101–110 of 122 posts
Earlier quoted context omitted.
As a part-time Schemer this does not surprise me... Schemers have a tendency to craft their own languages. It's only natural.
I've having this vision of a Jedi being required to construct their own light sabre.
Earlier quoted context omitted.
I've having this vision of a Jedi being required to construct their own light sabre.
... more of a Lambda Knight writing his own lisp ;) http://en.wikipedia.org/wiki/Knights_of_the_Lambda_Calculus
The payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86. http://www.grammatech.com/research/products/CodeSurferx86.ht... If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewritt…
Also interesting that the CodeSurfer product referenced above is "sponsored by several government agencies, including the US Air Force, the US Navy, the Office of the Secretary of Defense, and the Department of Homeland Security", according to its own website. Looks like a cool product.
This makes fairly little sense to me. Why wouldn't one write such a virus using straight ASM, or possibly write a VM in ASM and write the payload in the VM's bytecode (this option makes it particularly easy to do metamorphic code, though doing it with well-written ASM is also very possible)? It seems like creating a custom language -- or hacking up compiled C++ or whatnot -- is a bit of overkill considering that the…
If I were to guess, from the description they gave, it sounds like someone compiled erlang. The two have already been combined: http://www.erlang-factory.com/conference/SFBay2011/speakers/...
I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that. We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got inv…
http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...
The company has named it the Duqu Framework I am confident that within a week there will be 3 front page posts on HN along the lines of 'Why I use Duqu and you should too'.
Earlier quoted context omitted.
See my comment below. I don't think you quite understood what I meant. I'm not saying the code was written in scheme. I'm saying there is a product that allows you to write scheme macros to manipulate a database of machine code IR derived from disassembly and then turn the modified database back into an executable. Hiding the source language makes identifying the origin of the malware difficult. There are obvious rea…
Hiding the source language makes identifying the origin of the malware difficult. How so? Knowing that it was written using VC would hardly help identifying the origin. That's not to say that you're wrong about the tool used, but I don't believe the goal was to cover their tracks, but some kind of optimization. Viruses often face space constraints.
Earlier quoted context omitted.
Yeah, the author made a point of noting "this" could be in a register or the stack, but that to me just says "C". The functions moving around wouldn't necessarily mean it is written by hand, though. There just needs to be some rules governing the system and we don't know what those rules are (yet). I would just be very surprised if this is anything other than some convention developed on top of C.
I don't immediately see why it would be putting arbitrary data in front of the vtable unless it's done by a person. Do you have any ideas?
I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that. We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got inv…
You seem to be pretty enthusiastic about rather worrying and even disturbing developments. This is not a science fiction novel, this is real life. One day it is Israeli hackers destroying Iranian centrifuges, perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.
Considering some scientists were fearful that Stuxnet would cause a mini Chernobyl-like disaster, we can safety say that's not an unlikely scenario.
http://articles.nydailynews.com/2011-01-17/news/27087828_1_r...