5 ms·

"Handle with care." Hey guys, let's unzip this so the next guy can run it and spread the worlds most advanced malware on our home network.

cyphunk 12y ago
I didn't see any zips. Though zip is not the only vector one should be concerned with. For downloadable files, handle with extreme care. Exploration of the database content however is static and i'm sure the Internet will thank you if you parse and compile a list of interesting patterns you find from it.
rubbingalcohol 12y ago
It would be fun to install in a VM though! Or maybe not.
- gasull 12y ago
  It will phone home. Don't do it unless it's disconnected from the network. It might also try to spread the infection through other attack vectors, like bluetooth, or trying to break out of the VM.
  - kordless 12y ago
    > break out of the VM I wonder if this has happened yet?
    - sp0rk 12y ago
      Most definitely. Here is an example: http://1337day.com/exploit/22519 http://1337day.com/exploit/22519
      - Dylan16807 12y ago
        Got anything that doesn't involve the 2d/3d video acceleration? Those are a rather obvious and off-by-default attack surface.
        justincormack 12y ago
        See here http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_...
        gasull 12y ago
        Down for me. Here's a cached version: https://web.archive.org/web/20140703130707/www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php https://web.archive.org/web/20140703130707/www.vupen.com/blo...
  - wcummings 12y ago
    More likely it would self-destruct to avoid analysis or detection, this is well documented behavior of a number of more sophisticated pieces of malware.
- toomuchtodo 12y ago
  The equivalent of handling Ebola in your home kitchen.
frozenport 12y ago
I doubt its advanced, their customer list doesn't include well established players like China, Russia and the USA. In fact, this might be the cheapest militarized malware you can get. The only way to go cheaper is to use a TeamViewer RAT.
- kissickas 12y ago
  It might not be the most advanced out there, but I wouldn't belittle the surveillance ability of countries like Pakistan, Qatar, Bahrain, and South Africa. Surprised to see Italy on there, though. https://wikileaks.org/spyfiles4/customers.html https://wikileaks.org/spyfiles4/customers.html

cyphunk 12y ago

I didn't see any zips. Though zip is not the only vector one should be concerned with. For downloadable files, handle with extreme care. Exploration of the database content however is static and i'm sure the Internet will thank you if you parse and compile a list of interesting patterns you find from it.

rubbingalcohol 12y ago

It would be fun to install in a VM though! Or maybe not.

gasull 12y ago
It will phone home. Don't do it unless it's disconnected from the network. It might also try to spread the infection through other attack vectors, like bluetooth, or trying to break out of the VM.
- kordless 12y ago
  > break out of the VM I wonder if this has happened yet?
  - sp0rk 12y ago
    Most definitely. Here is an example: http://1337day.com/exploit/22519 http://1337day.com/exploit/22519
    - Dylan16807 12y ago
      Got anything that doesn't involve the 2d/3d video acceleration? Those are a rather obvious and off-by-default attack surface.
      - justincormack 12y ago
        See here http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_...
        gasull 12y ago
        Down for me. Here's a cached version: https://web.archive.org/web/20140703130707/www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php https://web.archive.org/web/20140703130707/www.vupen.com/blo...
- wcummings 12y ago
  More likely it would self-destruct to avoid analysis or detection, this is well documented behavior of a number of more sophisticated pieces of malware.
toomuchtodo 12y ago
The equivalent of handling Ebola in your home kitchen.

frozenport 12y ago

I doubt its advanced, their customer list doesn't include well established players like China, Russia and the USA. In fact, this might be the cheapest militarized malware you can get. The only way to go cheaper is to use a TeamViewer RAT.

kissickas 12y ago
It might not be the most advanced out there, but I wouldn't belittle the surveillance ability of countries like Pakistan, Qatar, Bahrain, and South Africa. Surprised to see Italy on there, though. https://wikileaks.org/spyfiles4/customers.html https://wikileaks.org/spyfiles4/customers.html