5 ms·
They learnt from watching all the research firms reverse engineer Stuxnet and eventually stop it. What they are doing is obfuscating the output. If you look at
by nikcub 15y ago
They learnt from watching all the research firms reverse engineer Stuxnet and eventually stop it. What they are doing is obfuscating the output. If you look at a default DLL or EXE build from VS it is amazing how much information is included that helps you attach a debugger and work out how it works.
The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm using black-box reverse engineering tools to figure out what the research guys will work out when they eventually find it in the wild.
This has worked so well that Kaspersky think that the authors actually invented a new language, when it is likely still just C++, some machine generated code, some obfuscator tools (game makers have been using them for years to stop crackers) and likely manually changing the outputted assembler.
- jberryman 15y ago> The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm using black-box reverse engineering tools to figure out what the research guys will work out when they eventually find it in the wild. Don't they mention that these components were floating around in 2007?
- nikcub 15y agoWhere does it say that? All the references are to 'Duqu Framework', which they recently found, I may have missed something They also completely rule out C++, C etc. when what they should be ruling out is C++, C compiled with a standard VS compiler (or an easily recognizable compiler). It is silly to completely rule out C++ and C just because they don't immediately recognize the output and because it doesn't reference anything else
- jberryman 15y agobottom of TFA: "Duqu was first detected in September 2011, but Kaspersky Lab believes it has seen the first pieces of Duqu-related malware dating back to August 2007"
- gaius 15y agoIn the old days on the demoscene there were utilities called packers and crunchers...
- akx 15y agoStill are: http://www.farbrausch.de/~fg/kkrunchy/ http://www.farbrausch.de/~fg/kkrunchy/ http://www.crinkler.net/ http://www.crinkler.net/ etc.