Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky: Duqu Trojan uses 'unknown programming language'

zdnet.com

Post reply on HN
Print view View original

71–80 of 122 posts

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#71

Post by zcid »

adriand wrote: post #51
runn1ng wrote: post #50

I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that. We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got inv…

You seem to be pretty enthusiastic about rather worrying and even disturbing developments. This is not a science fiction novel, this is real life. One day it is Israeli hackers destroying Iranian centrifuges, perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.

It's quite likely that humans need conflict in their lives to feel complete. The area of evolutionary psychology points strongly in that direction as does a subjective observation of our history.

I find online wars to be much more favorable than actual bloodshed. Even an occasional meltdown would be much less disastrous than real life conflict.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#72

Post by spullara »

I like the idea that it is an OO language that forgoes its own runtime library and instead uses the Win32 API as its native library. This would be a great language to write viruses in -- perfect for just glueing together APIs and doing some very small scale business logic without having to learn C++.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#73

Post by DaveMebs »

spullara wrote: post #72

I like the idea that it is an OO language that forgoes its own runtime library and instead uses the Win32 API as its native library. This would be a great language to write viruses in -- perfect for just glueing together APIs and doing some very small scale business logic without having to learn C++.

Anyone writing a virus already knows C++.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#74

Post by ori_b »

joezydeco wrote: post #43
driverdan wrote: post #12

Earlier quoted context omitted.

Not necessarily. Occam's Razor. It's more likely that they used something obscure to compile or obfuscate the code or wrote a tool to do so. Creating a new language just to write this seems highly unlikely.

Is writing something like this in pure assembly beyond the realm of possibility for some reason? There are still a few dedicated people that code on the metal for high level operating systems (Steve Gibson comes to mind immediately)

Writing something like this in assembly isn't impossible (or that difficult), but the patterns look like something that you wouldn't be using if you were writing in assembly.

My bet is that it's just C with a hand-rolled OO framework.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#75

Post by firefoxman1 »

runn1ng wrote: post #54
adriand wrote: post #51

Earlier quoted context omitted.

You seem to be pretty enthusiastic about rather worrying and even disturbing developments. This is not a science fiction novel, this is real life. One day it is Israeli hackers destroying Iranian centrifuges, perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.

As I think about it, you are probably right. And yet, I can't help myself but watch in fascination as all this happens. Maybe it's because this time, the war is fought with means and tools I understand (if only a little)? Maybe. Maybe it has something to do with the morbid fascination people have with anything destructive - the World War II books and movies are still sold like cakes, while noone actually wants to rep…

I, for one, appreciate your enthusiasm. I mean, it's just amazing to look at how far man has advanced from just 100 years ago.

And for me, it's definitely not about the destruction. I just think it's awesome to realize just what humans are capable of. Now, humans are also capable of some ridiculously destructive things. But the problem with @adriand's point of view is that it's as if there's something to be lost from all of Man's destruction. When really, what significance does Earth have in the Universe anyway?

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#76

Post by Confusion »

mahmud wrote: post #40
louthy wrote: post #32

Earlier quoted context omitted.

duqu.js is my goto script.

I don't like unstructured code: disassemblies are goto-filled spaghetti. That's why I use modern Assembly language tools, like comefrom.coffee .

All code comesfrom.coffee

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#77

Post by getsat »

est wrote: post #70
rmason wrote: post #47

Earlier quoted context omitted.

Within a month there will be a Dice job listing asking for five years of Duqu experience.

TFA > Duqu and Stuxnet components date to 2007

That's the joke, e.g., "Ruby on Rails expert with 10 years of experience wanted"

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#78

Post by maaku »

sheraz wrote: post #53
adriand wrote: post #51

Earlier quoted context omitted.

You seem to be pretty enthusiastic about rather worrying and even disturbing developments. This is not a science fiction novel, this is real life. One day it is Israeli hackers destroying Iranian centrifuges, perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.

...I guess some guys just want to watch the world burn.

...more likely an embattled people facing an existential threat resort to any means possible to slow down and thwart the efforts of an enemy developing a doomsday weapon.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#79

Post by beza1e1 »

Looking the assembly I see two things: (1) no name mangling. So either this was lost in the decompilation/deciphering phase by the Kaspersky guys or mysterious language does not support method overloading. (2) the assembly looks reasonably tight and optimized, so a solid code generation backend (GCC,LLVM,MSVC,...) was used.

Especially because of the name mangling i was thinking of Vala [0]. However, Vala relies on GObject and does probably not work on Windows. Anyways, I guess it's an OO language compiled to C in an intermediate step. This would explain (2).

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#80

Post by maaku »

daeken wrote: post #39

This makes fairly little sense to me. Why wouldn't one write such a virus using straight ASM, or possibly write a VM in ASM and write the payload in the VM's bytecode (this option makes it particularly easy to do metamorphic code, though doing it with well-written ASM is also very possible)? It seems like creating a custom language -- or hacking up compiled C++ or whatnot -- is a bit of overkill considering that the…

Perhaps because this is no simple virus? Perhaps because Stuxnet/Duqu is one of if not the most sophisticated examples of cyber warfare* we have public examples of? Perhaps because its compiled binary is a whopping half-megabyte in size?

The amount of effort that went into Stuxnet is truly massive. It'd be no surprise if a custom framework or even a domain-specific language were written to support it.

* Usually I cringe at just hearing the phrase cyber warfare and at the ridiculous way in which it is used by media and the government. But looking at what Stuxnet accomplished (physically damaging or disabling critical components of the Iranian nuclear enrichment program), the term applies completely.

Post reply on HN