4 ms·
How is the rust part relevant?
by belinder 4y ago
How is the rust part relevant?
- baguettefurnace 4y agojust like if a tesla is involved in a car crash, headline must mention Tesla
- butterNaN 4y agoIsn't that because sometimes the tesla software might be at fault?
- baguettefurnace 4y agoThe software is rarely at fault if you follow up on the stories. If every time a human driver crashed a car it was the lead story in whatever news you consume, you'd likely never drive.
- throwthere 4y agoChatgpt recommended it for the upvotes.
- wheelerof4te 4y ago"The most beloved programming language used to build and ship malware (PHOTO/VIDEO/NSFW)"
- HL33tibCe7 4y agoIt’s unusual for malware.
- selfmodruntime 4y agoYes, but only for the time being. I‘ve recently published a paper on the topic. Rust and Golang are getting immensely popular with malware authors.
- hoppla 4y agoI would love a link so I could read your paper.
- arthurcolle 4y agoSame! Please share GP
- Godel_unicode 4y agoI mean, not really? There’s a lot of legacy stuff written in other languages, but malware authors have realized that people are less skeptical of rust and are actively taking advantage of that fact.
- yabones 4y agoWe like when malware is written in a memory-safe language.
- dtgriscom 4y agoEncrypt my files, but please don't waste my RAM while you do so.
- lost_tourist 4y ago"it's amazing what they were able to do with that old pentium linux server that someone forgot in the server room, so much damage! rust is truly the future"
- mftb 4y agoIf a payload is native it's potentially more of a problem than a script. If the payload had been c or c++, I wouldn't have been surprised if they noted that either.
- sidlls 4y agoWe should only refer to Rust when it's included in positive events? How is it not relevant here? It was used to build executables to inject, likely for malicious purposes. Given its newness and all the other hype around it, I'd say it's very relevant.
- puffoflogic 4y agoWhy not also be sure to mention what OS was used for the build, and what linker, and what file format, and what model of computer was used, and what its default ui language was set to? What is so special about programming language used that sets it apart from those other factors that could be mentioned?
- muraiki 4y agoThe use of Rust has particular implications for malware analysis: https://c3rb3ru5d3d53c.github.io/2022/08/malware-reversing-rust/ https://c3rb3ru5d3d53c.github.io/2022/08/malware-reversing-r... So yes, it's relevant.
- puffoflogic 4y agoThat article is nonsense and the author could not even complete it. It is buried in a shallow grave of irrelevance.
- muraiki 4y agoHere's an article from the SEI covering the problems with using Ghidra for malware analysis of Rust code. See "Binary Analysis Without Source Code" https://insights.sei.cmu.edu/blog/rust-vulnerability-analysis-and-maturity-challenges/ https://insights.sei.cmu.edu/blog/rust-vulnerability-analysi...
- puffoflogic 4y agoYou cite yet another article which you clearly don't understand, and whose authors have questionable understanding themselves. This article cites CVEs of a certain type, which were especially popular in the 2021 timeframe. These CVEs do not correspond to real vulnerabilities in real executables. Rather, they are reporting instances of rust programs violating the strictest possible interpretation of the rules of the rust language. For comparison, quite literally every single C program ever written would have to receive a CVE if C were judged by the same rules, because it isn't possible to write a C program which conforms to the standard as strictly as these Rust CVEs were requiring. CVEs of this nature are a bit of a meme in the rust community now, and no one takes them seriously as vulnerabilities. They are reporting ordinary, non-vulnerability bugs and should have been reported to issue trackers. The whole discussion about layout order is completely irrelevant. When RE'ing unknown code you don't know the corresponding source anyways, so the one-to-many correspondence of source to layout is irrelevant. You are given the layout. You can always write a repr(C) which corresponds to it if you're trying to produce reversed source. This is no different than not knowing the original names of variables and having to supply your own. The next objection is literally that rust does not use null-terminates strings, except the authors are so far out of their depth that they don't even identify this obvious root cause of their tools failing. Again, this has absolutely nothing to do with the reversibility of rust programs, except perhaps preventing some apparent script kiddies from figuring it out. The authors do manage to struggle to shore, as it were, by the end of the article, and somehow they end up correctly identifying their tools and understanding and the root cause of their troubles, not Rust. I take it you didn't make it that far when you read it?
- hoppla 4y agoBecause everywhere it’s used, it has to be explicitly mentioned, like clothing that use GoreTex™.