Slashdot Mirror
Sober Code Cracked
An anonymous reader writes "The algorithm used by the Sober worm to 'communicate' with its author has been cracked. According to F-Secure, it can now calculate the exact URLs the worm would check on a particular day. Mikko Hyppönen, chief research officer at F-Secure, explained that the virus author has not used a constant URL because authorities would easily be able to block it. From the article: "Sober has been using an algorithm to create pseudorandom URLs which will change based on dates. Ninety nine percent of the URLs simply don't exist...however, the virus author can precalculate the URL for any date, and when he wants to run something on all the infected machines, he just registers the right URL, uploads his program and BANG! It's run globally on hundreds of thousands of machines," Hyppönen said. Sober is expected to launch itself again on January 5, 2006."
It said "lol no it's not a worm"
Feel a bit embarrased, but I am impressed. I think that's fairly clever programming - why do talented people waste their abilities on viruses?
- Greg
Start a happiness pandemic
Why else would he choose a date that coincides with the 21st anniversary of Richard Stallman's starting the GNU project?
http://en.wikipedia.org/wiki/January_5
Jesus saved me from my past. He can save you as well.
Let's award the Sober Virus writer a patent. I think he'd qualify.
Why on earth did they release this information? I can see telling the date of the next attack, but explaining how the author communicates with the virus just seems dumb. It doesn't help anyone except for the guy who knows that his methods have been spotted. Now you know that if he decides to upload to one of his websites he is going to assume that he is going to be tracked. This just means that he is going to make sure he is covert in doing it. If they had withheld this information, they might have been able to catch him in the act without him knowing and busted the little fascist shit head.
why would they publicize this? Wouldn't it be prudent to wait for the 5th January, run the same algorithms and check the URLs, and nab the perpetrator?
So they've figured out the algo, and while I haven't RTFA, i assume the domains don't exist yet either.
If that's true, what's to stop say symantec predicting a domain for a particular date, taking the domain, and putting a disinfection program up.
And after that, the feds can install their own rootkit to spy on you...
"According to F-Secure, it can now calculate the exact URLs the worm would check on a particular day." - wouldn't that be possible by just running the worm in a sandboxed computer, with the computer's clock set to some future date? Of course, understanding the code may reveal other hidden features, but if you only want to know what the worm will do tomorrow, you can just try it out.
My first impression was that not only did they tip thier hand, but now everyone and their dog will attempt to post code, and that this was a stupid idea. Thinking on it now, this very well could be an excellent method of trapping more then one shit head at a time.
Publicize the information so that other people can also figure out the algorithm. Don't give it away, just let out of enough so that a dedicated person can reach the same conclusion. Now just wait and nab every single bastard dumb enough to try and post code for Sober to get. While you are at it, switch off every website in question when its time to upload comes up. Not only do you cripple the virus's ability to upload, but you catch everyone stupid enough to try and abuse it.
Granted, catching someone based off domain registration probably is not trivial, but I wouldn't be surprised if the feds have something up their sleeve.
Call me paranoid, and this may just be a press release to drive traffic to a company, but I see the day coming when small packages pack a big punch.
I'm actually a bit suprised it hasn't happened yet.
Caption This
Register one of the URLs and post some code which, when executed, stops the worm executing. Rinse. Repeat.
Pinky: "What are we going to do tomorrow night Brain?"
Brain: "I would tell you Pinky but this 120 char limi
Can we use this discovery to distribute a cure?
I.e. we register one of the websites that Sober checks, and put a Sober removal tool on it. Come that day, Sober would download the file and delete itself without any user interaction.
Problem solved.
...namely that he isn't a multinational corporation and that the patent wouldn't fuck over everyone, er I mean wouldn't protect innovation...
~HTP~ Hug that tux
Hay guys I have a gr8 idea, why dont they just put a prog at the urls the virus checks, which an infected coputer can run and it will delete the virus!!
+5 informative
...should be forced to use open source.
one is supposedly http://it.slashdot.org/comments.pl?sid=170643&thre shold=1&mode=thread&commentsort=0&op=Reply
:)
It posts trollish looking messages and chats to you in IM.
Personally, I usually just chill while connected with ethereal running, then connect back to the PCs backdoored by the viruses that are trying to infect my honeypot on tcp/135. Then a simple netstat will show you an established tcp connection back to the IRC server the virus is using to announce itself to the author (not to mention about 500 connections SYN-SENT or ESTABLISHED to PCs being infected/probed, also a good source for other infected, backdoored PCs. You do know what is attacking you and what tcp backdoor it runs, right?) You can usually spot that connection, it has a high TCP destination port, whereas the normal vector port is 135/137/139. It's really sad to see thousands of PCs aleady announcing themselves to the author on that IRC channel as, "Hey come on over, I am running W2k|2XP. I am XP200453." And there is no one there to give me +OP privs!!! Batrastards!!! I could echo 'you are hacked please visit windowsupdate.com'> the startup folder all I want for days to each one of them to no avail... or echo ''you are a moron, too stupid to own a computer, put it back in the box and yadayadayada....
I wonder what I would do with a beowulf cluster of networks of hacked (i.e. unpatched windows) PCs. probably echo the same message in the same fashion as above, yet, alas, I am seriously lacking in motivation and spare time. (q.q.v 4. Pr0F1T!!!)
so little time, so many IP addresses, so many ignorant users.... so many clever, clever coders...
The only way they can make money is from a rival company wanting the worm to take down their competition, or a rival country in some cases, wanting to take down a lot of a country's infrastructure based on the net. We're all familiar with the hackers the russian government hired to try and rip down the internet, but it is often attempted with worms too
~HTP~ Hug that tux
to not use software that is so easy to get foreign code to execute on. I feel a warm Slackware moment coming...ahhhhhhh.
Isn't the authorities being able to block a URL a problem? If authority means "Software I've willingly installed on my computer to block malicious URLs", then good, fine and dandy. If authorities means the government, I'm not so keen about that possibility.
paintball
Hmm... If they can predict forward in time what sites Sober will seek, can not they also look backward in time to see what sites the worm sought in the past ? If so, could they not then check the registration records for each of those sites and... find the author?
I have often wondered why we haven't seen the emergence of worms with truly spectacular levels of sophistication. Nearly every worm / virus is small presumably so that it can spread quickly in limited bandwidth situations. The limited size means limited sophistication and sometimes flaws in the design or operation.
To the best of my knowledge no one has developed a worm with fully pluggable attack verctors and pay loads and automatic updating. An attack from such a worm would be all but unstoppable because there would always be a huge user base from which to start an attack. The attack would go like this:
Perhaps someone is already doing this, I don't know. It seems like a natural evolution for viruses though. A sort of virus P2P system so that the virus network can respond to attacks. You could even build viruses that knew the network was under attack and hid or destroyed themselves.
BTW I'm not a virus writter.
I used to have a better sig but it broke.
I find myself in the unusual and possibly unique situation of agreeing with other people on Slashdot.
It would have been better not to release this information. Now the author knows the game is up. Unless they have already traced him from some of the previous URLs, which I doubt.
So why release it then? The AV company just couldn't resist jumping up and down and showing everybody how clever they are. AV is more about marketing than technology anyway.
The thing is, I bet this algorithm wasn't even that hard to reverse engineer. I mean, I'm not saying that I could have done it and I'm sure most of you couldn't either. But to someone skilled in the black arts of disassembly and debuggery (if that isn't a word it should be), it would probably have been fairly trivial. At the end of the day, Virus authors usually aren't that bright. You can obfuscate and encrypt your code as much as you want but at some point it still has to executed. Most of the techniques are well known and I doubt this idiot invented any new ones.
How do they or anyone of us know it's going to be expected on that date? Nobody can predict an outbreak because there is never a set time for one. If the virus author can change the date he would. Like they say always expect the unexpected and what was expected is deemed to be better or worse than it was intended to be.
Gets sued by virus writer. :)
...living in countries where employment opportunities may be limited (I'm thinking former Soviet Bloc, Pakistan, India - countries with strong traditions in mathematics/sciences.) There is also potential for a similar thing to happen with nuclear weapons in some of these countries, which is a good bit scarier (as indeed did happen with Pakistan, although not in that case due to a lack of employment.)
If you think upgradeable viruses are bad...wait until you see computer
viruses self-mutate and evolve. Laugh if you want...it will come one of these
days.
As the get 'smarter', someday, computer virus and worms may become life forms. It's no magic these have been called lifre formes already.
Tis is an unreported, unknown new life form Sir. We should not destroy or interfere with itx existance due to The Prime Directive.
Léa Gris
"Drunk's code cracked."
"To be is to do." --Socrates
"To do is to be." -- Aristotle
"Do-Be-Do-Be-Do..." --Sinatra
nothing to see
Hopefully Sober gets drunk on New Years Eve and doesn't become Sober Until after the 5th. Even better yet, maybe Sober will get alcohol poisoning and die.
~Later~
The Sober virus author can precalculate the URLs. We wanted to be able to do the same thing. So we cracked the algorithm. This enabled us to calculate the download URLs for any future date. In fact, we did this already in May 2005, and we informed the local police in Germany as well as the affected ISPs. But we didn't want to talk about it publically then - we didn't want to fill in the virus writer on this. But he must know this by now.
Read the F-Secure blog.
Or read my previous comment.
F-Secure didn't simply crack the algorithm yesterday.
The revolution will be mocked
Seriously, the article's not that long. And if you read it, you'd know why the worm won't reveal future dates. Hint: it has to do with atomic clocks, and time synchronization.
(Yes, yes, it could still, technically, be sandboxed. But doing it this way makes determining URLs that much easier.)
1.) Assuming the author(s) is(are) paying attention to happenings on the internet, he would be an idiot to actually try to put anything on those domains for that date (assuming there isn't anything there yet). If he does, I would guess that he would be as good as caught...well...maybe...I guess it depends on how well he covers his tracks when uploading his intended payload.
2.) Both of the linked articles urge SysAdmins to block the URLs they have listed, but I HIGHLY doubt that most of the infected home users will do so, or even know how to, so that will leave a lot of machines trying to connect. Can the URLs be blocked at the ISP level?
3.) Going with the parent post's idea, might it not be a good idea for the authorities to set up those URLs now, and put removal tools on them (assuming they can be automated and it can happen in the background)? It seems to me that any machines still infected when that date hits would be automatically cleaned and the problem would be solved on the first day...
4.) Or, if it is even possible, have the ISPs monitor for requests to those URLs (while blocking them), and if they receive requests for those URLs on that date, automatically send an email to the account holders of the IPs that are trying to access the URLs informing them that their machines are infected with Sober and provide instructions (and software) on how to remove it? Of course, this requires cooperation from a LOT of ISPs, but it doesn't seem completely impossible. Of course, this idea also depends on the users to take action to clean their systems and we all know how well personal responsibility is doing these days...
5.) However, perhaps the ISPs can monitor requests for the URLs that Sober will request, and then perhaps start disconnecting users who don't clean their systems after being warned.
Anyway, just some thoughts...but I see no reason for the net to be rid of Sober after the first day (or first month going by 4 and 5 above) of activation...
Of course, I don't know a lot of details about how these things could be implemented, so take it with a grain of salt...
"Empathise with stupidity, and you're halfway to thinking like an idiot." - Iain M. Banks
Some people do constructive things for that, others do very destructive things.
It's the rush of having made a difference in this world that drives both categories of people. Some sadly seem to like hiding and laughing, some others prefer to do creative things.Once you're into adult hood, being a puppet master online starts to lose it's charm and you want more bragging rights - which is one of the thing that drives some h4x0rs back into the straight and narrow path of goodness.
Quidquid latine dictum sit, altum videtur
Ok, so, it's /., we don't usually RTFA, but those are the domains:
http://people.freenet.de/
http://scifi.pages.at/
http://home.pages.at/
http://free.pages.at/
http://home.arcor.de/
not really "alphabet soup with a TLD suffix", uh?
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
Apparently F-Secure reverse engineered this virus. So now the author can sue them, based on the DMCA, and MAKE MONEY FAST. :)
What a wonderful new "Get Rich" scheme this provides.
As it clearly says in F-Secure's blog, they cracked this in May. They're only going public now. They've informed both the ISPs affected and the police. It is very unlikely that anyone will be able to register those accounts - if they do, they'll probably be talking to the police.
Does my bum look big in this?
under what license was the virus published? as a company they have to respect copyright. what would f-secure say if someone would have done this to the viruses they have developed... er, sorry, i ment anti virus software... ofcourse...
Well... in my paranoid conspiracy theory, I think it may be one of this:
...
- The worm author is hired by the AV company (as I think a big part of virus coders are...)
So, the AV company told publicly and then he knows "he should stop registering urls..."
or
- The AV company didn't break the algorithm, but lied. Them they make the virus unefficient...
well I dunno, just paranoid stupid thoughts after a non-slept night.
#1
#2 Please explain why the second posting, stating the obvious content of the previous posting, seems to get the credit for the idea?
--Anon--
Or the worm carries a public key and monitors Usenet for new exploits signed with the corresponding private key, then distributes them to any other copies of the worm it knows about using a gossip algorithm - only a few copies need Usenet access and the attacker can post updates from anywhere.
Or each copy of the worm scans the local browser history for domain names, concatenates each domain with the date and its own IP address, hashes it, and requests the root web page from the domain if the first byte of the hash is zero. This means each copy scans a different part of the namespace, the area scanned changes each day, and the area scanned matches local usage (less suspicious and harder to block). If one of the copies finds a signed update, it propagates it to the other copies using a gossip algorithm. The attacker doesn't need to choose a domain in advance - when he wants to distribute an update he just cracks a random website, inserts an HTML comment containing the update into the root page, and waits for the worm to pick it up.
The Jan 5 URL is said to be www.windowsupdate.com
Viruses are bad. Nobody can argue that. And I'm against writing them. But viruses have done something good: people started to think about security of their systems and their data. What would happend if there are not so many viruses? Most people wouldn't even know that their computers are vulnerable, and that would mean a lot of secret data goes to black hats. This way even my father knows that he must be protected. http://www.aids.org/
Im still going to stick to my old protection
"In the game of life, someone always has to lose. To me, if life were fair, that someone would always be Oklahoma." -DKR
see topic
"Why did F-Secure (and other AV researchers) have to cryptographically crack the code? Couldn't they simply have advanced the clock on their PC, and empirically snoop which URLs the virus would check?"
Well, if the guy used a good pseudo-random hash (i.e., based on the timestamp), we don't know (yet) how to predict what a random day will create. If this weren't the case then you could easily predict what a password was based on the hash value. What the researchers are doing is the other way around -- knowing an input value (i.e., the date), they can now know what the output value (the URL) is going to be.
Sober cracked code, and I don't care. Sober cracked code, and I don't care. Sober cracked code, and I don't caaaaaaaaare. And the hacker's gone away.
(Note: I apologize to anyone who is aware of the origins of the song I'm parodying.)
The problem is an inability to block all potential URL registartions a worm might generate. By utilizing the system clock as a seed, there could be google-zillions of URLs. http://www.67539474c54ff91620.com/ anyone?
Why not use this information to post disinfection code on the next sober trigger date? That seems like the best use of this information since the author has probably already been tipped that he/she can't post their own code anymore. I wonder how many sober infected PC's are still in the wild? Cheers,
And the point is that they could already do that, with this simple algorithm:
get url (date):
set computer date (date)
run Sober worm
see what URL it uses
return that URL
Of course you could probably extract the portion of the code that does the generation and just jump to it.
Yeah you could spoof the response from the timesever, but simply cracking the code is far more elegant.
pi = 2*|arg(God)|
The sober author should have included a Eula. "By using your computer, you accept the terms and conditions located at C:\eula.txt"
& China & India groups might be using surepticious quiet entries to gather up all sorts of intellectual property secrets so they don't have to invent them "in-house".
i think its great, if your smart enough to create something like that, not worth jail, but, would look good on your resume
Why did F-Secure (and other AV researchers) have to cryptographically crack the code?
I didn't see any mention of cryptography in the article: it just sounded like plain old reverse engineering.
program
Stupid colonists! (Give it back and apologise, I say.)
Kids viruses are bad. So are jewish people. Heil Sober!
Now that they've revealed how to do this... Could someone now register said URLs before the virus author does and thus wrest control of this massive botnet? Or, on the other hand, could a company like F-Secure register one of the URLs to point to an autocleaning Sober scan program?
I guess it's a race!
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
- http://people.freenet.de/gixcihnm/
- http://scifi.pages.at/agzytvfbybn/
- http://home.pages.at/bdalczxpctcb/
- http://free.pages.at/ftvuefbumebug/
- http://home.arcor.de/ijdsqkkxuwp/
Can these companies be held to any type of punishment for allowing this to happen over their domain? Is there some type of regulation that applies for allowing your site/service to be used to replicate and/or update malware and viruses?Evil Walrus >83=
Took you long enough. I'll bet DVD-Jon could have done it over the weekend.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
...and see what URLs the thing will try to communicate to "on the particular date in the future"...
The unique method of using a random URL was too tempting for the author of the Sober worm. An international patent search reveils the method is patented by a Mr. ....
I use a Linux machine for a firewall. It monitors and filters all incoming and outgoing IP packets. If I deliberately infect a windows machine, I can tell what packets are going to where. I can even redirect some of these packets to a computer I control. That way. I can control malware and what actions it takes.
Once this is done, I can block, unblock, or redirect ip packets as I see fit. I run a network which has about 20 Windows based computers, and only one computer on the network has antivirus protection, yet there has been no malware infections. The reasons for this is simple.
1. I set firewall policies that blocks idiot users from all outside sites and unblock sites only for specifically requested site (if appropriate).
2. My email filter defangs all attachments unless the file extension is specifically exempted from the policy.
3. I also have disabled the Windows Autorun feature, and I have also restricted privileges on Win XP and 2k computers so that people on my network also do not have admin access to their computers by default.
4. I give each user an instruction manual on computer security and why they should follow certain security practices. I assume that people will read this manual and follow absolutely none of the instructions. In other words, I assume that every user is a clueby until proven otherwise. I have been known to send people fake mail in order to get them to attempt to do things that go against the instructions in tha manual. If users fall for the s.e. and do these things, they remain in the idiots catagory until I have the inclination to test them again.
5. Software applications that are not specifically needed on each computer are removed.
6. Firefox is used as the default browser and Thunderbird is used as the default email client. The Outlook Express email client is removed from any computer that contains it.
7. The Internet zone setting in Internet Explorer is set to the highest level with just about everything forbidden.
8 Internet Explorer may only be used to display essential work related websites that will not run under any other browser.
These rules keep my network at work secure.
January 5, 1961: Mr. Ed debuts
-- source: Wikipedia
Also on January 5th:
1781 - American Revolutionary War: Richmond, Virginia is burned by British naval forces led by Benedict Arnold.
1900 - Irish leader John Edward Redmond calls for a revolt against British rule.
1914 - Ford Motor Company announces an eight-hour workday and a minimum wage of $5 for a day's labor.
See more:
http://en.wikipedia.org/wiki/January_5
Perhaps they should just figure out who the author is and then let the virus upload code to all those computers to spam him (or her) with an assortment of valuable offers.
He could route the upload packets around the globe a dozen of times before the last system finally uploads it to the web site.
I'd rather all Windows computers in the world stopped working. Wipe the harddisk of those imbeciles and take over the net. It was built by geeks, it belongs to geeks. Windows shitheads? Who cares about them?
I doubt that this code was cracked for 'interoperability'. So, is this legal under the DMCA?
why dont they just put a prog at the urls the virus checks, which an infected coputer can run and it will delete the virus!!
Why not, indeed? Disregarding the possible ethical issues of whether it's OK to run code on someone else's computer, [b]many[/b] people did exactly this when the Code Red worm was making its rounds. I remember seeing code that would let Apache "strike back" at the attacker, remove the worm, and patch the vulnerability.
I'm not sure why the parent was modded funny; I almost modded it insightful, but then decided I'd rather remind people of relatively recent history.
Snicker....
This seems like just the kind of intelligence information the authorities could have used to find this twerp. Now that the cat's out of the bag (I'm sure he reads /.), it's kind of useless.
you could spoof the response from the timesever, but simply cracking the code is far more elegant.
I guess it depends how you define elegant. It'd say elegant means a small simple solution, an economy of effort. A small graceful judo move that turns the enemy againt itself and brushes away the most elaborate defenses.
A few deft strokes of the keyboard to feed fake date packets to the virus and it doesn't matter what defenses are in place, it doesn't matter how complex or powerful those defenses are. You turn the virus against itself and let it do the grunt work for you.
On the other hand elegant solutions tend to be very specific and focused. If you want to understand the virus completely then you need to do the grunt work of disecting the whole thing, and you must fight to defeat each obstacle placed in your way. Brute force overpowering of the enemy. Not elegant at all if it's evil code.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
I would, if I had the algorythm, generate past URLs and check into the registrations from those. At some level there is a trail as these domains were paid for.
Even if it is a ddns registration, it points to a computer that may be abe to be tracked down.
Sober author hired by F-Secure.
Don't take life so seriously. No one makes it out alive.
Register these precalculated urls and upload a program that tells the zombie computer to firewall off every connection to the internet. Hell notify the user with a nice pop up while you are at it. Then the user will wonder what's wrong and attempt to fix it hopefully.
And in all honestly they really shouldn't have disclosed this information.
IMAGE VERIFICATION IS EVIL!
Sounds to easy, so now higly talented people just put their infected computer a day forward in time and can predict the next attack ?
I know you're out there. I can feel you now. I know that you're afraid. You're afraid of us. You're afraid of change.
Once because you would mod such an obvious idea as "insightful"; once because you didn't get the joke that the GP is making fun of the Slashdot moderators; and once because you didn't use Preview.
Patrick Doyle
I mod down every jackass who puts his moderation policy in his sig. Oh, wait a sec....
Patrick Doyle
I mod down every jackass who puts his moderation policy in his sig. Oh, wait a sec....
If we know what URL's that the virus is going to try to connect to, we should encourage administrators NOT to block these URL's, register them ourselves and place our own code on them which will cause the virus to self destruct.
The idea of an antivirus-virus is much debited. In the past some have tried to make a virus which goes around patching the exploit on which it came in. Oversights in the development of this antivirus-virus have caused problems in other places (namely on the network infrastructure side.) The difference here is this: we are not USING the exploit, we are merely directing code that uses the exploit to no longer use it. (and to perhaps create a popup message warning the user that they are infected with something) This will create no additional network traffic.
This is of course in the hopes that the virus author did not anticipate this sort of action and make the virus expect some sort of encrypted certificate in the "virus update"
- Greg Costanzo