4 ms·
I'm curious: How realistic is building malware like this? Is this something that has been done out in the open by researchers? Is there an example we can see, o
by jt2190 10y ago
I'm curious: How realistic is building malware like this? Is this something that has been done out in the open by researchers? Is there an example we can see, or is this all still rumors?
The reason I ask is because there's actually value in spreading the rumor that a capability like this exists. Imagine if your adversary believed that you could gain access to their computers even when they're not connected to the internet. They'd run themselves in circles trying to secure everything!
In general, I believe this article to be true, but would love to learn more of the details.
- r721 10y agoFrom Kaspersky Lab's analysis: >What would ProjectSauron have cost to set up and run? >Kaspersky Lab has no exact data on this, but estimates that the development and operation of ProjectSauron is likely to have required several specialist teams and a budget probably running into millions of dollars. https://securelist.com/analysis/publications/75533/faq-the-projectsauron-apt/ https://securelist.com/analysis/publications/75533/faq-the-p...
- lawnchair_larry 10y agoIt is real, and many similar samples exist. People in the industry can usually ask around and get copies.
- runjake 10y agoIt would take an inordinate amount of time for a person to build something like ProjectSauron, but after reading the link, it uses a wide range of publicly-known techniques (windows key loggers, password filters, DNS/ICMP exfil, named pipes, etc etc). This software seems to do a good job at amalgamating a wide range of methods.
- acqq 10y agoRead this as an "introduction" and then you'll be able to understand why the researchers can be so sure that specific kind of malware must be state sponsored: http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html http://www.nytimes.com/2012/06/01/world/middleeast/obama-ord... http://www.langner.com/en/wp-content/uploads/2013/11/To-kill-a-centrifuge.pdf http://www.langner.com/en/wp-content/uploads/2013/11/To-kill... Simply, the goals ant he methods of the commercial malware are fundamentally different to those that can be recognized in the state-sponsored malware.
- wepple 10y agoThis is realistic; there are examples you can see. Have a google around for Stuxnet; a fairly advanced piece of malware which went after Iranian nuclear enrichment centrifuges. It used five previously unreported Microsoft vulnerabilities and a bunch of fairly advanced techniques including jumping airgaps like ProjectSauron does via USB. There are samples of Stuxnet kicking about, if you want to take a look yourself there's nothing stopping you. Although, you may be there a while.