5 ms·

I'm curious about the WannaCry situation. If the killswitch was truly to detect being in a VM, could they still not have bought the domain and just left unrespo

I'm curious about the WannaCry situation. If the killswitch was truly to detect being in a VM, could they still not have bought the domain and just left unresponsive, or even better, just generate a random new domain every single time. I guess they just didn't foresee someone buying the domain.

ineptech 9y ago
> or even better, just generate a random new domain every single time. I'm no expert, but I do recall reading in one of the WC write-ups that there is known malware that does this.
- clwg 9y ago
  It's called a DGA or domain generation algorithm, I believe Conficker was one of the first botnet's to use this approach about 10 years ago, it's pretty standard trade craft nowadays. https://en.wikipedia.org/wiki/Domain_generation_algorithm https://en.wikipedia.org/wiki/Domain_generation_algorithm
  - ehsankia 9y ago
    Well this is slightly different. DGA seems to actually use it as a rendez-vous host, whereas in this case, it literally is a dummy domain that they didn't even bother registering, with the only purpose of checking if they were in a VM. In which case, generating any long hash domain would most likely not be registered and would do the job.
Kostic 9y ago
Buying a domain would make deanonymizing them easier and would take energy from the main effort.
cortesoft 9y ago
And how effective is that defense, anyway? I mean, couldn't you just clone the VM, and start responding or not responding to different domains until you hit on the right one? Or hell, have your VM check a domain and respond correctly if the domain isn't registered?
luckyt 9y ago
Yea, this part was confusing to me as well. How would a VM "simulate" the internet? Does it return a dummy page? I don't understand what mental model of VM behavior that the virus creators had in mind when they designed this killswitch.
- javajosh 9y ago
  The part about how to simulate a site isn't confusing, the part about why you'd want to do that is the confusing part. If I was researching malware in a VM I'd want to take a very passive approach, and allow it to talk to the real internet, and inspect the traffic.
  - LolWolf 9y ago
    It does do that, but in order for it to inspect what's going on, the VM has to accept an outgoing connection as legitimate.
- imtringued 9y ago
  By intercepting every DNS request and routing it to your honey pot server which logs the packets the malware sends to the mothership. What the malware author should do is simply randomly generate the DNS name at the cost of the unlikely chance of hitting a valid domain name instead of hardcoding it.

ineptech 9y ago

> or even better, just generate a random new domain every single time. I'm no expert, but I do recall reading in one of the WC write-ups that there is known malware that does this.

clwg 9y ago
It's called a DGA or domain generation algorithm, I believe Conficker was one of the first botnet's to use this approach about 10 years ago, it's pretty standard trade craft nowadays. https://en.wikipedia.org/wiki/Domain_generation_algorithm https://en.wikipedia.org/wiki/Domain_generation_algorithm
- ehsankia 9y ago
  Well this is slightly different. DGA seems to actually use it as a rendez-vous host, whereas in this case, it literally is a dummy domain that they didn't even bother registering, with the only purpose of checking if they were in a VM. In which case, generating any long hash domain would most likely not be registered and would do the job.

Kostic 9y ago

Buying a domain would make deanonymizing them easier and would take energy from the main effort.

cortesoft 9y ago

And how effective is that defense, anyway? I mean, couldn't you just clone the VM, and start responding or not responding to different domains until you hit on the right one? Or hell, have your VM check a domain and respond correctly if the domain isn't registered?

luckyt 9y ago

Yea, this part was confusing to me as well. How would a VM "simulate" the internet? Does it return a dummy page? I don't understand what mental model of VM behavior that the virus creators had in mind when they designed this killswitch.

javajosh 9y ago
The part about how to simulate a site isn't confusing, the part about why you'd want to do that is the confusing part. If I was researching malware in a VM I'd want to take a very passive approach, and allow it to talk to the real internet, and inspect the traffic.
- LolWolf 9y ago
  It does do that, but in order for it to inspect what's going on, the VM has to accept an outgoing connection as legitimate.
imtringued 9y ago
By intercepting every DNS request and routing it to your honey pot server which logs the packets the malware sends to the mothership. What the malware author should do is simply randomly generate the DNS name at the cost of the unlikely chance of hitting a valid domain name instead of hardcoding it.