Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Flame: Massive cyber-attack discovered, researchers say

bbc.com

Post reply on HN
Print view View original

61–70 of 84 posts

Re: Flame: Massive cyber-attack discovered, researchers say

#61

Post by est »

dbh937 wrote: post #60
gaius wrote: post #21

Earlier quoted context omitted.

Aren't these the guys who wigged out because they thought Duqu was written in an entirely new custom virus language? And it was actually Visual C++? The second most common compiler on the planet? (after GCC) I would take their analysis with a big pinch of salt.

From the official blog post: >There are however some links which could indicate that the creators of Flame had access to technology used in the Stuxnet project - such as use of the “autorun.inf” infection method If I'm not mistaken, you can find youtube videos on how to exploit autorun.inf to make a prank virus. I'm with you on these guys missing easy stuff.

> technology used in the Stuxnet project - such as use of the “autorun.inf” infection method

Can't tell if you are trolling or ...

Re: Flame: Massive cyber-attack discovered, researchers say

#62

Post by spritrig »

pjin wrote: post #19
mkr-hn wrote: post #9

Earlier quoted context omitted.

The LUA makes me wonder if the creator could be identified by their coding style.

From the Kaspersky article, Flame ships with a Lua VM, sqlite3, zlib, libbz2, and an SSL library (probably OpenSSL?), and these and more apparently result in its unusually large size (almost 20 MB). Sounds almost like "lean malware" written by a relatively small team using easily available tools and libraries.

FLAME isn't a virus, it is software from Brazil, just like LUA is from Brazil.

"Tool prototyping in the FLAME platform is based on the Lua scripting language. Lua is adopted in FLAME as an extension language: its interpreter is embedded as a library into the measurement agents. On the one hand, the Lua interpreter gives to the scripts running in the agents access to active measurement primitives through a high-level, minimalist API. On the other hand, the measurement agents and the measurement API are implemented in C, preventing significant overheads in the measurement results due to the execution of Lua scripts." http://martin.lncc.br/main-software-flame

Re: Flame: Massive cyber-attack discovered, researchers say

#63

Post by acdha »

swatkat wrote: post #43
rbanffy wrote: post #36

Earlier quoted context omitted.

It depends: will you render it using Adobe's software?

IIRC, both Adobe Reader "Protected Mode"[1] and Chromium "sandbox"[2] are built on Windows user-mode sandbox framework[3]. Basically, things like principle of least privilege and disable writes etc. [1] http://blogs.adobe.com/asset/2010/10/inside-adobe-reader-pro... [2] http://dev.chromium.org/developers/design-documents/sandbox [3] http://blogs.msdn.com/b/david_leblanc/archive/2007/07/27/pra...

Security is all about execution: Chrome has an enviable track record; Adobe has an embarrassing one. They could change that but it's unclear that they're motivated to build up serious security competency (if they were, the manager in charge of their update process would be fired for cause)

Re: Flame: Massive cyber-attack discovered, researchers say

#65

Post by cstejerean »

moe wrote: post #55
gue5t wrote: post #46

Earlier quoted context omitted.

Assuming fairly dense formats (no .wavs or .bmp images), large files necessarily mean more than small files, so they draw more attention to themselves. "Why is /foo/bar using 300MB of disk?" is a much more likely avenue of inquiry than "Why is /foo/bar using 50KB of disk?".

Except the last time when 20MB was "large" was in the early 1990s. Today, even if someone goes to clean out their harddrive, a 20MB file is unlikely to even appear on the radar.

Unless you're dealing with most corporate mail systems.

Re: Flame: Massive cyber-attack discovered, researchers say

#66

Post by runjake »

haberman wrote: post #49

The reason why Flame is [20MB] is because it includes many different libraries, such as for compression (zlib, libbz2, ppmd) and database manipulation (sqlite3), together with a LUA virtual machine. SQLite is 500kB, Lua is 150kb, zlib is 80kB, libbz2 is 60kB. Together this comes to less than 1MB, not 20MB. You would need an awful lot of libraries like this to get anywhere close to 20MB.

I don't get the point of your comment. Are you saying you doubt it's 20MB? Or that it doesn't include a lot of libraries?

What point are you trying to make exactly?

Re: Flame: Massive cyber-attack discovered, researchers say

#67

Post by jsz0 »

LiquidSummer wrote: post #17
thursley wrote: post #12

More technical details (pdf) on: http://www.crysys.hu/skywiper/skywiper.pdf Although the naming differs it has been noted on several blogs that it is the same malware.

I always hesitate a little bit when I open a pdf, specially when it is one on malware

For what it's worth if you're using OSX Lion Preview is sandboxed.

Re: Flame: Massive cyber-attack discovered, researchers say

#68

Post by duaneb »

raverbashing wrote: post #47
pjin wrote: post #19

Earlier quoted context omitted.

From the Kaspersky article, Flame ships with a Lua VM, sqlite3, zlib, libbz2, and an SSL library (probably OpenSSL?), and these and more apparently result in its unusually large size (almost 20 MB). Sounds almost like "lean malware" written by a relatively small team using easily available tools and libraries.

Yeah, I mean, sqlite3? In a 'virus'? What's next? Shipping the JVM and MariaDB

The original virus may have only been a few hundred KB, which then bootstrapped the rest of the program. Just because you're writing malware doesn't mean you have to sacrifice good tools.

Re: Flame: Massive cyber-attack discovered, researchers say

#69

Post by fusiongyro »

runjake wrote: post #66
haberman wrote: post #49

The reason why Flame is [20MB] is because it includes many different libraries, such as for compression (zlib, libbz2, ppmd) and database manipulation (sqlite3), together with a LUA virtual machine. SQLite is 500kB, Lua is 150kb, zlib is 80kB, libbz2 is 60kB. Together this comes to less than 1MB, not 20MB. You would need an awful lot of libraries like this to get anywhere close to 20MB.

I don't get the point of your comment. Are you saying you doubt it's 20MB? Or that it doesn't include a lot of libraries? What point are you trying to make exactly?

He's pointing out that the explanation for the size given in the article isn't adequate because the facts don't bear it out.

Re: Flame: Massive cyber-attack discovered, researchers say

#70

Post by duaneb »

cstejerean wrote: post #65
moe wrote: post #55

Earlier quoted context omitted.

Except the last time when 20MB was "large" was in the early 1990s. Today, even if someone goes to clean out their harddrive, a 20MB file is unlikely to even appear on the radar.

Unless you're dealing with most corporate mail systems.

I don't quite understand what you mean - the 20MB file would stand out on a mail server? I find that unlikely, unless they're running OpenBSD. Is the 20MB file attached to mail messages? That also seems unlikely, if only because that's a really stupid way to design a virus.
Post reply on HN