DuQu Mystery Language Solved With the Help of Crowdsourcing

http://www.wired.com/threatlevel/2012/03/duqu-mystery-language-solved/

by jaryd • 14 years ago

101 35 14 years ago

hsmyers• 14 years ago

Well we already know that crowdsourcing works for funding---that it works for coding is no surprise. The folks over in Bio have learned that lesson. All of which makes me wonder about a future (at least to me) formal mechanism to allow projects to adopt crowds as part of their overall coding methods. Parsing the useful from the cruft might be a pain, but it seems like it might well be worth it depending on the need and circumstances.

RandallBrown3• 14 years ago

Most big open source projects take advantage of crowdsourcing. Firefox and Chrome are two of the bigger examples.

Jach• 14 years ago

HN's previous speculation: http://news.ycombinator.com/item?id=3682280

As for this Wired article, feel free to stop reading after:

> A custom framework allowed DuQu’s authors to meld C code with object-oriented programming.

The rest is just Costin Raiu spewing bullshit.

jaryd3• 14 years ago

http://seclists.org/fulldisclosure/2012/Mar/78

The FD discussion, if you're interested :)

inchcombec2• 14 years ago

Eugene Kaspersky's twitter comment seemed a lot more speculative than anything I heard Costin Raiu say. Exact quote:

"The mystery of #Duqu framework http://bit.ly/w5BrzP <- seems the state behind #Duqu sponsored the development of a new progr language"

I don't even do much programming and I was immediately wondering "wtf?" at that statement. The idea of developing a new programming language just to create a worm seemed far fetched, to say the least. He also mentions, as if it were fact despite that I've seen no hard evidence supporting it, that DuQu was created by a nation state. The whole thing just reeked of alarmist cyberwar nonsense.

jaryd3• 14 years ago

While I agree that it is reasonable to expect trending towards an alarmist reaction, there are significant enough similarities between DuQu and Stuxnet to suggest that the authors of the former had access to the source code of the latter. If you read the W32.Stuxnet Dossier (http://www.symantec.com/content/en/us/enterprise/media/secur...) from Symantec it pretty objectively articulates the complexity and sophistication of the creation of Stuxnet. I personally don't think it's an alarmist opinion to believe Stuxnet had national interest behind it, and so am pretty wary of DuQu until more information is uncovered.

Dn_Ab• 14 years ago

Looks like apaprocki clocked it. http://news.ycombinator.com/item?id=3682531

jgw• 14 years ago

I actually found myself disappointed that it turned out to be something as pedestrian as C on Visual Studio - I thought (hoped?) it would be something really obscure and exotic.

I confess that I'm tickled silly by the whole mystery of Stuxnet. It must have been a fascinating project to work on.

gaius2• 14 years ago

We do now know however that one compiler flag is all it takes to throw off professional, full-time reverse-engineers. That's got to be valuable to someone.

lukeschlather• 14 years ago

Well, to be fair, according to the article it was two compiler flags.

drats• 14 years ago

Wouldn't you expect an exploit to be written in a low level/system level language on the very platform(and associated tool-chain) it is targeting?

crag• 14 years ago

C is perfect. It's low level and compiles on every platform in the world.

I wonder why this "research" hasn't been shut down by various governments. Yet. Unless it leads to a red herring.

unimpressive• 14 years ago

>I wonder why this "research" hasn't been shut down by various governments. Yet. Unless it leads to a red herring.

Because anyone who stepped in to stop it would be basically admitting involvement. Right now the perpetrators are likely exactly where they want to be. Speculated on as a possibility, but unconfirmed.

And unconfirmed they will likely remain.

apaprocki• 14 years ago

Igor's comment on Reddit referenced in the article:

  [–]igor_sk 8 points 9 days ago
  They're wrong, or, rather, they did not express their 
  thinking well. They do add "It is possible that its authors 
  used an in-house framework to generate intermediary C code" 
  [which was then compiled with MSVC], and this, I think was 
  exactly the case. I even found something that matches very 
  closely after a hint over at /r/ReverseEngineering: Simple 
  Object Orientation (for C).

My comment on HN: http://news.ycombinator.com/item?id=3682531

Just saying.. :)

obtu• 14 years ago

In context: https://pay.reddit.com/r/programming/comments/qnyy9/duqu_tro...

bh42222• 14 years ago

If you are an experienced C/C++ hacker, this article will hurt your brain.

RandallBrown3• 14 years ago

Seems legit to me. I've been writing C++ for years and never had to write a constructor...

cecilpl2• 14 years ago

Then I must say you're either not writing very good code, or you're writing C and calling it C++.

troels• 14 years ago

It will too even if you're not. They lost me on the part where they "ruled out Java". No really?

munin2• 14 years ago

this was blindingly obvious to anyone that does anything with compilers and reverse engineering. there are some really big clues: the access to C functions from win32 is direct, with no visible FFI. the generated code has a lot of qualities shared with C code, in terms of control flow and stack usage, and it had a lot in common with the MS C compiler based on how it uses the stack.

that it deceived kaspersky this long is frankly disturbing.

runjake• 14 years ago

Hindsight is 20/20.

It may have seemed obvious in hindsight, but some pretty bright people were looking at it, including compiler people at MS.

If it were truly so obvious, it's a shame you didn't end everyone's troubles when the mystery was originally posted here.

munin2• 14 years ago

I didn't see the discussion on HN :)

it was posted to some (private) mailing lists I'm on, and I posted exactly the same thing there.

nekitamo• 14 years ago

I agree. I personally can't believe Kaspersky were this incompetent. To me the entire thing sounds like a PR play. Just look at all the alarmist headlines they generated.

sendos• 14 years ago

* "So you will never code a constructor directly [in C++]. Instead, the compiler codes the constructor for you [and] basically you lose control of the whole thing"*

Utter rubbish. One wonders how he got to be "director of Kaspersky’s Global Research and Analysis Team" if his knowledge is so limited

evincarofautumn• 14 years ago

This gave me a chuckle too. But hey, if the guy wants to display his lack of C++ knowledge, he can go for it. His skills and experience are probably just in different areas, that’s all.

aercolino• 14 years ago

> It suggests that whoever coded this part of DuQu was conservative, precise, and wanted 100 percent assurance that the code would work the way they wanted it to work.

That limits possible authors to all programmers in the world.

georgemcbay• 14 years ago

You haven't worked with very many other programmers, have you?

timtadh• 14 years ago

Here is the blog post from Kaspersky: http://www.securelist.com/en/blog/677/The_mystery_of_Duqu_Fr...

All of the posts on Duku are pretty interesting. If you have a few minutes you should check them out.

danbmil99• 14 years ago

That clears it up -- it must have been Linus.

http://news.ycombinator.com/item?id=687587

keshet• 14 years ago

"..because, when compiled, it was known to produce code that could be unpredictable."

All the code I write is unpredictable when compiled. Such is the life.

DuQu Mystery Language Solved With the Help of Crowdsourcing

Related Stories