3 ms·

How are these things named? Is "Regin" or "Stuxnet" a string somewhere? Do the researchers make the names up? (And, what do the creators think of the name the

by jonah 12y ago

How are these things named? Is "Regin" or "Stuxnet" a string somewhere? Do the researchers make the names up? (And, what do the creators think of the name their tool is given vs. what they called it.)

AlyssaRowan 12y ago
Yes, generally malware is named by the researchers who found it - often even if the creators obviously named it otherwise. I wouldn't be surprised if "Regin" was a reference to how the researchers found big chunks of it tucked away in the registry, or something like that. For example, there's a reference to the name "Myrtus" in Stuxnet, which was (I think) probably the name its creators gave it (and may point to its Israeli origin)?
nikcub 12y ago
Stuxnet: named for files .stub (where config was stored) and mrxnet.sys (main driver), by Microsoft Duqu: named for the "~DQ-" temporary files it created, by researchers in Hungary who found it and wrote report Flame: is from a routine called "InstallFlame", so the malware name is likely same between discoverers and writers. The naming convention is usually to find a unique identifier used in the malware. Portmanteau's are common. We often don't find out what the writers name was, although both Stuxnet and Flame were part of Operation Olympic Games[0] [0] http://en.wikipedia.org/wiki/Operation_Olympic_Games http://en.wikipedia.org/wiki/Operation_Olympic_Games
jonah 12y ago
From this The Intercept piece[0]: "In Nordic mythology, the name Regin is associated with a violent dwarf who is corrupted by greed. It is unclear how the Regin malware first got its name, but the name appeared for the first time on the VirusTotal website on March 9th 2011." Double meaning or coincidence? e.g. did the authors of this piece just google "Regin" and find out about this dwarf? [0] https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/ https://firstlook.org/theintercept/2014/11/24/secret-regin-m...

by jonah 12y ago

AlyssaRowan 12y ago

Yes, generally malware is named by the researchers who found it - often even if the creators obviously named it otherwise. I wouldn't be surprised if "Regin" was a reference to how the researchers found big chunks of it tucked away in the registry, or something like that. For example, there's a reference to the name "Myrtus" in Stuxnet, which was (I think) probably the name its creators gave it (and may point to its Israeli origin)?

nikcub 12y ago

Stuxnet: named for files .stub (where config was stored) and mrxnet.sys (main driver), by Microsoft Duqu: named for the "~DQ-" temporary files it created, by researchers in Hungary who found it and wrote report Flame: is from a routine called "InstallFlame", so the malware name is likely same between discoverers and writers. The naming convention is usually to find a unique identifier used in the malware. Portmanteau's are common. We often don't find out what the writers name was, although both Stuxnet and Flame were part of Operation Olympic Games[0] [0] http://en.wikipedia.org/wiki/Operation_Olympic_Games http://en.wikipedia.org/wiki/Operation_Olympic_Games

jonah 12y ago

From this The Intercept piece[0]: "In Nordic mythology, the name Regin is associated with a violent dwarf who is corrupted by greed. It is unclear how the Regin malware first got its name, but the name appeared for the first time on the VirusTotal website on March 9th 2011." Double meaning or coincidence? e.g. did the authors of this piece just google "Regin" and find out about this dwarf? [0] https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/ https://firstlook.org/theintercept/2014/11/24/secret-regin-m...