Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky: Duqu Trojan uses 'unknown programming language'

zdnet.com

Post reply on HN
Print view View original

81–90 of 122 posts

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#81

Post by archangel_one »

firefoxman1 wrote: post #75
runn1ng wrote: post #54

Earlier quoted context omitted.

As I think about it, you are probably right. And yet, I can't help myself but watch in fascination as all this happens. Maybe it's because this time, the war is fought with means and tools I understand (if only a little)? Maybe. Maybe it has something to do with the morbid fascination people have with anything destructive - the World War II books and movies are still sold like cakes, while noone actually wants to rep…

I, for one, appreciate your enthusiasm. I mean, it's just amazing to look at how far man has advanced from just 100 years ago. And for me, it's definitely not about the destruction. I just think it's awesome to realize just what humans are capable of. Now, humans are also capable of some ridiculously destructive things. But the problem with @adriand's point of view is that it's as if there's something to be lost from…

It's pretty significant to us, because we're here :) Seriously, from our point of view, including adriand's, there is something to be lost from Mankind's destruction because it would be the end of our entire species. From the perspective of the universe as a whole, it may not be significant, but it seems eminently sensible for humans to be concerned about it.

Also, it is possible that Earth is significant to the universe because it's the only place where intelligent life has arisen. I don't expect that this is actually the case, but so far we have no evidence to the contrary, and if it were true it would be tragic if we wiped ourselves out by playing with virii and nuclear technology.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#82

Post by tlrobinson »

getsat wrote: post #77
est wrote: post #70

Earlier quoted context omitted.

TFA > Duqu and Stuxnet components date to 2007

That's the joke, e.g., "Ruby on Rails expert with 10 years of experience wanted"

Amusing joke, yes, but the parent was pointing out that 5 years experience in Duqu framework might not be impossible. 2012 - 2007 = 5

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#83

Post by tlrobinson »

I've seen the theory that Stuxnet/Duqu was developed by a state thrown around a lot, but what's the actual evidence?

It's not particularly hard to write a simple programming language. Worms are very specialized pieces of code. It doesn't seem that crazy that someone would create a language tailored for worm development.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#84

Post by spullara »

DaveMebs wrote: post #73
spullara wrote: post #72

I like the idea that it is an OO language that forgoes its own runtime library and instead uses the Win32 API as its native library. This would be a great language to write viruses in -- perfect for just glueing together APIs and doing some very small scale business logic without having to learn C++.

Anyone writing a virus already knows C++.

Sorry, anyone who is writing the "business logic" for a virus. Someone else might write the exploit.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#86

Post by narag »

scottdw2 wrote: post #58
lukeschlather wrote: post #56

Earlier quoted context omitted.

What exactly is the benefit of obfuscating the source language? Your hypothesis that it's written in Scheme is reasonable, but a DSL by any other name is a basket of Lisp macros. It's not a new language, but at the same time, it's kind of a Domain-specific language. At any rate, I don't think that if it was Scheme that the goal was to obfuscate that it was written in Scheme.

See my comment below. I don't think you quite understood what I meant. I'm not saying the code was written in scheme. I'm saying there is a product that allows you to write scheme macros to manipulate a database of machine code IR derived from disassembly and then turn the modified database back into an executable. Hiding the source language makes identifying the origin of the malware difficult. There are obvious rea…

Hiding the source language makes identifying the origin of the malware difficult.

How so? Knowing that it was written using VC would hardly help identifying the origin.

That's not to say that you're wrong about the tool used, but I don't believe the goal was to cover their tracks, but some kind of optimization. Viruses often face space constraints.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#87

Post by jgrahamc »

It might well be a macro language and not compiled. For example, HLA (http://en.wikipedia.org/wiki/High_Level_Assembly) has many of the features that are present here. It has its own library functions, objects/classes, and produces code that looks bit like it was compiled.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#88

Post by gaius »

nikcub wrote: post #60

They learnt from watching all the research firms reverse engineer Stuxnet and eventually stop it. What they are doing is obfuscating the output. If you look at a default DLL or EXE build from VS it is amazing how much information is included that helps you attach a debugger and work out how it works. The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm usin…

In the old days on the demoscene there were utilities called packers and crunchers...
Post reply on HN