Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Mystery of the Encrypted Gauss Payload

securelist.com

Post reply on HN
Print view View original

41–50 of 52 posts

Re: The Mystery of the Encrypted Gauss Payload

#41

Post by Scaevolus »

lt wrote: post #34
eli wrote: post #30

Earlier quoted context omitted.

Great point... are those uniquely named based on the application installed? That might be a nice, oblique way of checking if a particular program is installed.

Yes, these are GUIDs in the following format: {931373E2-3DA4-4631-930C-F59510630DA3} It seems to me that's a good theory of what it might be looking for, as GUIDs should make good triggers. I wonder if this reduces the search space enough to make brute force feasible now.

128 bit GUIDs give pairs of 256 bits -- too large to mount an efficient brute force.

Re: The Mystery of the Encrypted Gauss Payload

#42

Post by lifeisstillgood »

kuriraisu wrote: post #24
pruman wrote: post #22

Earlier quoted context omitted.

Clever. The font makes it possible for the agent to verify he is on a Gauss machine by visiting seemingly innocuous websites which have code to detect whether the font exists, and then inform him by outputting special text only he knows about. He could receive messages that way too. Once he knows it's a Gauss machine, he can drop his specially named files and they are delivered.

Is the idea that gauss would act like a secret file katamari, rolling around collecting data while it spreads, and being harvested when it "infects" a creator controlled machine? It would seem like any direct data transmission would be detectable and investigated with extreme prejudice.

I am only speculating but we know a few things

1. Its part of a wider eco-system of collecting / infecting / attacking "framework". It seems that attacking uranium enrichment was just a "plug-in".

2. They have designed for multiple infection vectors. Now if it can get in it can also get out. I would not be surprised if the family of malware here is also able to hook into outlook.exe, and even piggy back on IE connections. There is no particular reason why a payload cannot be steganographically put into every photo uploaded to irans' facebook. Which may not be entirely secure of couse :-)

The possibilites when you have the money and time are incredible.

So, no, something as silly as transmitting over UDP from the agents laptop back to www.cia.gov is unlikely, but this things will just keep pushing data around and around till it gets either home, or to a target.

Sadly, much of the code is out in the open. And is surely being pulled apart by other nationstates and the mafia.

Fun times ahead

Re: The Mystery of the Encrypted Gauss Payload

#43

Post by lifeisstillgood »

tjic wrote: post #40
meatsock wrote: post #37

a good point raised in the comments is that the "arabic or hebrew" part really meant to say a "non-letter us-ascii value including curley brackets, tilde, and pipe". not sure why anyone would want to jump the gun on narrowing down geography in this way.

> not sure why anyone would want to jump the gun on narrowing down geography in this way. Because it's a tool designed to take out Iranian uranium refining tools.

I think it is fair to say it is a general purpose tool, that was configured at least once, to take out Uranium refining tools.

So, I would be surprised to find this was not also using, say the parts of Unicode with Chinese characters as well.

Re: The Mystery of the Encrypted Gauss Payload

#44

Post by danielweber »

eli wrote: post #31
danielweber wrote: post #20

Earlier quoted context omitted.

Getting a certain filename onto your computer doesn't sound like a hard problem. Just send them a mail with an attachment of "398rgf90rej243rf.htm" that their email client helpfully extracts for them, or have a file with that name in their web cache when they browse the internet.

Why would you need to trick someone into saving a file with a particular name? You already have malware running on their machine! Seems much more likely that the check is there to confirm that the payload only runs on specific targets. And, perhaps more importantly, to make recovery and dissection of the payload very difficult for someone without access to the target(s).

I was thinking that this program is the bomb, but it's waiting for a trigger. Having a file with a certain name appear on the machine would be that trigger.

Re: The Mystery of the Encrypted Gauss Payload

#46

Post by DividesByZero »

trebor wrote: post #45

I'd like to see Kaspersky bust one of the Russian government-made viruses. I see them protecting customers from everyone else...

Do you have any examples of such a virus? So far only the US and Israel have been implicated in the creation of 'weaponised' malware.

Re: The Mystery of the Encrypted Gauss Payload

#47

Post by rdtsc »

eli wrote: post #31
danielweber wrote: post #20

Earlier quoted context omitted.

Getting a certain filename onto your computer doesn't sound like a hard problem. Just send them a mail with an attachment of "398rgf90rej243rf.htm" that their email client helpfully extracts for them, or have a file with that name in their web cache when they browse the internet.

Why would you need to trick someone into saving a file with a particular name? You already have malware running on their machine! Seems much more likely that the check is there to confirm that the payload only runs on specific targets. And, perhaps more importantly, to make recovery and dissection of the payload very difficult for someone without access to the target(s).

If you are a virus and you are too obvious, you are quickly found and and eliminated by the "immune" system. So it is import to stay low on hosts where there is no benefit in attacking and only using them for vectors of infection and only go into full blown activation mode when some specific trigger is found.

Re: The Mystery of the Encrypted Gauss Payload

#48

Post by rdtsc »

sirclueless wrote: post #25
danielweber wrote: post #20

Earlier quoted context omitted.

Getting a certain filename onto your computer doesn't sound like a hard problem. Just send them a mail with an attachment of "398rgf90rej243rf.htm" that their email client helpfully extracts for them, or have a file with that name in their web cache when they browse the internet.

Well, Gauss requires a file in %PROGRAMFILES% which is considerably more difficult to plant.

I would guess it shouldn't be planted it is expecting it to be there. Chances are that is an Arabic name for some program from Siemmens or something like that. Or the name of the a rich bank client used to connect to a Swiss bank or something of that sort.

The key is of course is to lay low and undetected until that trigger fires, otherwise, anti-virus companies will blow the whistle.

Re: The Mystery of the Encrypted Gauss Payload

#49

Post by sp332 »

Scaevolus wrote: post #41
lt wrote: post #34

Earlier quoted context omitted.

Yes, these are GUIDs in the following format: {931373E2-3DA4-4631-930C-F59510630DA3} It seems to me that's a good theory of what it might be looking for, as GUIDs should make good triggers. I wonder if this reduces the search space enough to make brute force feasible now.

128 bit GUIDs give pairs of 256 bits -- too large to mount an efficient brute force.

But checking all known GUIDs might be more feasible.

Re: The Mystery of the Encrypted Gauss Payload

#50

Post by eli »

sp332 wrote: post #49
Scaevolus wrote: post #41

Earlier quoted context omitted.

128 bit GUIDs give pairs of 256 bits -- too large to mount an efficient brute force.

But checking all known GUIDs might be more feasible.

Well, yeah, but where do you get a list of known GUIDs for InstallShield? Might as well just gather a list of all known Program Files directories.
Post reply on HN