3 ms·
Unless this is different from the shellcode they used when taking down Freedom Hosting, I'm not sure what releasing it would do. There are already numerous anal
by moyix 11y ago
Unless this is different from the shellcode they used when taking down Freedom Hosting, I'm not sure what releasing it would do. There are already numerous analyses of the code:
- Vlad Tsyrklevich: http://tsyrklevich.net/tbb_payload.txt http://tsyrklevich.net/tbb_payload.txt
- Gareth Owenson: http://owenson.me/fbi-tor-malware-analysis/ http://owenson.me/fbi-tor-malware-analysis/
- My own analysis based on running it in PANDA: https://www.reddit.com/r/ReverseEngineering/comments/1jpln2/has_anyone_else_taken_a_look_at_the_shellcode/cbh1qpe https://www.reddit.com/r/ReverseEngineering/comments/1jpln2/... (you can also get the recording of the shellcode executing and step through it here: http://www.rrshare.org/detail/26/ http://www.rrshare.org/detail/26/ )
It's not big, and we have a pretty good idea what every piece of it does.
Of course, I suppose we don't know that the malware it used in this case is the same as the one in the Freedom Hosting case, so I guess it would be nice to compare and contrast them.
- belorn 11y agoOne benefit is to have documented evidence that FBI did release malware to the public. There has been little to no discussion on safeguards or liability when it comes to government published malware, and I wonder if a concrete example can enable such discussion.