Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky: Duqu Trojan uses 'unknown programming language'

zdnet.com

Post reply on HN
Print view View original

111–120 of 122 posts

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#111

Post by JVIDEL »

archangel_one wrote: post #81
firefoxman1 wrote: post #75

Earlier quoted context omitted.

I, for one, appreciate your enthusiasm. I mean, it's just amazing to look at how far man has advanced from just 100 years ago. And for me, it's definitely not about the destruction. I just think it's awesome to realize just what humans are capable of. Now, humans are also capable of some ridiculously destructive things. But the problem with @adriand's point of view is that it's as if there's something to be lost from…

It's pretty significant to us, because we're here :) Seriously, from our point of view, including adriand's, there is something to be lost from Mankind's destruction because it would be the end of our entire species. From the perspective of the universe as a whole, it may not be significant, but it seems eminently sensible for humans to be concerned about it. Also, it is possible that Earth is significant to the univ…

500 years ago all human settlements on Earth had always been agrarian economies with different levels of development but primitive nonetheless, until the industrial revolution started.

What if it had never happened? Now we now there were previous attempts at industry, like steam engines and chemistry, but there was always a war, a drought or some other disaster that destroyed the framework where said developments were made, and sometimes even killed the people making them (Archimedes for example).

What if the universe is just like that? what if we're the most advanced species and all the aliens out there are either animals or still haven't even figured out how to build clocks or engines?

If that's the case then all the knowledge that ever existed would die with us.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#112

Post by lukeschlather »

DEinspanjer wrote: post #108
narag wrote: post #86

Earlier quoted context omitted.

Hiding the source language makes identifying the origin of the malware difficult. How so? Knowing that it was written using VC would hardly help identifying the origin. That's not to say that you're wrong about the tool used, but I don't believe the goal was to cover their tracks, but some kind of optimization. Viruses often face space constraints.

I am not knowledgeable enough to say much on this topic, but I was wondering if maybe such rewriting would also serve to make it easy to mutate code to change its signature?

That was sort of what I was getting at. The obfuscation of the source language may be correlated, but it's not the goal.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#115

Post by akx »

gaius wrote: post #88
nikcub wrote: post #60

They learnt from watching all the research firms reverse engineer Stuxnet and eventually stop it. What they are doing is obfuscating the output. If you look at a default DLL or EXE build from VS it is amazing how much information is included that helps you attach a debugger and work out how it works. The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm usin…

In the old days on the demoscene there were utilities called packers and crunchers...

Still are:

http://www.farbrausch.de/~fg/kkrunchy/

http://www.crinkler.net/

etc.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#116

Post by jberryman »

nikcub wrote: post #69
jberryman wrote: post #66

Earlier quoted context omitted.

> The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm using black-box reverse engineering tools to figure out what the research guys will work out when they eventually find it in the wild. Don't they mention that these components were floating around in 2007?

Where does it say that? All the references are to 'Duqu Framework', which they recently found, I may have missed something They also completely rule out C++, C etc. when what they should be ruling out is C++, C compiled with a standard VS compiler (or an easily recognizable compiler). It is silly to completely rule out C++ and C just because they don't immediately recognize the output and because it doesn't reference…

bottom of TFA:

"Duqu was first detected in September 2011, but Kaspersky Lab believes it has seen the first pieces of Duqu-related malware dating back to August 2007"

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#117

Post by gphil »

LeafStorm wrote: post #59
shmageggy wrote: post #42

Earlier quoted context omitted.

The characteristics listed in the actual article (posted by computerbob: http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq... ) also support this conclusion. -Everything is wrapped into objects -Function table is placed directly into the class instance and can be modified after construction -There is no distinction between utility classes (linked lists, hashes) and user-written code -Objects communicate us…

Reminds me of Smalltalk.

And by extension, of Ruby.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#118

Post by buff-a »

shmageggy wrote: post #42
viraptor wrote: post #11

Unless I'm mistaken it looks like a very dynamic language. The screenshot they're showing seems to point at initialisation of a new object, which actually copies function pointers for each of its methods. That's not needed for static languages which would just point to vtables. It looks like it doesn't use real GC though - object's destructor is called right away on a failed allocation. And the destructor is possible…

The characteristics listed in the actual article (posted by computerbob: http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq... ) also support this conclusion. -Everything is wrapped into objects -Function table is placed directly into the class instance and can be modified after construction -There is no distinction between utility classes (linked lists, hashes) and user-written code -Objects communicate us…

Sounds like someone said, "Make me a language that is hard to reverse engineer using IDA Pro".

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#119

Post by Tossrock »

stef25 wrote: post #93
runn1ng wrote: post #50

I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that. We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got inv…

It's very cool from a geek / technological point of view but I can't help but think that non-lifesaving technology ultimately brings us little good, if you look at the big picture.

"Lifesaving" is a pretty nebulous concept. Does a plow which enables higher crop yields and thus less starvation constitute as life saving? Or a weather satellite, which allows prediction of rain patterns and more efficient irrigation usage? Modern technology is all interconnected, and only a few extreme leaf nodes could be unambiguously declared non-life saving.

Re: Kaspersky: Duqu Trojan uses 'unknown programming language'

#120

Post by rwallace »

adriand wrote: post #51
runn1ng wrote: post #50

I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that. We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got inv…

You seem to be pretty enthusiastic about rather worrying and even disturbing developments. This is not a science fiction novel, this is real life. One day it is Israeli hackers destroying Iranian centrifuges, perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.

Compared to the ways people used to settle their differences in the days when war wasn't online, I also am enthusiastic about these developments.
Post reply on HN