Hackers Serving Rootkits with Bagles

Iran Contra writes "Security researchers at F-Secure in Finland have discovered a rootkit component in the Bagle worm that loads a kernel-mode driver to hide the processes and registry keys of itself and other Bagle-related malware from security scanners. Bagle started out as a simple e-mail borne executable and the addition of rootkit capabilities show how far ahead of the cat-and-mouse game the attackers are."

Comments

The evolving virus

[ndogg]

I keep waiting for a virus based on genetic algorithms. I'm certain that it's only a matter of time.

Re:The evolving virus

[january]

Agree. This will be a breakthrough, and if anything is a mystery -- then the question, why it hasn't already happened.

Evolving computer programs -- not simple genetic algorithms, but programs that actually "thrive" on CPU time and memory, and compete for these resources -- have been already used to experimentally investigate evolution. Note that there is a serious difference between a genetic algorithm and a truly evolving program. In the former case, the fitness function is precisely defined by the programmer. In the latter, the fitness is just what it is in living organisms -- ability to pass on the genes, or code.

Check out the web page -- http://www.msu.edu/~lenski/ -- of Richard Lenski, experimental evolutionist (bacteria in a test tube + computer), you will find a nice article on in silicio evolution on his web page. The guy has 4 Nature and 2 Science publications only on the topic of digital evolution.

January

j.

Re:The evolving virus

[zerocool^]

If you're talking polymorphic characteristics (in viruses or animals), the phrase you're looking for is Heterozygous Advantage. Yes, I do live with a woman who is going to vet school and who has a degree in animal science.

In computer terms, it's going to be hard for random code variations to produce a useful new code segment on their own, for exactly the reasons you describe - there needs to be "sex", or a merging of two codebases, in order to produce surrogate code.

In terms of animals, however, if I may step on my pro-evolution soapbox... This is what all those people at the Institute for Creation Research and Answers in Genesis never talk about. The natural tendancy in animals (at least, and probably in other kingdoms) is for the offspring of a non-homogonous pairing to be *better* than either of the parents. No joke, this is the way it works. Not all the time, but more often than not.

For example, my wife is pretty firmly against the homogonization of the beef industry onto black angus for meat and holstein for milk. The reason being, if you breed nothing but black angus to black angus, you're going to get black angus, which is good, but it will never get better than its parents. If you're breeding black angus and charolais, however, the genetic tendancy is that the offspring most of the time will posess the best characteristics of both parents (breeding and birthing ease with black angus, better meat with charolais).

Anyway, I have to go fix a dead UPS.

~Will

[Off topic] It's not a worm!

[january]

It definitely isn't, trust me. I'm a ...biologist.

I mean the picture, of course: http://images.slashdot.org/topics/topicworms.gif -- it is an insect larva, not a worm. To be more specific -- probably a butterfly caterpillar.

You want to see a worm? Here -> http://www.desc.med.vu.nl/NL-taxi/ICE/C_elegans1.j pg is a nice picture of C.elegans, The Model Worm (r).

January

I blogged Ubuntu LiveCD to explain to noobies

[ScrewTivo]

I got so tired of explaining it over and over. Ultimate Spyware/Virus Blocker. If you think there is something I need to add or remove then please leave a comment.

My friend is opening up a coffee shop that will have an ap. I will make some copies of Ubuntu for the customers to use.

Now where do I find a dentist for the rootkit I received when I didn't take my own advice :)