Slashdot Mirror
Sober Code Cracked
An anonymous reader writes "The algorithm used by the Sober worm to 'communicate' with its author has been cracked. According to F-Secure, it can now calculate the exact URLs the worm would check on a particular day. Mikko Hyppönen, chief research officer at F-Secure, explained that the virus author has not used a constant URL because authorities would easily be able to block it. From the article: "Sober has been using an algorithm to create pseudorandom URLs which will change based on dates. Ninety nine percent of the URLs simply don't exist...however, the virus author can precalculate the URL for any date, and when he wants to run something on all the infected machines, he just registers the right URL, uploads his program and BANG! It's run globally on hundreds of thousands of machines," Hyppönen said. Sober is expected to launch itself again on January 5, 2006."
Feel a bit embarrased, but I am impressed. I think that's fairly clever programming - why do talented people waste their abilities on viruses?
Because even though they might be doing something they deem to be nice, running code on someone elses computer without permission is still illegal.
Can we use this discovery to distribute a cure?
I.e. we register one of the websites that Sober checks, and put a Sober removal tool on it. Come that day, Sober would download the file and delete itself without any user interaction.
Problem solved.
I think the best use of this information is uploading a disabling and/or revealing program ("your computer is infected with sober, click next to reactivate it") via one of the sites.
Yeah, because when I get a mysterious popup telling me my computer may be infected I always click "Next."
Granted, catching someone based off domain registration probably is not trivial, but I wouldn't be surprised if the feds have something up their sleeve.
It's unlikely that the URL would be any "easily found" string of characters. I would suspect it's probably alphabet soup with a TLD suffix, but you would be able to catch "likely looking" Sober URLs.
.
Now what you want is for domain registration companies to watch out for said "likely looking" URL and flag it up as suspicious somehow.
Hmm... If they can predict forward in time what sites Sober will seek, can not they also look backward in time to see what sites the worm sought in the past ? If so, could they not then check the registration records for each of those sites and... find the author?
But you can set up a fake NTP source, which is (or ought to be) a piece of cake for any security company.
I find myself in the unusual and possibly unique situation of agreeing with other people on Slashdot.
It would have been better not to release this information. Now the author knows the game is up. Unless they have already traced him from some of the previous URLs, which I doubt.
So why release it then? The AV company just couldn't resist jumping up and down and showing everybody how clever they are. AV is more about marketing than technology anyway.
The thing is, I bet this algorithm wasn't even that hard to reverse engineer. I mean, I'm not saying that I could have done it and I'm sure most of you couldn't either. But to someone skilled in the black arts of disassembly and debuggery (if that isn't a word it should be), it would probably have been fairly trivial. At the end of the day, Virus authors usually aren't that bright. You can obfuscate and encrypt your code as much as you want but at some point it still has to executed. Most of the techniques are well known and I doubt this idiot invented any new ones.
How do they or anyone of us know it's going to be expected on that date? Nobody can predict an outbreak because there is never a set time for one. If the virus author can change the date he would. Like they say always expect the unexpected and what was expected is deemed to be better or worse than it was intended to be.
...living in countries where employment opportunities may be limited (I'm thinking former Soviet Bloc, Pakistan, India - countries with strong traditions in mathematics/sciences.) There is also potential for a similar thing to happen with nuclear weapons in some of these countries, which is a good bit scarier (as indeed did happen with Pakistan, although not in that case due to a lack of employment.)
So people know things to look for when analysing other viruses?
I am trolling
1.) Assuming the author(s) is(are) paying attention to happenings on the internet, he would be an idiot to actually try to put anything on those domains for that date (assuming there isn't anything there yet). If he does, I would guess that he would be as good as caught...well...maybe...I guess it depends on how well he covers his tracks when uploading his intended payload.
2.) Both of the linked articles urge SysAdmins to block the URLs they have listed, but I HIGHLY doubt that most of the infected home users will do so, or even know how to, so that will leave a lot of machines trying to connect. Can the URLs be blocked at the ISP level?
3.) Going with the parent post's idea, might it not be a good idea for the authorities to set up those URLs now, and put removal tools on them (assuming they can be automated and it can happen in the background)? It seems to me that any machines still infected when that date hits would be automatically cleaned and the problem would be solved on the first day...
4.) Or, if it is even possible, have the ISPs monitor for requests to those URLs (while blocking them), and if they receive requests for those URLs on that date, automatically send an email to the account holders of the IPs that are trying to access the URLs informing them that their machines are infected with Sober and provide instructions (and software) on how to remove it? Of course, this requires cooperation from a LOT of ISPs, but it doesn't seem completely impossible. Of course, this idea also depends on the users to take action to clean their systems and we all know how well personal responsibility is doing these days...
5.) However, perhaps the ISPs can monitor requests for the URLs that Sober will request, and then perhaps start disconnecting users who don't clean their systems after being warned.
Anyway, just some thoughts...but I see no reason for the net to be rid of Sober after the first day (or first month going by 4 and 5 above) of activation...
Of course, I don't know a lot of details about how these things could be implemented, so take it with a grain of salt...
"Empathise with stupidity, and you're halfway to thinking like an idiot." - Iain M. Banks
Unlikely, most I have seen seem to be a hacked servers. I saw a log file on an infected PC, I connected to the same server and issued the same commands, but by the time I got there the jig must have been up, not the same PCs/output in the channel. Meaning, I issued the same commands but did not see the pages and pages (and pages and pages and pages, literally thousands) of entries as in the log file of IP addresses and entries like 2K10234 and XP11442. Strange thing is the "IRC" server was still running. I say that cause the commands were IRC like but not full blown RFC 1459. I sent a note to abuse@isp.com. Maybe the author got his list and was covering his tracks, but the goods were already in a log file on the PC. Again, just noticed out of the 500-700 connections open connections (netstat -an |find "ESTAB") on the infected PC one was not to the viruse's vector port, thought I would check it out... took several tries to even get to the same channel. I had to join one channel and then issue a command to join the second channel to even try. Can't remember which worm it was (not sober), but this was a few days after it was announced and thought I would sniff to see how prevalent it was. Odd. The virus descriptions say, "opens a backdoor on port xxx," and I would just try to connect to port xxx after I got connections, sometimes you just get a c:\windows prompt. Very scary, glad I know how to keep my win pc up to date, and run linux otherwise. And I consider that to be an invitation of sorts, as in, "I'm sorry, were you trying to tell me something? Were YOU trying to hack ME? YOU connected to ME. I am only looking out for my own security here."
;) /disclaimer
I really do the echo something > notice.txt into startup folder, hoping the person will take action and realize they are infected... who knows what good that does. I am also a staunch privacy advocate, so nothing malicious (flame-suit on) from my end. mostly dir c:\windows\system32 |find "" to look for recently installed malware. I could care less about your files. That was how I found the log file that had what looked like a complete connection log to the IRC server. Too bad there are not more good commands in windows command shells (usually a virus opens a socket to cmd.exe) or I would kill and clean up and reboot, or even ftp down the patch, not like MS supports that though. (God the good old days of pre-retirement) This happens in internet time, not human time. If someone was really malicious, there is really no way even hundreds of humans could stop it. I take that back, a good hacker (in the MIT sense...) could reconnect back to the machine and issue some commands to shutdown the proc and stop the scanning, but again you are limited to what is at the ms-dos command shell, and we all know how well the anti-blaster worm worked with it's ICMP DOS. But given that a goofball scriptkiddie could connect like I did, maybe that is a good thing (good luck kiddies). Careful what you wish for and all that.
Disclaimer: Really, if I was black hat, would I post with my own account? (laughs hysterically as g-san gets investigated by the FBI the next day). Anyways come get me, I would love to work for you FBI and you could use my help.
Here goes... submit...
Did you mean DMCA?
& China & India groups might be using surepticious quiet entries to gather up all sorts of intellectual property secrets so they don't have to invent them "in-house".
That statment is naive. Biological organisms also have very strict rules that they need to conform, even stricter than computer programs. That is why most mutations are lethal.
Biological virus don't have anything like junk-DNA to mutate into something usefull. This happens because bilogical virus are also constrained into a small size, just like the computer's ones.
The biological virus can spread while mutating because each virus creates milions of descendents with hundreds of different mutations. Just out of luck, some are can spread well. We can do this with computer virus too.
Rethinking email
Actually, that's easier. Drunk people always tell you what they're going to do just before they do it. Therefore theyd actually document something for once.
As unlikely as that may be, it's exactly what we need to rid the world of DMCA like bullshit.