'Stealth' Worm Hinders Sandbox Analysis

Tuxedo Jack writes "The Register reports that the new Atak worm cannot be analyzed or debugged by antivirus companies without quite a bit of work, due to the author being sloppy with his or her code. Windows machines, as per the norm, are the only vulnerable ones, and it still requires user intervention to infect. Perhaps future worms will start including this 'bug' in their releases. We can only hope not." It doesn't sound like a bug at all, from the virus writer's perpective.

Comments

Re:Okay...?

[ePhil_One]

Worm or Virus?

Since they claim it requires user intervention, that would make it a virus, since worms are self-propagating.

Of course, given the accuracy I've come to expect from Slashdot summaries, it could be a new version of MS IE...

Interesting Concept

[pHatidic]

Atak uses a variety of tactics in its attempts to escape antivirus analysis. Its main trick is to check to see if it's being run in a debugging environment. If so, it exits to avoid detection.

Would that make this worm a 'night crawer'?

Badum Ching!

Easy way to be safe

[tomhudson]

So all you have to do to be safe is make sure you've got a debugger running, and the virus kills itself. I guess that adds new meaning to the term "de-bugger" :-)

The 2nd oldest trick in the book

[magefile]

"You're right, it's pure genius - they couldn't guess we'd do that, because only a frickin' idiot would do that!" - paraphrased from (approximately) 3.14 million movies.

Makes for better AV companies

[StickMang]

Maybe this will teach them how to teach outside the (sand)box! Maybe they can harness their synergy with this new paridigm shift into sandbox free thinking.

Ahh, its 1999 all over again :)

Re:Makes for better AV companies

[DA-MAN]

Score: +5 Buzzwords!

geez!

[manavendra]

Just what we wanted - buggy bugs, erm, viruses!

You know something's wrong with the world, when the malicious software itself is flawed..

Re:Script kiddies becoming worse?

[irokitt]

Sounds like a strip kiddy tried to write a virus

Strippers writing viruses? Sounds like a Fox special. And, being your typical Slashdotter without a girlfriend, I have to ask, do you have pictures?

/grammar nazi

Re:Okay...?

[perly-king-69]

Of course, given the accuracy I've come to expect from Slashdot summaries, it could be a new version of MS IE...

...or a dupe.

"HER" code?

[md358]

C'mon, *her* code? Isn't that a bit gratuitous? I mean, we're talking about code here, not a delicious turkey dinner.

Sound familiar?

[captnjameskirk]

1) Contains a "bug", well let's just call it a "feature". 2) Sloppy code, but Hey! it works. Sort of. 3) Run on Windows only. Sounds like every piece of comercial software sold by Microsoft to me.

Elementary, my dear Watson...

[bfg9000]

This piece of code is so sloppy, it's devious

It shouldn't be hard to find the author, he obviously works at Microsoft.

obscurity

[double_ooh]

The code is so bad that they can't read it, so it's insecurity through obscurity?

Re:Hex it?

[vasqzr]

Can't they break it down with a hex editor and see what's under the hood?

You've watched Hackers way too many times.

Dade: This isn't a virus. It's a worm!

Finally!

[teamhasnoi]

Those DMCA violating virus 'terrorists' will be prevented from infringing the copyrights of the poor, disadvantaged virus writers.

This content author has villified every artist who has ever had their work reverse engineered.

This is a great day for copyright, authors, and those downtrodden by IP terrorists!

Hex Value Analysis

[john.mull]

Found embedded in the virus code... 56 42 56 63 72 69 70 74 20 72 6f 58 6f 72 7a 21

Stealth Worm???

[pandrijeczko]

Isn't a "stealth worm" that requires "user intervention" a paradox?

Re:Strange

[Homology]

I've always heard that it takes a very good programmer to write effective and powerful virus. /I>

Not on Microsoft Windows, it seems. From the article it's even better if the virus writer is sloppy.

EULA

[Fuzzums]

A viruswriter should add an EULA to his/her virus.

- You may execute this virus 'as is'.

- We accept no claims of any kind of any or all damage done by this piece of software.

- You are responsible for the consequences of executing this software.

- You are NOT allowed to disassemble the code (DCMA).

- etc, etc..

Re:Okay...?

[darkmeridian]

Of course, given the accuracy I've come to expect from Slashdot summaries, it could be a new version of MS IE...

...or a dupe.

--
This sig is inoffensive.

Re:Strange

[ObsessiveMathsFreak]

Clearly sir, you have never heard of VBA.

Empowering amatuers with sysadmin capabilities since 1993!
Where would you like script kiddies to joyride your computer to today?

Simpson's adaptation

[dfj225]

AV Guy: Man you are really sloppy! Virus Writer: Sloppy like a fox!

Re:Strange

[Anonymous Coward]

I can't tell, are you being sarcastic?

The creator of the Melissa virus left his email address in a comment. What sort of very good programmer uses comments?!?

Re:Clarification, there are 2 issues

[mikael]

The Good news: The virus writer has released a patch that fixes these two bugs

The Bad news: You can't download these patches, you have to wait for them to self-install onto your system.

Re:Strange

[forrestt]

That's because Windows is used to running such code.

I knew it!

[Stevyn]

There is still a way to blame microsoft for this!!! I was getting a little worried there.

Re:More damaging.

[The Conductor]

Wan't a smilar virs targete at slashcoe?

Read the Result!

[Anonymous Coward]

Authorized Researcher Only.

Attachment: result.zip

Re:Strange

[Anonymous Coward]

The creator of the Melissa virus left his email address in a comment. What sort of very good programmer uses comments?!?

The guy who framed that poor patsy for creating Melissa, that's who.

Sloppy code?

[wvitXpert]

Atak worm cannot be analyzed or debugged by antivirus companies without quite a bit of work, due to the author being sloppy with his or her code.

Hmmm... let me guess, the virus is written in such sloppy code that it just blends right in with the Windows code? ;^)

Re:not

[Anonymous Coward]

This is not a very scary idea...

vindication

[sacrilicious]

the new Atak worm cannot be analyzed or debugged by antivirus companies without quite a bit of work, due to the author being sloppy with his or her code.

See, this is what I've been trying to tell my boss: I'm not writing sloppy code, I'm trying to prevent people from reverse engineering our product!

We visionaries are always persecuted.

TurboTax like virus?

[hardaker]

Gee... a virus that does things different when in a debugger or emulator? Sounds an aweful lot like a certain version of Turbotax about 2 years back... Do we have a prime suspect yet?