Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WannaCry – New Variants Detected

blog.comae.io

Post reply on HN
Print view View original

131–140 of 164 posts

Re: WannaCry – New Variants Detected

#131

Post by jayflux »

jayflux wrote: post #37
probably_wrong wrote: post #35

Earlier quoted context omitted.

Exactly. Based on what I understand, those that test malware do it in a VM logging and redirecting all queries to external domains, in order to identify possible command and control hosts. As a response, malware writers add checks for nonexistent domains. If, say, 5 domains known to be fake suddenly start replying, then the malware assumes that it's being executed inside a VM and stops doing anything, in order not to…

Oh right, I was under the impression it checked the domains as a kill switch, not as a VM check? I.e if this domain is up and responding don't do anything. As I could easily run it in a VM and not redirect any traffic

Edit: just read this ... In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen).

https://www.malwaretech.com/2017/05/how-to-accidentally-stop...

Does someone have more info on this? I didn't know VMs do this?

Re: WannaCry – New Variants Detected

#133

Post by bubblethink »

This makes me think of a different kind of a kill-switch. What if the OS itself is required to have a kill-switch that triggers once it goes out of support, and it prevents regular use unless the admin goes through some serious hoops to override. It at least squarely puts the blame on 1) Orgs that willfully override v/s passively ignoring to update 2) OS vendors who have really short support cycles (~1 year for most android phones)

Re: WannaCry – New Variants Detected

#134

Post by kijin »

nathan_f77 wrote: post #88
kuschku wrote: post #73

Earlier quoted context omitted.

Or even just sha256(unixtime().rand()).com Or a domain in a TLD that allows only second level TLDs (such as some of the commonwealth countries).

> sha256(unixtime().rand()).com Yep, that's the way to do it.

That gives you 64 characters to the left of the dot. The maximum number of characters allowed in any single component of a domain name is 63. Some systems might react in unexpected ways if you try to resolve an invalid domain name, making your check unreliable. Better use md5 or sha1.

Re: WannaCry – New Variants Detected

#135

Post by column »

bubblethink wrote: post #133

This makes me think of a different kind of a kill-switch. What if the OS itself is required to have a kill-switch that triggers once it goes out of support, and it prevents regular use unless the admin goes through some serious hoops to override. It at least squarely puts the blame on 1) Orgs that willfully override v/s passively ignoring to update 2) OS vendors who have really short support cycles (~1 year for most…

if you put a killswitch in Windows that can be triggered from Redmond, I guarantee you it will be used by virus of sorts

Re: WannaCry – New Variants Detected

#136

Post by ComodoHacker »

btown wrote: post #132

Could a grey hat create a self propagating but non-ransoming variant that inoculated target machines against its more malicious brethren? Seems like something a state actor might want to do.

You mean bundle and forcefully install MS patches? This would require reboot which AFAIK can't be done without user's action (if not using undocumented APIs).

Re: WannaCry – New Variants Detected

#137

Post by erikbye »

ibic wrote: post #120
kristofferR wrote: post #115

Earlier quoted context omitted.

WannaCry ("the attack") didn't target Windows 10 installations (probably since most Win10 users have updates enabled), but Windows 10 is still vulnerable without the patch.

Again, where is the source? I seriously doubt that the worm author would let go such a profitable target if they can infect Windows 10. According to this: https://www.netmarketshare.com/operating-system-market-share... Windows 10 has almost 4 times users than XP (and supposedly the gap is growing larger)

Just have a look at the XML configuration files for the exploits used. They are on GitHub. Windows 10 was not a target.

Re: WannaCry – New Variants Detected

#138

Post by Sunset »

ComodoHacker wrote: post #136
btown wrote: post #132

Could a grey hat create a self propagating but non-ransoming variant that inoculated target machines against its more malicious brethren? Seems like something a state actor might want to do.

You mean bundle and forcefully install MS patches? This would require reboot which AFAIK can't be done without user's action (if not using undocumented APIs).

Maybe install itself as a network packet filter and work as temporary firewall until the machine is restarted?

Re: WannaCry – New Variants Detected

#139

Post by losteric »

bichiliad wrote: post #116
nathan_f77 wrote: post #87

I think it's hilarious how these "kill switches" are supposedly meant to detect sandboxes, to make it harder for security researchers to analyze the malware. While actually making it easy for security researchers to completely disable all installations around the entire world. That's just what I heard, but it makes sense. There are far more sane ways to implement a kill switch without using unregistered domains. (For…

The point of the killswitch is to detect if the worm is running inside a sandbox. Some sandboxes will resolve any domain you try to ping, so an easy way to detect this is to ping a non-existent domain name. I'm not totally sure how pinging an existing domain would give you the same behavior, but doing something like checking a handful of random non-existent domains from a large list could do the trick. From the sound…

I wonder why there are multiple kill switches?

Re: WannaCry – New Variants Detected

#140

Post by kuschku »

kijin wrote: post #134
nathan_f77 wrote: post #88

Earlier quoted context omitted.

> sha256(unixtime().rand()).com Yep, that's the way to do it.

That gives you 64 characters to the left of the dot. The maximum number of characters allowed in any single component of a domain name is 63. Some systems might react in unexpected ways if you try to resolve an invalid domain name, making your check unreliable. Better use md5 or sha1.

Well, that'd be an implementation detail, but the general concept stays the same.

And is superior to hardcoding.

Post reply on HN