4 ms·
This makes fairly little sense to me. Why wouldn't one write such a virus using straight ASM, or possibly write a VM in ASM and write the payload in the VM's b
by daeken 15y ago
This makes fairly little sense to me. Why wouldn't one write such a virus using straight ASM, or possibly write a VM in ASM and write the payload in the VM's bytecode (this option makes it particularly easy to do metamorphic code, though doing it with well-written ASM is also very possible)? It seems like creating a custom language -- or hacking up compiled C++ or whatnot -- is a bit of overkill considering that the basic tenets of virus writing are: keep it simple, don't get caught; this wouldn't aid in either of those.
- maaku 15y agoPerhaps because this is no simple virus? Perhaps because Stuxnet/Duqu is one of if not the most sophisticated examples of cyber warfare* we have public examples of? Perhaps because its compiled binary is a whopping half-megabyte in size? The amount of effort that went into Stuxnet is truly massive. It'd be no surprise if a custom framework or even a domain-specific language were written to support it. * Usually I cringe at just hearing the phrase cyber warfare and at the ridiculous way in which it is used by media and the government. But looking at what Stuxnet accomplished (physically damaging or disabling critical components of the Iranian nuclear enrichment program), the term applies completely.
- lallysingh 15y agoNobody does pure ASM anymore. And frankly, all you need for this level of obfuscation is a new compiler pass, something very easy to do in LLVM. If I were to guess, from the description they gave, it sounds like someone compiled erlang. The two have already been combined: http://www.erlang-factory.com/conference/SFBay2011/speakers/joearmstrong http://www.erlang-factory.com/conference/SFBay2011/speakers/...