5 ms·
It's so bad that even some intelligence agency-developed malware gets busted (in part) due to leaky paths and other strings in binaries' metadata. Here's a lea
by meowface 6y ago
It's so bad that even some intelligence agency-developed malware gets busted (in part) due to leaky paths and other strings in binaries' metadata.
Here's a leaked CIA Wiki/CMS thread from 2015 discussing some of the fuckups found by Kaspersky in NSA ("Equation Group") malware binaries: https://wikileaks.org/ciav7p1/cms/page_14588809.html https://wikileaks.org/ciav7p1/cms/page_14588809.html
>This is PDB string, right? The PDB path should ALWAYS be stripped (I speak from experience. Ask me about Blackstone some time.). For Visual Studio user mode stuff, the /DEBUG linker switch should NOT be used. For drivers, it's a bit harder to avoid it, but a post-build step using binplace will strip the path information.
>For other strings generally, yeah, search the binary for them. Don't use internal tool names in your code.
Examples from Kaspersky's report (https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf https://securelist.com/files/2015/02/Equation_group_question...):
>"Timeout waiting for the “canInstallNow” event from the
implant-specific EXE!"
"Implant" is NSA lingo for "persistent malware". Probably best not to include routines for helpful error messages in your production-build nation-state malware code.
>"Manual/DRINKPARSLEY/2008-09-30/10:06:46.468-04:00"
Conspicuous all-caps NSA codename.
>"standalonegrok_2.1.1.1"
"The codename GROK appears in several documents published by Der Spiegel, where “a keylogger” is mentioned. Our analysis indicates EQUATIONGROUP’s GROK plugin is indeed a keylogger on steroids that can perform many other functions."
>"c:\users\rmgree5\"
Follows NSA's internal username / @nsa.gov pattern.
(The whole thread's an interesting read in general. You can even hover over all the myriad acronyms/initialisms to see what they mean. Also kind of amusing to see the unsurprising rivalry and passive-aggressive shade between CIA's and NSA's cyber operations teams.)