Carberp Source Code Leaked

https://threatpost.com/carberp-source-code-leaked/

by yelnatz • 13 years ago

74 44 13 years ago

threatpost.com

ccarter84• 13 years ago

D*mmit. Guess I finally should break down and burn a linux bootdisk for banking.

lifeguard3• 13 years ago

Ahhh, but what system can you trust to burn the linux boot CD on?

al1x2• 13 years ago

Not to mention by the time you burned it it would be well out of date (security patches). If you're going to go that route you'd be better off buying a USB stick with a write-lock (Kanguru sells some).

Wingman4l73• 13 years ago

Are you saying this software can inject malicious code into a disk image and/or falsify the integrity report if you look at the md5 checksum of said image?

dinkumthinkum• 13 years ago

Yeah but if you go this far, how could you ever trust the bank's security?

SmokyBorbon• 13 years ago

A Linux boot CD would be secure but I think it's awkward to have to reboot your computer all the time. I use Linux but I have stopped using my computer for anything like banking. Instead, I use my bank's app on my iPhone or iPad neither of which are jailbroken.

gcb0• 13 years ago

Just hope you never open the wrong PDF... Or hope that the app is using SSL correct.... Or, nah, forget it. too much hope goes on in using a closed source from a company that does not disclose nothing. thank you.

al1x2• 13 years ago

Or break down and invest in a VMWare license, and run everything (_everything_) in a virtual machine.

spindritf• 13 years ago

You can get that for free and designed for security: http://qubes-os.org/trac

unimpressive3• 13 years ago

I tried to find an article about an attack against virtualization that used some CPU trickery to spy on everything the host computer was doing. (Including other virtual machines on the same host.) Sadly I couldn't.

So here are all the tabs I opened during my search instead.

http://www.kb.cert.org/vuls/id/649219

https://www.scmagazineus.com/Altor-Networks-Altor-VF/Review/...

https://www.juniper.net/us/en/products-services/software/sec...

http://news.cnet.com/8301-13846_3-10395695-62.html?tag=mncol...

http://www.itworld.com/security/80289/securing-your-virtual-...

http://www.symantec.com/connect/blogs/infographic-what-small...

A quick look at these shows them to be wholly not what I'm looking for. (And wholly unfit for HN I might add, which is where I got them.)

If anyone out there has a link to the vulnerability I'm thinking of (it was on HN at one point), or useful information on securing virtual machines against breakout malware, that would be awesome.

reeses• 13 years ago

Make sure the media don't come with a little surprise. :-)

vichu• 13 years ago

Out of curiosity, where could one actually obtain this source code?

colonelxc• 13 years ago

See this thread:

http://www.reddit.com/r/netsec/comments/1h1lcs/carberp_sourc...

yelnatz2• 13 years ago

Here https://github.com/hzeroo/Carberp

frozenport2• 13 years ago

$40,000 dollars sounds cheap

driverdan• 13 years ago

Really? How many hours do you think it'd take to write something like this?

yelnatz2• 13 years ago

botnets make that much everyday

SeanDav• 13 years ago

It is absolutely not about the hours taken to write it, but the skill and knowledge required.

How many hours does it take a doctor to remove your appendix? Is that a relevant metric to judge or place a cost on?

flyinRyan• 13 years ago

You need to read up on how capitalism actually works. It doesn't matter if the thing was written in 30 seconds. The price comes from the perceived value of it.

siddboots2• 13 years ago

$40,000 is ridiculously cheap when you realise how little effort can go in to building, say, a master-data management software, which licenses for many hundreds of thousands per year.

Or, consider the average salary of a programmer with enough operating systems knowledge to write this.

But then, supply and demand is a strange thing.

scrapcode• 13 years ago

I don't understand how people comprehend this shit. Not only is it malicious, it's absolutely hideous.

pvnick• 13 years ago

Shitty coders with shitty morals write shitty software for shitty people

siddboots2• 13 years ago

It might not read quite like the poetry, but this is definitely not shitty code.

Of course, I agree with you completely wrt their morality.

flippyhead• 13 years ago

Some times I feel like the world I live in is from a science fiction novel.

rplacd• 13 years ago

I'm sure all the tropes exist today in some form or another (and they needn't be products of the new millenium, either - I've been seeing reportage from Naipaul's cramped Bombay well since the 70s, wrought out of an incredible amount of tiering and complete alienation between the tiers) but we consider them individual failures of society, and god knows if we'll ever suspend the ideals from our rhetoric in order to assemble the full enchilada.

huhtenberg• 13 years ago

Bootkit alone is probably worth $40k - https://github.com/hzeroo/Carberp/tree/master/source%20-%20a...

The code looks better than a lot of commercial kernel code of comparable complexity, and it is complex. From readme -

--

Bootkit is a driver for loading other drivers at the OS boot time. Driver is loaded before the initialization of NT kernel (i.e. before the start of the PatchGuard) and it can patch arbitrary kernel code. The driver gets launched before every other drivers, including the boot-time ones, and it can monitor and control their loading. No digital signature is required.
Supported Windows versions - from XP to W8 inclusively.
Supported platforms - x86 and amd64.
Boot-loader works with all types of NTFS partitions.

The code is metamorphic, it consists of several blocks that are randomly rearranged with each build. The IPL (initial loader) code is encrypted and it is incrementally decrypted during the execution. Considered together, this means that each build of the bootkit is binary unique. The driver is also encrypted when stored on the disk and it is decrypted by IPL upon loading.

--

All in all, this is quite a leak. Very few people can code something like this and it's a unique chance to peek at and learn from their work.

slacka• 13 years ago

code looks better than a lot of commercial kernel code

Sounds like we need another of Fabien Sanglard's source code reviews:) Normally I'd stay away from this sort of thing, but if it's a good as people say, I might have to check it out myself.

shin_lao• 13 years ago

Does it go around W8 protected boot? From what I understand it cannot.

But how it goes around the signature requirement of drivers is very clever.

mmcnickle• 13 years ago

What is the legality of selling this as opposed to using it? I assume it's legal?

Carberp Source Code Leaked

Related Stories