NetBus[1] (1998), Back Orifice 2000[2] (1999) and Sub7[3] (1999) demonstrate that feature packed malware is not a novel concept. Kids were pranking each other w

NetBus[1] (1998), Back Orifice 2000[2] (1999) and Sub7[3] (1999) demonstrate that feature packed malware is not a novel concept. Kids were pranking each other with webcam-hijacking, audio-recording, port-redirecting, password-sniffing, auto-updating software in the late 90’s. Hans Dobbertin, Wang Xiaoyun, Arjen Lenstra, Alexander Sotirov, Marc Stevens, Jacob Appelbaum, David Molnar, Dag Arne Osvik, Benne de Weger, Dengguo Feng, Xuejia Lai, Tao Xie, Hongbo Yu, Ron Rivest and numerous other researchers were instrumental from as early as 1996[4] in demonstrating that MD5 was broken. The MD5 collision attack used by Flame will be an implementation of and minor extension to this prior work. My point is that technology development is incremental and tends to occur in small steps. New advances build off the work of many others. An understanding of hacker history is essential to any meaningful malware analysis. Early e-zines such as Phrack, the communities of 2600, CCC, Black Hat/DEF CON and the activities of the cypherpunk movement are good starting points. Without this historical perspective past mistakes will be repeated and insignificant matters over-hyped to the detriment of areas that matter. Cryptography conferences, arXiv, hacker conferences (HOPE Number 9, DEF CON 20, 29C3), open source mailing lists and security researcher blogs are the places to look for new developments. [1] https://en.wikipedia.org/wiki/NetBus https://en.wikipedia.org/wiki/NetBus [2] https://en.wikipedia.org/wiki/Back_Orifice_2000 https://en.wikipedia.org/wiki/Back_Orifice_2000 [3] https://en.wikipedia.org/wiki/Sub7 https://en.wikipedia.org/wiki/Sub7 [4] https://en.wikipedia.org/wiki/MD5#History_and_cryptanalysis https://en.wikipedia.org/wiki/MD5#History_and_cryptanalysis