fascination people have with anything destructive - the World War II books and movies are still sold like cakes, while noone actually wants to repeat the world war.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#55

Post by etherael »

adriand wrote: post #51
runn1ng wrote: post #50

I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that. We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got inv…

You seem to be pretty enthusiastic about rather worrying and even disturbing developments. This is not a science fiction novel, this is real life. One day it is Israeli hackers destroying Iranian centrifuges, perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.

Maybe so, likely though this is what the erosion of existing power structures looks like first hand. I think we should just be thankful it is relatively peaceful compared to the natural order of such events historically speaking.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#56

Post by lukeschlather »

scottdw2 wrote: post #6

The payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86. http://www.grammatech.com/research/products/CodeSurferx86.ht... If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewritt…

What exactly is the benefit of obfuscating the source language? Your hypothesis that it's written in Scheme is reasonable, but a DSL by any other name is a basket of Lisp macros. It's not a new language, but at the same time, it's kind of a Domain-specific language.

At any rate, I don't think that if it was Scheme that the goal was to obfuscate that it was written in Scheme.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#57

Post by mlnowak »

rmason wrote: post #47
anigbrowl wrote: post #10

The company has named it the Duqu Framework I am confident that within a week there will be 3 front page posts on HN along the lines of 'Why I use Duqu and you should too'.

Within a month there will be a Dice job listing asking for five years of Duqu experience.

Seriously! the funniest thing I read today:)

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#58

Post by scottdw2 »

lukeschlather wrote: post #56
scottdw2 wrote: post #6

The payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86. http://www.grammatech.com/research/products/CodeSurferx86.ht... If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewritt…

What exactly is the benefit of obfuscating the source language? Your hypothesis that it's written in Scheme is reasonable, but a DSL by any other name is a basket of Lisp macros. It's not a new language, but at the same time, it's kind of a Domain-specific language. At any rate, I don't think that if it was Scheme that the goal was to obfuscate that it was written in Scheme.

See my comment below. I don't think you quite understood what I meant. I'm not saying the code was written in scheme. I'm saying there is a product that allows you to write scheme macros to manipulate a database of machine code IR derived from disassembly and then turn the modified database back into an executable.

Hiding the source language makes identifying the origin of the malware difficult. There are obvious reasons to do that.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#59

Post by LeafStorm »

shmageggy wrote: post #42
viraptor wrote: post #11

Unless I'm mistaken it looks like a very dynamic language. The screenshot they're showing seems to point at initialisation of a new object, which actually copies function pointers for each of its methods. That's not needed for static languages which would just point to vtables. It looks like it doesn't use real GC though - object's destructor is called right away on a failed allocation. And the destructor is possible…

The characteristics listed in the actual article (posted by computerbob: http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq... ) also support this conclusion. -Everything is wrapped into objects -Function table is placed directly into the class instance and can be modified after construction -There is no distinction between utility classes (linked lists, hashes) and user-written code -Objects communicate us…

Reminds me of Smalltalk.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#60

Post by nikcub »

They learnt from watching all the research firms reverse engineer Stuxnet and eventually stop it. What they are doing is obfuscating the output. If you look at a default DLL or EXE build from VS it is amazing how much information is included that helps you attach a debugger and work out how it works.

The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm using black-box reverse engineering tools to figure out what the research guys will work out when they eventually find it in the wild.

This has worked so well that Kaspersky think that the authors actually invented a new language, when it is likely still just C++, some machine generated code, some obfuscator tools (game makers have been using them for years to stop crackers) and likely manually changing the outputted assembler.

Post reply on HN