7 ms·

Maybe it would be better to wait until the attackers registered the domain, then sopoeana the registrair for their account info.

SXX 9y ago
Do you seriously expect criminals are dumb enough to leave any useful information there?
- Nrsolis 9y ago
  You'd be very surprised at how dumb criminals can be. Nobody is smart at everything 100% of the time.
- Sir_Cmpwn 9y ago
  Do you seriously expect most criminals are intelligent?
  - TheSpiceIsLife 9y ago
    In this context criminals are a person or persons who have created ransomware which, in less than three days has infecting more than 230,000 computers in 150 countries, demanding ransom payments in bitcoin in 28 languages. The meth dealer two houses down who serves people out his front window probably isn't thinking straight. What we're dealing with here is a different category of thinking.
    - 21 9y ago
      The ransom note in 28 languages can be very well taken from other ransomware pieces, just like the ransomware code itself. It's not like someone will sue for copyright infringement.
    - sillysaurus3 9y ago
      For perspective, they've netted a measly $39,000 / 21 BTC so far. https://www.reddit.com/r/Bitcoin/comments/6axuzs/wannacry_wcry_wannacrypt_bitcoin_addresses/ https://www.reddit.com/r/Bitcoin/comments/6axuzs/wannacry_wc...
  - xj9 9y ago
    not criminals who get caught, no. a good "criminal" is invisible and manages to get away with their crime. these aren't people you hear about, because then they'd be failures.
- 21 9y ago
  Remember the guy which created Silk Road. People talked about him in mythical terms, that he probably has the op-sec of God, but afterwards facts pointed to major mistakes, like connecting identities to his real name, and suddenly everybody was like "how can he be so stupid, doing this while being the owner of a $100 mil criminal empire"
  - SXX 9y ago
    Yet as far as I remember he leaked his identify long before anyone even knew Silk Road is even a thing. And someone behind this botnet certainly knew what scale it's going to have before they started it.
    - 21 9y ago
      In my view that's even more damning. Continuing while knowing that you made basic mistakes in the beginning.
  - DougBTX 9y ago
    It's a classic asymmetry: the defender needs to defend all the time, the hacker just needs to get in once. Ditto op-sec, the hacker needs to keep their identity protected at all times, the security services only need to connect the dots once.
    - MichaelGG 9y ago
      He kept his diary unlocked along with the rest of his operational assets. That's a far cry from one slip. Was it ever released how they found and imaged his server though?
MichaelGG 9y ago
I suppose that might be interesting just to see if they're stupid enough to register with traceable info.
- hk__2 9y ago
  The whole point of this "kill switch" is that it’s NOT registered. The malware uses it to detect if it runs in the sandbox, as researchers often make all DNS requests succeed in their sandbox. Checking for an domain known to be unregistered is one way of checking that.
  - sundvor 9y ago
    How trivial it would be to append a random number at the end, or otherwise randomise it just a little bit.. Quite lucky the programmer didn't think this one through.
    - hk__2 9y ago
      Yes, in another thread someone mentionned a trojan that hit five randomly-generated hostnames and, if they all resolve to the same IP, assumes its running in a sandbox.
  - sajal83 9y ago
    It's not about the registration status of the domain. It is about an HTTP request succeeding. The same functionality could be achieved by using a valid registered domain with server not listening on the desired port.
bahmboo 9y ago
They never would. It's just a naive test to see if the software is running in a VM. Researchers usually resolve all DNS queries inside their test VMs.
- jayflux 9y ago
  How do you mean? Is the malware detecting its in a VM?
  - TobbenTM 9y ago
    And why would they not then use randomly generated domain names, instead of hardcoding domains that could be registered?
    - scottmf 9y ago
      Good point, although randomly generated domain names can exist.
    - DougBTX 9y ago
      The MalwareTech article that documents this best, https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html https://www.malwaretech.com/2017/05/how-to-accidentally-stop... , uses Necurs as an example of a trojan that uses randomly generated domain names, so probably not at technical reason.
  - probably_wrong 9y ago
    Exactly. Based on what I understand, those that test malware do it in a VM logging and redirecting all queries to external domains, in order to identify possible command and control hosts. As a response, malware writers add checks for nonexistent domains. If, say, 5 domains known to be fake suddenly start replying, then the malware assumes that it's being executed inside a VM and stops doing anything, in order not to give researchers any clues. This malware just happened to check a single domain.
    - 9y ago

SXX 9y ago

Do you seriously expect criminals are dumb enough to leave any useful information there?

Nrsolis 9y ago
You'd be very surprised at how dumb criminals can be. Nobody is smart at everything 100% of the time.
Sir_Cmpwn 9y ago
Do you seriously expect most criminals are intelligent?
- TheSpiceIsLife 9y ago
  In this context criminals are a person or persons who have created ransomware which, in less than three days has infecting more than 230,000 computers in 150 countries, demanding ransom payments in bitcoin in 28 languages. The meth dealer two houses down who serves people out his front window probably isn't thinking straight. What we're dealing with here is a different category of thinking.
  - 21 9y ago
    The ransom note in 28 languages can be very well taken from other ransomware pieces, just like the ransomware code itself. It's not like someone will sue for copyright infringement.
  - sillysaurus3 9y ago
    For perspective, they've netted a measly $39,000 / 21 BTC so far. https://www.reddit.com/r/Bitcoin/comments/6axuzs/wannacry_wcry_wannacrypt_bitcoin_addresses/ https://www.reddit.com/r/Bitcoin/comments/6axuzs/wannacry_wc...
- xj9 9y ago
  not criminals who get caught, no. a good "criminal" is invisible and manages to get away with their crime. these aren't people you hear about, because then they'd be failures.
21 9y ago
Remember the guy which created Silk Road. People talked about him in mythical terms, that he probably has the op-sec of God, but afterwards facts pointed to major mistakes, like connecting identities to his real name, and suddenly everybody was like "how can he be so stupid, doing this while being the owner of a $100 mil criminal empire"
- SXX 9y ago
  Yet as far as I remember he leaked his identify long before anyone even knew Silk Road is even a thing. And someone behind this botnet certainly knew what scale it's going to have before they started it.
  - 21 9y ago
    In my view that's even more damning. Continuing while knowing that you made basic mistakes in the beginning.
- DougBTX 9y ago
  It's a classic asymmetry: the defender needs to defend all the time, the hacker just needs to get in once. Ditto op-sec, the hacker needs to keep their identity protected at all times, the security services only need to connect the dots once.
  - MichaelGG 9y ago
    He kept his diary unlocked along with the rest of his operational assets. That's a far cry from one slip. Was it ever released how they found and imaged his server though?

MichaelGG 9y ago

I suppose that might be interesting just to see if they're stupid enough to register with traceable info.

hk__2 9y ago
The whole point of this "kill switch" is that it’s NOT registered. The malware uses it to detect if it runs in the sandbox, as researchers often make all DNS requests succeed in their sandbox. Checking for an domain known to be unregistered is one way of checking that.
- sundvor 9y ago
  How trivial it would be to append a random number at the end, or otherwise randomise it just a little bit.. Quite lucky the programmer didn't think this one through.
  - hk__2 9y ago
    Yes, in another thread someone mentionned a trojan that hit five randomly-generated hostnames and, if they all resolve to the same IP, assumes its running in a sandbox.
- sajal83 9y ago
  It's not about the registration status of the domain. It is about an HTTP request succeeding. The same functionality could be achieved by using a valid registered domain with server not listening on the desired port.

bahmboo 9y ago

They never would. It's just a naive test to see if the software is running in a VM. Researchers usually resolve all DNS queries inside their test VMs.

jayflux 9y ago
How do you mean? Is the malware detecting its in a VM?
- TobbenTM 9y ago
  And why would they not then use randomly generated domain names, instead of hardcoding domains that could be registered?
  - scottmf 9y ago
    Good point, although randomly generated domain names can exist.
  - DougBTX 9y ago
    The MalwareTech article that documents this best, https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html https://www.malwaretech.com/2017/05/how-to-accidentally-stop... , uses Necurs as an example of a trojan that uses randomly generated domain names, so probably not at technical reason.
- probably_wrong 9y ago
  Exactly. Based on what I understand, those that test malware do it in a VM logging and redirecting all queries to external domains, in order to identify possible command and control hosts. As a response, malware writers add checks for nonexistent domains. If, say, 5 domains known to be fake suddenly start replying, then the malware assumes that it's being executed inside a VM and stops doing anything, in order not to give researchers any clues. This malware just happened to check a single domain.
  - 9y ago