Slashdot Mirror
New Alureon Rootkit Takes Malware To New Level
Trailrunner7 writes "A new version of the venerable Alureon malware has appeared, and this one includes some odd behavior designed to prevent analysis and detection by antimalware systems. However, this isn't the typical evasion algorithm, as it uses some unusual encryption and decryption routines to make life much more difficult for analysts and users whose machines have been infected. Alureon is a well-known and oft-researched malware family that has some rootkit-like capabilities in some of its variations. The newest version of the malware exhibits some behavior that researchers haven't seen before and which make it more problematic for antimalware software to detect it and for experts to break down its components."
Why can't the system be installed on ROM? At the very least, it will boot clean every time...
For justice, we must go to Don Corleone
Oh great, malware coders have learned how to do math. We're boned.
A new version of well-known Alureon is out which has odd things to make it hard to analyze. It's odd, and is not normal and makes it's hard to analyze. It's well known and is a rootkit.The new version is odd and makes it hard to analyze.
We got that after the first sentence, how about actually providing some fscking detail.
Your hair look like poop, Bob! - Wanker.
Comment removed based on user account deletion
Summary says: "The newest version of the malware exhibits some behavior that researchers haven't seen before"
The article says: "In 1999, a new virus, Win32/Crypto, was discovered... Today, in 2011, variants of Win32/Alureon are bringing this old-school technique back to life... Another interesting tidbit is that an initial version of this obfuscator first arrived in our lab in the first half of 2009."
That's kinda stretching the definition of "haven't seen before", which may be true in a technical sense (because they haven't seen THIS EXACT MALWARE before, but they've certainly seen lots like it).
New Alureon Rootkit Takes Malware To Same Level As Before, but With More Obscurity.
Once you have root access, is there really "another level" to take it to?
Something is happening that is new, but we can't describe how or why it is new. We're like Roy Scheider in Jaws: "You're going to need a bigger boat." And you're like Robert Shaw: you just get to work trying to catch the thing. Even though it is big, it's bad, it's silent, it runs deep, you don't have the tools to properly track, capture, kill or otherwise defeat the thing, and you will be dead in 15 minutes at the end of the movie anyway. So just run around and panic. Because rootkits are scary, and strange new exotic rootkits are scarier. Your best bet is to strap on your scuba gear and go hide on the ocean bottom and pee while the real men take care of business. Oh, almost forgot: "Boo!"
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
"We're closely monitoring Alureon to ensure that our users are always protected. In fact, Alureon has been part of the Microsoft Malicious Software Removal Tool (MSRT) since April 2007."
I am putting my full faith and hope in to the Microsoft security team to eliminate it with their latest Malicious Software Removal tool.
I have given up on being paranoid about viruses, and I am much happier now!
He who knows best knows how little he knows. - Thomas Jefferson
Only for major major updates, and it wasn't a pain in the ass. You unplugged the chip and stuck the new one in. Back then it was pretty common for users to hack their Amigas anyways, so it wasn't that big of a deal to open her up and swap it in. The pain the ass was expanding the chip memory by soldering lines to a new socket. I was 12 when I had to do this for my Amiga 500. Worked fine.
If some software is hard to analyze, at some point shouldn't you just give up on trying to figure it out, and elect to never install it? I'd remove this from whitelist consideration and move on to a competitor, long before I'd bother with the trouble of sorting out such a mess.
Some software just isn't worth auditing. If they didn't even try to make it readable, fuck 'em. If you need to run a malware app, there's plenty out there to choose from, which don't fight you. Let Alureon languish in obscurity until they remove their tangledness.
Rootkits, malware, must be Sony.
Why can't someone go all Seal Team 6 on these coder's asses?
I'm sure their Moms could use the basement for something better than hosting these losers.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
Because the current model of downloading active scripts and running them locally would be broken. As well as there would be no method for remote upgrading, bug patching, I mean installing service packs..
I hear that the new version has some behaviors that make it harder to detect and also more difficult to analyze.
"We shall grapple with the ineffable, and see if we may not eff it after all." - Douglas Adams
I also happen to be a PC technician, and I find it tiresome to hear people tirade about how bad Windows is, or how "clueless" users are. Software vulnerabilities are a fact of life, and it's unrealistic to expect average users to tell a fake warning from a real one when they can look pretty much identical.
Here's a car analogy. If I paint a phony detour sign that looks exactly like a real detour sign, stick it up in the middle of a road, and traffic starts diverting down a street of my choice, does that make the drivers stupid or "clueless"?
Even with the best available antivirus software and every available patch, 0-day drive-by exploits will come along, and people will get burned. My approach is to assume that problems will occur, and focus on how to quickly and easily recover from such incidents.
My impression is that the internet ecosystem is becoming so lethal that standalone boxes (especially windows) are on their way out. Even hosted blogs and web sites have a hard time defending against the constant onslaught of spam and exploits. Are we in the last days of the open internet, before moving to a more closed environment where only large server clouds will be able to survive?
I get that this makes it a little bit harder to figure out what the program is about to do (hint: allow it to decode, breakpoint & step), but isn't the point to simply identify that the malware is present? Unless the malware is capable of executing encrypted code on the chip, the code that decrypts the remaining payload code must be stored in plain machine code.
The machine code that initiates the brute force will be identifiable, and a signature can be made. Nothing to see here folks. The shitty encryption system doesn't even use asymmetric keys, and the very fact that it only takes 255 tries for it to brute-force one of its "chunks" is laughable. I mean -- I wrote better cipher systems when I was 12... Are they trying to avoid breaching US encryption export laws?!
Who cares how good it is at hiding its payload if the code that decodes the payload has a fingerprint...
P.S. What really scares the shit out of me is new processor tech that enables public key crypto at the machine instruction level. Not only will the "good" guys use it to "protect" their code from their user's prying eyes, the malware writers will use this to actually design code that has no fingerprints. Each copy will be indistinguishable from pseudo random noise -- So much for "signatures" at that point.
P.P.S. Once you know malware has executed on the system, it's time for a full wipe, BIOS re-flash, and OS re-install -- There is no "removing" malware.
It's pathetic to see all these people with kinda old /. IDs writing that system in ROM can't work because an exploit against the system in ROM would then work everytime.
You guys are lame, so lame to comment such bullshit and it's saddening to see monkeys with + modpoints wasting them on that bullshittycrap.
Crypto can solve this and this is *precisely* the problem Google solved with their Chromebook. Now, of course, Google may have fuxx0red the implementation, but the maths behind the concept are sound.
What you don't get is that the system in ROM makes sure that the computer, at *every single reboot*, will look for cryptographically signed updates.
If an attacker manages to break crypto, then the world at large is fucked up and botnets will be the least of our concerns.
So we consider the math behind the crypto are sound and, using logic, here's what we have: we have a system that, at every reboot, will look for valid (cryptographically signed) updates. If a legit update is found, it is installed.
What does this mean? It means that unless the "r00t spl0it" can fuck up your entire chain, at one point the computer *shall* find a correct, valid update. And the spl0it *cannot* modify the ROM and it *cannot* forever prevent legit update from being found by the system in ROM.
And what shall that update contain? At one point a security patch owning the "r00t spl0it".
Now how hard is that to understand? How comes this sh!t has been known since ages and actually implemented in the Google Chromebook and you still get r*tard here saying that "a r00t spl0it shall 0wn your ROM system everytime"? WTFF? How hard is, say, "minimal system in ROM writing only cryptographically signed update in EEPROM" to understand?
Instead of knee-jerking and bowing to malware authors as if they were going to write an uber-malware, you should start applauding people, like those working at Google, looking for solutions.
Once again: Google may have fuxx0red this particular implementation (I don't know all the details), but that f*cking sh!t is totally doable.
Say a f*cking EEPROM checked from a ROM: if the EEPROM doesn't contain data cryptographically system with a FUCKING key FUCKING written in ROM, then it gets erased, on every reboot. So the spl0it can write to the EEPROM? Big fucking no-deal: that corrupted EEPROM *shall* be erased on the next reboot. At one point on reboot the system in ROM *shall* find a motherfucking security patches patching the r00t spl0it.
How f*cking hard is that to f*cking understand you f*cking r*tards?
-- In the malware?
-- No, in the summary!
-- Bwahahahaha!
Comment removed based on user account deletion