In my best Commander Tigh voice: "Looks like exactly the kind of code a Cylon would write, to me."
Kaspersky: Duqu Trojan uses 'unknown programming language'
61–70 of 122 posts
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#62related: an anti-reverse engineering tool at microsoft called "warbird" (http://forum.doom9.org/archive/index.php/t-130166.html, search for warbird)
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#63The payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86. http://www.grammatech.com/research/products/CodeSurferx86.ht... If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewritt…
As a part-time Schemer this does not surprise me... Schemers have a tendency to craft their own languages. It's only natural.
Relevant, semi-related story about methods an adware-author used to write and conceal his adware in Scheme:
http://philosecurity.org/2009/01/12/interview-with-an-adware...
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#64Well, given that Unit 8200 is up, and the U.S. Cyber Command is active this looks exactly like what they'd do. Just wait until they let the A.I. make the language as so it is not human decipherable.
Relevant link:
http://www.kurzweilai.net/ai-designs-its-own-video-game
Pretty much, let the machine make the code.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#65To me this just seems like someone wrote their own little OO system in C, similar to how GObject works. The book Object Oriented Programming with ANSI by Axel-Tobias Schreiner[1] even has example types which use the nomenclature 'ctor' and 'dtor' as in the snippet of code they show (See section 2.5, page 17). It isn't hard to write a little class generator that writes out all this boilerplate code[2] from a C++/C# li…
The inconsistent placement of the "this" argument in function calls seems to support this being C. The vtable moving around would indicate that each class layout is hand-written, though.
Yeah, the author made a point of noting "this" could be in a register or the stack, but that to me just says "C". The functions moving around wouldn't necessarily mean it is written by hand, though. There just needs to be some rules governing the system and we don't know what those rules are (yet).
I would just be very surprised if this is anything other than some convention developed on top of C.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#66They learnt from watching all the research firms reverse engineer Stuxnet and eventually stop it. What they are doing is obfuscating the output. If you look at a default DLL or EXE build from VS it is amazing how much information is included that helps you attach a debugger and work out how it works. The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm usin…
> The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm using black-box reverse engineering tools to figure out what the research guys will work out when they eventually find it in the wild.
Don't they mention that these components were floating around in 2007?
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#67Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#68I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that. We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got inv…
You seem to be pretty enthusiastic about rather worrying and even disturbing developments. This is not a science fiction novel, this is real life. One day it is Israeli hackers destroying Iranian centrifuges, perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.
Something doesn't have to be not-a-train-wreck to be utterly fascinating. Quite the opposite, sometimes.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#69They learnt from watching all the research firms reverse engineer Stuxnet and eventually stop it. What they are doing is obfuscating the output. If you look at a default DLL or EXE build from VS it is amazing how much information is included that helps you attach a debugger and work out how it works. The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm usin…
> The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm using black-box reverse engineering tools to figure out what the research guys will work out when they eventually find it in the wild. Don't they mention that these components were floating around in 2007?
Where does it say that? All the references are to 'Duqu Framework', which they recently found, I may have missed something
They also completely rule out C++, C etc. when what they should be ruling out is C++, C compiled with a standard VS compiler (or an easily recognizable compiler). It is silly to completely rule out C++ and C just because they don't immediately recognize the output and because it doesn't reference anything else
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#70The company has named it the Duqu Framework I am confident that within a week there will be 3 front page posts on HN along the lines of 'Why I use Duqu and you should too'.
Within a month there will be a Dice job listing asking for five years of Duqu experience.
TFA
> Duqu and Stuxnet components date to 2007