Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Flame: Massive cyber-attack discovered, researchers say

bbc.com

Post reply on HN
Print view View original

41–50 of 84 posts

Re: Flame: Massive cyber-attack discovered, researchers say

#41

Post by gcb »

Their conclusion that because it doesn't steal money it can't belong to cybercriminals is bogus and show how little they understand of the industry.

I've heard of researchers from one company dumpster diving the competition. A worm (as amateur as a 20mb one ) could easily be the work of those kind. But i think it gets less press than "evil country" "omg world cyber war" ...not that it may not be happening anyway.

Re: Flame: Massive cyber-attack discovered, researchers say

#42

Post by swordswinger12 »

gaius wrote: post #21
swatkat wrote: post #3

Kaspersky blog has more info: http://www.securelist.com/en/blog/208193522/The_Flame_Questi...

Aren't these the guys who wigged out because they thought Duqu was written in an entirely new custom virus language? And it was actually Visual C++? The second most common compiler on the planet? (after GCC) I would take their analysis with a big pinch of salt.

Give them some credit. Duqu was written using a nonstandard C extension for OO and it was pretty heavily obfuscated iirc.

Re: Flame: Massive cyber-attack discovered, researchers say

#43

Post by swatkat »

rbanffy wrote: post #36
LiquidSummer wrote: post #17

Earlier quoted context omitted.

I always hesitate a little bit when I open a pdf, specially when it is one on malware

It depends: will you render it using Adobe's software?

IIRC, both Adobe Reader "Protected Mode"[1] and Chromium "sandbox"[2] are built on Windows user-mode sandbox framework[3]. Basically, things like principle of least privilege and disable writes etc.

[1]http://blogs.adobe.com/asset/2010/10/inside-adobe-reader-pro...

[2]http://dev.chromium.org/developers/design-documents/sandbox

[3]http://blogs.msdn.com/b/david_leblanc/archive/2007/07/27/pra...

Re: Flame: Massive cyber-attack discovered, researchers say

#44

Post by rhdoenges »

thursley wrote: post #12

More technical details (pdf) on: http://www.crysys.hu/skywiper/skywiper.pdf Although the naming differs it has been noted on several blogs that it is the same malware.

> sKyWIper may have been active for as long as five to eight years

spooky.

Re: Flame: Massive cyber-attack discovered, researchers say

#45

Post by gaius »

swordswinger12 wrote: post #42
gaius wrote: post #21

Earlier quoted context omitted.

Aren't these the guys who wigged out because they thought Duqu was written in an entirely new custom virus language? And it was actually Visual C++? The second most common compiler on the planet? (after GCC) I would take their analysis with a big pinch of salt.

Give them some credit. Duqu was written using a nonstandard C extension for OO and it was pretty heavily obfuscated iirc.

Not really; they just did OO with C structs and function pointers, this is actually how it used to be done in high- performance code like computer graphics before C++ got fast enough. And the " obfuscation" was passing the -O flag to the compiler...

Re: Flame: Massive cyber-attack discovered, researchers say

#46

Post by gue5t »

munin wrote: post #40

"It’s easier to hide a small file than a larger module." my mind is blown. small files are not like small rocks. it's a computer!

Assuming fairly dense formats (no .wavs or .bmp images), large files necessarily mean more than small files, so they draw more attention to themselves. "Why is /foo/bar using 300MB of disk?" is a much more likely avenue of inquiry than "Why is /foo/bar using 50KB of disk?".

Re: Flame: Massive cyber-attack discovered, researchers say

#47

Post by raverbashing »

pjin wrote: post #19
mkr-hn wrote: post #9

Earlier quoted context omitted.

The LUA makes me wonder if the creator could be identified by their coding style.

From the Kaspersky article, Flame ships with a Lua VM, sqlite3, zlib, libbz2, and an SSL library (probably OpenSSL?), and these and more apparently result in its unusually large size (almost 20 MB). Sounds almost like "lean malware" written by a relatively small team using easily available tools and libraries.

Yeah, I mean, sqlite3? In a 'virus'?

What's next? Shipping the JVM and MariaDB

Re: Flame: Massive cyber-attack discovered, researchers say

#48

Post by forgotusername »

swordswinger12 wrote: post #42
gaius wrote: post #21

Earlier quoted context omitted.

Aren't these the guys who wigged out because they thought Duqu was written in an entirely new custom virus language? And it was actually Visual C++? The second most common compiler on the planet? (after GCC) I would take their analysis with a big pinch of salt.

Give them some credit. Duqu was written using a nonstandard C extension for OO and it was pretty heavily obfuscated iirc.

Any group of reverse engineers who notice C calling conventions and conclude the function parameters are so uniform that it must absolutely be a deadly new HACKER LANGUAGE need to be taken out back and shot, but I doubt any actual engineers were responsible for that announcement.

Re: Flame: Massive cyber-attack discovered, researchers say

#49

Post by haberman »

The reason why Flame is [20MB] is because it includes many different libraries, such as for compression (zlib, libbz2, ppmd) and database manipulation (sqlite3), together with a LUA virtual machine.

SQLite is 500kB, Lua is 150kb, zlib is 80kB, libbz2 is 60kB. Together this comes to less than 1MB, not 20MB. You would need an awful lot of libraries like this to get anywhere close to 20MB.

Post reply on HN