3 ms·
> the author is sophisticated and that's why they chose RC5 I'm saying that because the author is sophisticated, they know that the strength of the algorithm d
by alister 12y ago
> the author is sophisticated and that's why they chose RC5
I'm saying that because the author is sophisticated, they know that the strength of the algorithm doesn't matter (so long as it's not something ridiculously simple).
DES, AES, RC5, RC6, whatever. They're all good enough because Symantec (or whoever is analyzing the malware) is going to get the plaintext no matter what. Symantec is not going to do any cryptanalysis whatsoever. Symantec is going to run the sample malware in a debugger and watch it get decrypted. The malware must decrypt itself in order to run.
- AlyssaRowan 12y agoThe malware must decrypt the parts that it runs. (There's an obfuscation technique that's apparently quite strong in existence, but it produces gigabyte executables for simple 5-condition if statements you can brute force by hand, so it's ludicrously impractical.) This could be worse. It could have encrypted routines for which the commands are the decryption keys. It doesn't appear to be particularly polymorphic. If there's a BIOS/PCI dropper, it's (sadly) long gone here.