Kaspersky: Duqu Trojan uses 'unknown programming language'

http://www.zdnet.com/blog/security/kaspersky-duqu-trojan-uses-unknown-programming-language/10625

by Slimy • 14 years ago

363 118 14 years ago

zdnet.com

computerbob• 14 years ago

The actual real blog which zdnet summarized from which is far more interesting:

http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...

p0ss• 14 years ago

and from the comments on that blog:

> The code your referring to .. the unknown c++ looks like the older IBM compilers found in OS400 SYS38 and the oldest sys36.

> The C++ code was used to write the tcp/ip stack for the operating system and all of the communications. The protocols used were the following x.21(async) all modes, Sync SDLC, x.25 Vbiss5 10 15 and 25. CICS. RSR232. This was a very small and powerful communications framework. The IBM system 36 had only 300MB hard drive and one megabyte of memory,the operating system came on diskettes.

> This would be very useful in this virus. It can track and monitor all types of communications. It can connect to everything and anything.

moondowner• 14 years ago

> This would be very useful in this virus. It can track and monitor all types of communications. It can connect to everything and anything.

When I read these kind of sentences I always think of Plan9 first

cag_ii3• 14 years ago

But this comment doesn't ever mention specifically what makes his suggestion "look like" the given examples. I find it highly unlikely, given all the available networking/comm libraries available that old, proprietary IBM code would be used. Maybe there's something to it, but he certainly didn't mention anything convincing.

More unusual (to me) is that there are two separate comments suggesting it may be RPG (an OS400/iSeries language), which is very unlikely due to it not being an OOP language therefore not having constructor/destructor functionality, and otherwise a very high level language.

I'd guess some high level assembly, though this suggestion does look interesting.

http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...

Cieplak• 14 years ago

Haskell or Lisp, perhaps?

sek• 14 years ago

I really had to laugh. Cmon guys, this humor is ok on HN.

michaelkscott• 14 years ago

It could also be Erlang, but no mentions so far.

ralphc• 14 years ago

One of the suggestions that was worthy of a reply was that it's some derivative of Mosquito Lisp.

scottdw23• 14 years ago

The payload could have been modified (to obfuscate its origin / source language) using a product named codesurfer/x86.

http://www.grammatech.com/research/products/CodeSurferx86.ht...

If it has access to source code, it can instrument the build process, and obtain disassembly that is high quality enough to support rewriting. Using it's scheme API you can modify the CFG of each procedure directly, serialize the rewritten parts out as nasm, and even relink with the object files you don't have source for.

It works with any build system, and supports gcc / as / ld and cl / link.

So it may not have actually been written using a custom pl.

muyuu• 14 years ago

As a part-time Schemer this does not surprise me... Schemers have a tendency to craft their own languages. It's only natural.

bhrgunatha2• 14 years ago

But surely the compiler (assuming a compiler is used) would convert the new high level language into regular Scheme primitives - I think it's unlikely that the result wouldn't be identifiable.

mahmud2• 14 years ago

GrammaTech is an Scheme shop and employs several Lispers :-)

mkramlich• 14 years ago

I've having this vision of a Jedi being required to construct their own light sabre.

eddie_the_head• 14 years ago

Relevant, semi-related story about methods an adware-author used to write and conceal his adware in Scheme:

http://philosecurity.org/2009/01/12/interview-with-an-adware...

jnbiche• 14 years ago

Also interesting that the CodeSurfer product referenced above is "sponsored by several government agencies, including the US Air Force, the US Navy, the Office of the Secretary of Defense, and the Department of Homeland Security", according to its own website.

Looks like a cool product.

stunr69• 14 years ago

There are some similar products from sgvsarc called Crystal REVS from SGV Sarc (http://www.sgvsarc.com/products.htm). Does anyone know how they compare against Codesurfer and related products from GrammaTech ?

lukeschlather2• 14 years ago

What exactly is the benefit of obfuscating the source language? Your hypothesis that it's written in Scheme is reasonable, but a DSL by any other name is a basket of Lisp macros. It's not a new language, but at the same time, it's kind of a Domain-specific language.

At any rate, I don't think that if it was Scheme that the goal was to obfuscate that it was written in Scheme.

scottdw23• 14 years ago

See my comment below. I don't think you quite understood what I meant. I'm not saying the code was written in scheme. I'm saying there is a product that allows you to write scheme macros to manipulate a database of machine code IR derived from disassembly and then turn the modified database back into an executable.

Hiding the source language makes identifying the origin of the malware difficult. There are obvious reasons to do that.

meatsock• 14 years ago

are properly written code obfuscators able to throw off detection of their originating language?

samstave• 14 years ago

This is one of the most interesting netsec (if not THE most) questions of our time.

We have what is effectively an alien virus, given how advanced it was, its construction and spawing of duqu and being written in an unknown language.

This is serious awesome cyberpunk stuff - but scary as hell at the same time.

With the revelation of Stuxnet and Duqu, NOBODY should think anything they do/say online is safe.

driverdan• 14 years ago

Not necessarily. Occam's Razor. It's more likely that they used something obscure to compile or obfuscate the code or wrote a tool to do so. Creating a new language just to write this seems highly unlikely.

kiiski• 14 years ago

"Creating a new language just to write this seems highly unlikely."

Of course, it might be that they didn't create a new language "just to write this", but because they're planning/already written other things in it.

joezydeco• 14 years ago

Is writing something like this in pure assembly beyond the realm of possibility for some reason? There are still a few dedicated people that code on the metal for high level operating systems (Steve Gibson comes to mind immediately)

dhx• 14 years ago

Read some hacker/cracker zines from the late 80's/early 90's (Phrack, 2600, etc being the well known ones) and you'll quickly gain a deep perspective on the pace of computing/IT security advancement over the decades. Stuxnet and Duqu will suddenly appear to be a minor revisions of 20 year old technology/techniques. You'll see code for polymorphic engines written in TurboPascal suddenly break out into obscured x86 assembler interrupt handlers. Detailed analysis of reverse engineering efforts against "packed" code on foreign and obscure architectures. And the word "cyber" used in all seriousness.

It is quite amusing to see how many old ideas from the dawn of computing have been reinvented multiple times over the years.

anigbrowl• 14 years ago

The company has named it the Duqu Framework

I am confident that within a week there will be 3 front page posts on HN along the lines of 'Why I use Duqu and you should too'.

cpeterso• 14 years ago

Who will be the first to post a duqu project on github? :)

louthy• 14 years ago

duqu.js is my goto script.

rmason• 14 years ago

Within a month there will be a Dice job listing asking for five years of Duqu experience.

mlnowak• 14 years ago

Seriously! the funniest thing I read today:)

est• 14 years ago

TFA

> Duqu and Stuxnet components date to 2007

odiroot• 14 years ago

But is it web scale?

linker3000• 14 years ago

"Duqu - the Clojure angle".

viraptor• 14 years ago

Unless I'm mistaken it looks like a very dynamic language. The screenshot they're showing seems to point at initialisation of a new object, which actually copies function pointers for each of its methods. That's not needed for static languages which would just point to vtables. It looks like it doesn't use real GC though - object's destructor is called right away on a failed allocation. And the destructor is possible to change too...

So something like compiled javascript sans GC really. Or maybe like precompiled python.

Doesn't seem very obfuscated either imho - there's a bunch of static data copied in a series of moves. If someone really wanted to obfuscate those, this looks like a fairly low hanging fruit: grab a list of 5+ mov-s of constants and change them into xor+copy of a memory range to confuse pointer detection.

Can you see any more characteristics in that fragment?

shmageggy• 14 years ago

The characteristics listed in the actual article (posted by computerbob: http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...) also support this conclusion.

  -Everything is wrapped into objects
  -Function table is placed directly into the class instance and can be
   modified after construction
  -There is no distinction between utility classes (linked lists, hashes) and
   user-written code
  -Objects communicate using method calls, deferred execution queues and
   event-driven callbacks

LeafStorm• 14 years ago

Reminds me of Smalltalk.

buff-a• 14 years ago

Sounds like someone said, "Make me a language that is hard to reverse engineer using IDA Pro".

RodgerTheGreat2• 14 years ago

If I read that properly, it sounds like Objects have their own function tables- this would seem to indicate an object oriented language based on prototypal inheritance.

darxius• 14 years ago

What driverdan said makes sense. It is much more likely that they obfuscated or masked their code instead of inventing an "unknown" programming language. Even so, the obfuscation method used I'm sure would be pretty cunning (seeing as these folk mean business).

It's interesting to see Kaspersky suggest that the state is behind this solely based on some unknown code. Does anyone know why that would be a likely conclusion on their part?

cag_ii3• 14 years ago

From what I gathered from the article, this doesn't appear to be obfuscated since the purpose/method is transparent in the decompiled code, it simply doesn't match the constructs you would expect to see in common programming languages when decompiled.

jd• 14 years ago

Writing an unpolished programming language isn't that much work in comparison to writing a complex virus. Especially low level languages where instructions map pretty closely to the CPU instructions are easy to create.

I think it makes a lot of sense to write a custom programming language/compiler because virus scanners tend to use fingerprints to recognize dangerous pieces of code. So you want a compiler that deliberately obfuscates the code it writes and also outputs instructions in such a way that it avoids triggering known virus scanner fingerprints.

RodgerTheGreat2• 14 years ago

Agreed. Writing compilers is easy; The "hard" aspects of creating a new language usually boil down to issues like tooling, documentation and support libraries. In the case of a virus, the only users of the language are the virus authors and the language can be highly tailored to the domain.

helmut_hed• 14 years ago

It's particularly hard to obfuscate when anything produced by your compiler gets marked as a virus: http://community.norton.com/t5/Norton-Internet-Security-Nort...

andrewcooke• 14 years ago

is it dumb to suggest that someone who understands c++ (or other compiled oo language) would/could write assembler in this way? just from reading the description (things like variable locations of method tables, various registers for "this", and lack of memory management) it sounds like it could be handwritten, but structured in a similar way to c++.

dfox2• 14 years ago

The disassembly snippet looks like typical C/assembly handcrafted object system without real classes, but responses by Kaspersky guys in blog comments seem to imply that it uses these objects even in places where it is highly impractical when writing code manually. So it's possibly C/assembly written by typical hardcore Java programmer, but I find that highly unlikely.

nivertech• 14 years ago

They doing it wrong.

Instead of trying to compile code examples in every candidate PL, they should:

1. Crawl x86 binaries from the Internet / download sites / code archives.

2. Write M/R job, which will disassemble and look for patterns they discovered.

3. Once patterns found - investigate the source of binary (i.e. who uploaded it to download site, maybe it was on university FTP server or maybe it's part of commercial driver released by company XYZ).

Yxven• 14 years ago

Why would creating your own programming language for a virus be a good thing? If viruses are the only thing written in this language, wouldn't the language make it easier for the anti-virus companies to detect it without having to worry as much about false positives?

Pjdog• 14 years ago

I don't know, maybe they thought that the virus would be harder to remove, or perhaps the person created it to just to see if he could!

cag_ii3• 14 years ago

It may not have been done for that reason alone. NIHS is pretty common among hackers:

http://en.wikipedia.org/wiki/Not_invented_here#In_computing

It also seems to me that a new language for this exact purpose is unlikely, however, it could very well be a proprietary or otherwise unknown language that may have been built for another purpose (internal company, domain-specific development, etc) and not often seen in this context.

cjensen• 14 years ago

Normally compilers compile each operation into a single destination machine code chunk. If you ignore efficiency, there are many ways to implement the same operation in machine code. A Cracker Compiler could contain multiple destination chunks and randomly choose one at compile time.

Writing a detector for a virus with infinite code representations would be difficult.

alan_cx• 14 years ago

Please forgive, and correct, me if I have this wildly wrong:

This is referred to as Stuxnet 2. And the original was "proven" to have been made to attack Iranian nuclear labs, and what not. Conclusion being that it was made by some government agency. I suppose foil hat theory would point fingers at CIA/NSA type people.

Assuming the above is correct, or correct enough, its it not surprising to see what might be a new language for this virus, if it has a nation state's resources behind it? If that is the case, what chance is there that any one will be able to crack this mystery?

yuvadam• 14 years ago

The best guess, at least in Israel, has been for a while now that Stuxnet was a joint Israeli/US effort.

I haven't heard any similar speculation about Duqu.

damiankennedy• 14 years ago

Maybe they just embedded something like RTOS-32. The company that makes it (www.On-Time.com) say it can be integrated with Visual Studio and used along side Visual C++.

apaprocki3• 14 years ago

To me this just seems like someone wrote their own little OO system in C, similar to how GObject works. The book Object Oriented Programming with ANSI by Axel-Tobias Schreiner[1] even has example types which use the nomenclature 'ctor' and 'dtor' as in the snippet of code they show (See section 2.5, page 17). It isn't hard to write a little class generator that writes out all this boilerplate code[2] from a C++/C# like input file. The benefit is, of course, the resulting code size and avoiding any linkage to the std C++ library.

[1] http://www.planetpdf.com/codecuts/pdfs/ooc.pdf [2] http://www.jirka.org/gob.html

stianan3• 14 years ago

The inconsistent placement of the "this" argument in function calls seems to support this being C. The vtable moving around would indicate that each class layout is hand-written, though.

apaprocki3• 14 years ago

Yeah, the author made a point of noting "this" could be in a register or the stack, but that to me just says "C". The functions moving around wouldn't necessarily mean it is written by hand, though. There just needs to be some rules governing the system and we don't know what those rules are (yet).

I would just be very surprised if this is anything other than some convention developed on top of C.

flabberghast• 14 years ago

Well, given that Unit 8200 is up, and the U.S. Cyber Command is active this looks exactly like what they'd do.

Just wait until they let the A.I. make the language as so it is not human decipherable.

GeogreHost• 14 years ago

Relevant link:

http://www.kurzweilai.net/ai-designs-its-own-video-game

Pretty much, let the machine make the code.

daeken• 14 years ago

This makes fairly little sense to me. Why wouldn't one write such a virus using straight ASM, or possibly write a VM in ASM and write the payload in the VM's bytecode (this option makes it particularly easy to do metamorphic code, though doing it with well-written ASM is also very possible)? It seems like creating a custom language -- or hacking up compiled C++ or whatnot -- is a bit of overkill considering that the basic tenets of virus writing are: keep it simple, don't get caught; this wouldn't aid in either of those.

maaku2• 14 years ago

Perhaps because this is no simple virus? Perhaps because Stuxnet/Duqu is one of if not the most sophisticated examples of cyber warfare* we have public examples of? Perhaps because its compiled binary is a whopping half-megabyte in size?

The amount of effort that went into Stuxnet is truly massive. It'd be no surprise if a custom framework or even a domain-specific language were written to support it.

* Usually I cringe at just hearing the phrase cyber warfare and at the ridiculous way in which it is used by media and the government. But looking at what Stuxnet accomplished (physically damaging or disabling critical components of the Iranian nuclear enrichment program), the term applies completely.

lallysingh• 14 years ago

Nobody does pure ASM anymore. And frankly, all you need for this level of obfuscation is a new compiler pass, something very easy to do in LLVM.

If I were to guess, from the description they gave, it sounds like someone compiled erlang. The two have already been combined: http://www.erlang-factory.com/conference/SFBay2011/speakers/...

vessenes• 14 years ago

Apparently I am the only one who thought immediately "Goldman Sachs." My money is on this being SLANG.

gaius2• 14 years ago

Slang is not compiled, and isn't very useful without SecDB behind it.

runn1ng2• 14 years ago

I will be repeating a notion I read on YCombinator elsewhere - but I, too, find it incredibly cool that we live in a time when wars are fought online like that.

We have online revolutionaries anarchists and REAL nation-wide revolutions, started on online networks (talking about Arabic Spring here); we got FBI agents, looking through IP addresses on IRC networks to catch a small group of bragging attackers; we got invisible army of Chinese hackers that noone knows who they are, only that they are really good; some unknown entity making amazingly well done and thought out trojan like stuxnet and now duqu, that seems to be right from pages of some hyperbolic comic book; and, last but not the least, the Russian mafia lords employing Zeus trojans and whatnot to make botnets that mine bitcoin, purely digital currency.

It's an amazing world we live in. Can't wait what the future will bring.

adriand• 14 years ago

You seem to be pretty enthusiastic about rather worrying and even disturbing developments. This is not a science fiction novel, this is real life. One day it is Israeli hackers destroying Iranian centrifuges, perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.

sheraz• 14 years ago

...I guess some guys just want to watch the world burn.

runn1ng2• 14 years ago

As I think about it, you are probably right.

And yet, I can't help myself but watch in fascination as all this happens. Maybe it's because this time, the war is fought with means and tools I understand (if only a little)? Maybe.

Maybe it has something to do with the morbid fascination people have with anything destructive - the World War II books and movies are still sold like cakes, while noone actually wants to repeat the world war.

etherael• 14 years ago

Maybe so, likely though this is what the erosion of existing power structures looks like first hand. I think we should just be thankful it is relatively peaceful compared to the natural order of such events historically speaking.

wmeredith• 14 years ago

Something doesn't have to be not-a-train-wreck to be utterly fascinating. Quite the opposite, sometimes.

zcid• 14 years ago

It's quite likely that humans need conflict in their lives to feel complete. The area of evolutionary psychology points strongly in that direction as does a subjective observation of our history.

I find online wars to be much more favorable than actual bloodshed. Even an occasional meltdown would be much less disastrous than real life conflict.

kiloaper• 14 years ago

>perhaps the next day it will be nuclear reactor facilities that are sent into meltdowns.

Considering some scientists were fearful that Stuxnet would cause a mini Chernobyl-like disaster, we can safety say that's not an unlikely scenario.

http://articles.nydailynews.com/2011-01-17/news/27087828_1_r...

rwallace• 14 years ago

Compared to the ways people used to settle their differences in the days when war wasn't online, I also am enthusiastic about these developments.

stef252• 14 years ago

It's very cool from a geek / technological point of view but I can't help but think that non-lifesaving technology ultimately brings us little good, if you look at the big picture.

Tossrock• 14 years ago

"Lifesaving" is a pretty nebulous concept. Does a plow which enables higher crop yields and thus less starvation constitute as life saving? Or a weather satellite, which allows prediction of rain patterns and more efficient irrigation usage? Modern technology is all interconnected, and only a few extreme leaf nodes could be unambiguously declared non-life saving.

itmag• 14 years ago

Yes, we live in the cyberpunk future.

"High tech meets low life".

godfreykfc• 14 years ago

I find this theory by a commenter on the original Kaspersky blog post very interesting. I certainly don't really have the knowledge to judge if it has any merits, but I still find it amusing nonetheless.

http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...

nikcub2• 14 years ago

They learnt from watching all the research firms reverse engineer Stuxnet and eventually stop it. What they are doing is obfuscating the output. If you look at a default DLL or EXE build from VS it is amazing how much information is included that helps you attach a debugger and work out how it works.

The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm using black-box reverse engineering tools to figure out what the research guys will work out when they eventually find it in the wild.

This has worked so well that Kaspersky think that the authors actually invented a new language, when it is likely still just C++, some machine generated code, some obfuscator tools (game makers have been using them for years to stop crackers) and likely manually changing the outputted assembler.

jberryman2• 14 years ago

> The authors learnt from the Stuxnet experience and I wouldn't be surprised if they are not testing their own worm using black-box reverse engineering tools to figure out what the research guys will work out when they eventually find it in the wild.

Don't they mention that these components were floating around in 2007?

nikcub2• 14 years ago

Where does it say that? All the references are to 'Duqu Framework', which they recently found, I may have missed something

They also completely rule out C++, C etc. when what they should be ruling out is C++, C compiled with a standard VS compiler (or an easily recognizable compiler). It is silly to completely rule out C++ and C just because they don't immediately recognize the output and because it doesn't reference anything else

gaius2• 14 years ago

In the old days on the demoscene there were utilities called packers and crunchers...

akx• 14 years ago

Still are:

http://www.farbrausch.de/~fg/kkrunchy/

http://www.crinkler.net/

etc.

petermcd• 14 years ago

In my best Commander Tigh voice: "Looks like exactly the kind of code a Cylon would write, to me."

wololo• 14 years ago

related: an anti-reverse engineering tool at microsoft called "warbird" (http://forum.doom9.org/archive/index.php/t-130166.html, search for warbird)

prajesh• 14 years ago

MASM32

http://www.infernodevelopment.com/introduction-masm32

http://www.opensc.ws/asm-sources/11120-masm-simple-memory-co...

spullara2• 14 years ago

I like the idea that it is an OO language that forgoes its own runtime library and instead uses the Win32 API as its native library. This would be a great language to write viruses in -- perfect for just glueing together APIs and doing some very small scale business logic without having to learn C++.

DaveMebs• 14 years ago

Anyone writing a virus already knows C++.

spullara2• 14 years ago

Sorry, anyone who is writing the "business logic" for a virus. Someone else might write the exploit.

beza1e1• 14 years ago

Looking the assembly I see two things: (1) no name mangling. So either this was lost in the decompilation/deciphering phase by the Kaspersky guys or mysterious language does not support method overloading. (2) the assembly looks reasonably tight and optimized, so a solid code generation backend (GCC,LLVM,MSVC,...) was used.

Especially because of the name mangling i was thinking of Vala [0]. However, Vala relies on GObject and does probably not work on Windows. Anyways, I guess it's an OO language compiled to C in an intermediate step. This would explain (2).

tlrobinson2• 14 years ago

I've seen the theory that Stuxnet/Duqu was developed by a state thrown around a lot, but what's the actual evidence?

It's not particularly hard to write a simple programming language. Worms are very specialized pieces of code. It doesn't seem that crazy that someone would create a language tailored for worm development.

JanezStupar• 14 years ago

Considering the facts that are known (e.g.: http://www.digitalbond.com/2012/01/31/langners-stuxnet-deep-...) it is nigh impossible for Stuxnet to be commissioned by a nongovernmental entity.

The sheer complexity is off the charts. Stuxnet's sophistication and complexity is an cybernetic equivalent of Manhattan project. E.g.: As a domain expert on industrial automation of this kind Langners states that whoever created Stuxnet _had to have a testing facility_. How many hackers do you know who build uranium enrichment centrifuges to test their cyber attack tools?

Yeah thought so.

Edit: TL;DR: There are two pieces of evidence. No.1: Motive, No.2: Sophistication and complexity.

jgrahamc• 14 years ago

It might well be a macro language and not compiled. For example, HLA (http://en.wikipedia.org/wiki/High_Level_Assembly) has many of the features that are present here. It has its own library functions, objects/classes, and produces code that looks bit like it was compiled.

logn• 14 years ago

ahh, that's assembly

Marwan• 14 years ago

To me it seems just Kaspersky are advertising their product, nothing more.

ekm2• 14 years ago

Someone in an earlier post had claimed it is MASM32

Kaspersky: Duqu Trojan uses 'unknown programming language'

Related Stories