The company has named it the Duqu Framework I am confident that within a week there will be 3 front page posts on HN along the lines of 'Why I use Duqu and you should too'.
[deleted]
Kaspersky: Duqu Trojan uses 'unknown programming language'
41–50 of 122 posts
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#42Unless I'm mistaken it looks like a very dynamic language. The screenshot they're showing seems to point at initialisation of a new object, which actually copies function pointers for each of its methods. That's not needed for static languages which would just point to vtables. It looks like it doesn't use real GC though - object's destructor is called right away on a failed allocation. And the destructor is possible…
The characteristics listed in the actual article (posted by computerbob: http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...) also support this conclusion.
-Everything is wrapped into objects
-Function table is placed directly into the class instance and can be
modified after construction
-There is no distinction between utility classes (linked lists, hashes) and
user-written code
-Objects communicate using method calls, deferred execution queues and
event-driven callbacksRe: Kaspersky: Duqu Trojan uses 'unknown programming language'
#43This is one of the most interesting netsec (if not THE most) questions of our time. We have what is effectively an alien virus, given how advanced it was, its construction and spawing of duqu and being written in an unknown language. This is serious awesome cyberpunk stuff - but scary as hell at the same time. With the revelation of Stuxnet and Duqu, NOBODY should think anything they do/say online is safe.
Not necessarily. Occam's Razor. It's more likely that they used something obscure to compile or obfuscate the code or wrote a tool to do so. Creating a new language just to write this seems highly unlikely.
Is writing something like this in pure assembly beyond the realm of possibility for some reason? There are still a few dedicated people that code on the metal for high level operating systems (Steve Gibson comes to mind immediately)
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#44Earlier quoted context omitted.
But surely the compiler (assuming a compiler is used) would convert the new high level language into regular Scheme primitives - I think it's unlikely that the result wouldn't be identifiable.
No... the product allows you to write scripts to manipulate its machine code IR database in scheme, and then spit out the machine code as nasm assembly, assembly them, and then run the appropriate linker in the same way that was used to produce the original exe. Scheme is used as a macro language. So you use scheme to say: change the code at EA 0xdeadbeef from a mov to a jmp. You can reorder functions, insert and rem…
Ahh, that makes more sense, I thought it meant simply creating a higher level language from Scheme rather than manipulating the last stage(s) of producing the binary.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#45The payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86. http://www.grammatech.com/research/products/CodeSurferx86.ht... If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewritt…
As a part-time Schemer this does not surprise me... Schemers have a tendency to craft their own languages. It's only natural.
I've having this vision of a Jedi being required to construct their own light sabre.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#46Apparently I am the only one who thought immediately "Goldman Sachs." My money is on this being SLANG.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#47The company has named it the Duqu Framework I am confident that within a week there will be 3 front page posts on HN along the lines of 'Why I use Duqu and you should too'.
Within a month there will be a Dice job listing asking for five years of Duqu experience.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#48To me this just seems like someone wrote their own little OO system in C, similar to how GObject works. The book Object Oriented Programming with ANSI by Axel-Tobias Schreiner[1] even has example types which use the nomenclature 'ctor' and 'dtor' as in the snippet of code they show (See section 2.5, page 17). It isn't hard to write a little class generator that writes out all this boilerplate code[2] from a C++/C# li…
The inconsistent placement of the "this" argument in function calls seems to support this being C. The vtable moving around would indicate that each class layout is hand-written, though.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#49Please forgive, and correct, me if I have this wildly wrong: This is referred to as Stuxnet 2. And the original was "proven" to have been made to attack Iranian nuclear labs, and what not. Conclusion being that it was made by some government agency. I suppose foil hat theory would point fingers at CIA/NSA type people. Assuming the above is correct, or correct enough, its it not surprising to see what might be a new l…
The best guess, at least in Israel, has been for a while now that Stuxnet was a joint Israeli/US effort.
I haven't heard any similar speculation about Duqu.
Re: Kaspersky: Duqu Trojan uses 'unknown programming language'
#50I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that.
We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got invisible army of Chinese hackers that noone knows who they are, only that they are really good; some unknown entity making amazingly well done and thought out trojan like stuxnet and now duqu, that seems to be right from pages of some hyperbolic comic book; and, last but not the least, the Russian mafia lords employing Zeus trojans and whatnot to make botnets that mine bitcoin, purely digital currency.
It's an amazing world we live in. Can't wait what the future will bring.