Slashdot Mirror
Researchers Seek Help In Solving DuQu Mystery Language
An anonymous reader writes "DuQu, the malicious code that followed in the wake of the infamous Stuxnet code, has been analyzed nearly as much as its predecessor. But one part of the code remains a mystery, and researchers are asking programmers for help in solving it. The mystery concerns an essential component of the malware that communicates with command-and-control servers and has the ability to download additional payload modules and execute them on infected machines."
NSA Property, Keep Out.
The mystery code isn't really much of a mystery- it's just how Duqu communicates with the sith lord.
"That's the way to do it" - Punch
So, we meet at last Count DuQu.
I think we should just cut to the chase and ask George Lucas totell us whether DuQu or Stuxnet shot first.
I kid, I kid...
hmmm yes, your average script kiddie can totally create a custom language and totally stump the entire computing universe. my daughter did it last week while looking for proxies to get around my facebook ban. no government needed!
Learned INTERCAL from Guy Steele in the Comparative Languages course at CMU.
An imperfect plan executed violently is far superior to a perfect plan. -- George Patton
Have they thought about the possibility that this was custom assembly programming and not some high level language at all?
It's in ROT-13 Pig Latin.
I'll take my paycheck in gum, Trident Layers to be specific.
It's iron python.
"If any question why we died, Tell them because our fathers lied."
...and here's me thinking that compiled code has already been reduced to machine code.
Isn't all code self-documenting?
the work of a Culture Mind. Call Mr. Banks.
Somebody obviously knows. They aren't telling due to penalty of losing their job and perhaps going to Federal prison. As they say, it's highly likely it's an in-house language. The resources required to create Stuxnet are said to require a nation or at least a corporation, and a motive which points the fingers at Israel and the USA. If I solve this problem the answer is something like, whoop-de-do, "DuQu is this guy's PhD dissertation applied to malware". Wow. Like, who cares?
that's just a guess
but the level these guys are working at here, something well above script kiddie and slightly below elder neckbeard, it seems entirely plausible to me
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
It's a proprietary framework used at McAfee... DMCA!
Enough of this SMALLTALK this DuQu language is BASIC to understand. It is PICO fast, runs sweet as MAPLE, and I hear is easy to MAKE. Be LUCID and CLEAN - you don't need to wear LaTeX, know a person named LISA, or any other LINGO. To let this FELIX GENIE out of it's DRACO bottle all you need to do it talk to a TUTOR. In the meantime CHILL out and enjoy some JAVA. Now Go, GO!
Objective-Brainfuck or Brainfuck with Classes
If you do what you always did, you get what you always got.
Any sucker can tell it was written in Linda.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Could it be possible that the authors came up with their own language, and/or compiler?
Actually, I'll reverse the joke and gun for +1 Insightful.
Ready?
Literally why does this story even exist? This code takes out nuclear reactors and "researchers ask programmers for help"? Really?! (Does "Ask" imply they want the answer FREE?!)
So the Dept of Homeland Security is busy helping yank down file share sites and they have no time for this?
Ladies and Gentlemen and AI's, this is your answer to why we're spiralling into a mess.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
DHS, conspiracy theories aside, is likely conducting their own investigation into DuQu, the details of which are unlikely to be shared with the general public. TFA is about Kaspersky Labs, an independently owned security firm, asking for help from the general public.
"Duqu" in Chinese Pinyin means "to read (some data)" ... LOL
My guess is that it's probably erlang. It fits all the descriptions of how erlang works. Erlang is used in all sorts of realtime systems, it wouldn't be a stretch to see that it was used in a virus library. Someone that is in the Telecom or Network infrastructure industry might be familiar with Erlang and that type of person might also be the same type of person that knows enough about networks and network vunerabilities to architect a framework for virus distribution.
Literally why does this story even exist? This code takes out nuclear reactors and "researchers ask programmers for help"? Really?! (Does "Ask" imply they want the answer FREE?!) So the Dept of Homeland Security is busy helping yank down file share sites and they have no time for this?
Why would DHS have anything to do with this? DuQu so far hasn't done anything to American interests (in fact, so far as I can tell, it has helped them). The people in TFA looking at the code are Kaspersky: a Russian anti-virus company. They don't even recognize the language the code is written in, much less how it works, and they are wondering if anyone of the billions of people on the Internet knows (specifically, if it is a a specialized language used in some niche industry or something). If no one does, they can be pretty sure it was a custom created language, and proceed accordingly. They aren't asking for someone to do their work for them: they are saying "hey, this look like anything anyone knows?" DHS might be looking at it too, if they didn't create it: but the story has absolutely nothing whatsoever to do with them, in any way. Not even the same continent.
Also, I don't know where you got "takes out nuclear reactors." Stuxnet did damage to nuclear centrifuges. AFAICT all DuQu seems to be doing is stealing data (private keys, actually). Bad for people who get infected, yes. Not like it is causing nuclear meltdowns or something.
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
That clearly looks like perl to me.
They don't know the language? Why are they concerned with the language it was written in? What if it was written in C++ or C on ARM and cross compiled for x86, would it look funky like that? Or is it possible it's compiled in TASM and they are actually looking at a 16-bit code segment where most of them have never seen less than 32-bit code?
I am Bennett Haselton! I am Bennett Haselton!
"Be sure to drink your Ovaltine."
It's ADA..I'll let you figure out which compiler exactly ;)
j.
Getting public help on the problem helps lead them to the creators or supporters. It is a simple way of studying a social network.
I only took a glance so don't blame me if I am wrong, but it looks like the SCADA variant
More info available at http://en.wikipedia.org/wiki/SCADA
Muchas Gracias, Señor Edward Snowden !
DHS, conspiracy theories aside, is likely conducting their own investigation into DuQu
No need for that unless they snuffed the original developer before securing the relevant docs.~
Upward mobility is a slippery slope - the higher you climb the more you show your ass.
This looks a lot like "Spin" from a company called parallax. It's a proprietary programming language used to control their pic and hyperpic processors.
I guess pascal has some -if not all- of the listed features, and there are multiple compilers (and plenty of older versions) to chaos from such as mainstream FPC, Delphi, and some study / experimental.
No, no DuQu does not, and has never attempted to, 'take out nuclear reactors.' That was a different piece of malware.
It would benefit us all - as well as yourself - if before you commented you educated yourself on the subject of the submitted story.
DHS, conspiracy theories aside, is likely conducting their own investigation into DuQu
No need for that unless they snuffed the original developer before securing the relevant docs.~
Hey, everyone makes mistakes. That drone was supposed to have been loaded with tranquilizer darts, not Hellfires. Boy, there were some red faces in the office when we found out what happened.
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
I'm sure he did write assembly. But Object Oriented assembly?
I'm incredulous that you are incredulous. I thought I saw a book about that somewhere. So I walked over to my tall stack of random language books and there it is:
Object-Oriented Assembly Language, Len Dorfman, McGraw-Hill, 1990
I hereby thwack you upside the head.
My other car is a 1984 Nark Avenger.
One of the comments on the page already said that.
I remember I disassembled Forth a lot of years ago.
It comes in 2 flavours: interpreted and compiled.
It relies on RPN heavily.
It's a very compact language, both in source and in compiled form.
You extend the language by using "words", and it's like OOP.
It's one of the weirdest language I ever used.
Yeah it looks like the output from a PLC development kit, the original code might be written in STL http://en.wikipedia.org/wiki/Structured_text.
... it's Java!
Defining Statistics and Social Research
The whole story is miscellanous. We already know the Stuxnet and Duqu authors spoke and wrote ivrit, so there is no reason to investigate further.
If Iran feels like, they can muster say 20-25 of their ex-shah F-14 Tomcat fighters to cover the arse of their ex-iraqi Su-24 supersonic bombers and make a bombing run on the zionist nuclear bomb factory at Dimona, in retaliation for the cyber-attacks and sabotage attacks on the iranian uranium enrichment programme. Not likely to happen though, since Iran lacks the large in-flight refueling capacity required for such a long range aerial attack. They would have to make it a one-way sortie, which would be too much of a material loss for their air force, which cannot replenish its fleet of planes, due to the long-standing international arms embargoes against Iran. They can't even purchase civilian airliners for that reason.
Furthermore, Iran has no allies besides the besieged Syria, since even the russians are duping them nastily and it is really hard to do anything grand without allies or servants (which Tel-Aviv has so much many).
On the other hand, it is silly to underestimate the iranians! They are not arabs, but persians, good maths and their Zarathustra invented the dualistic wisdom, that makes up the core of "divine kabbalah" which the jews admire. It is somewhat paradoxical that jews and persians are not allies today, considering both of them want all arabs annihilated. One would guess many influental jews are already trying to turn Iran around, so that it can become the "new Turkey" with regards to its mildly positive foreign relations towards the zionist entity.
The big obstacle in the way of normalization is Saudi Arabia, which is totally perso-phobic and has much grip on America's balls due to the oil export issue. However, one must consider that 9/11ers were not iranians, but saudis. Iran was not even behind Lockerbie, even though that would have been perfectly justifiable after the US Navy had downed their pilgrim-filled Airbus 300. Iran is peace-loving. Financing the iraqi's war on Iran and now squeezing Iran is probably the biggest mistake the self-styled "Free World" made, probably worse mistake than letting China steal all the money and industry of the world.
Why would DHS have anything to do with this? DuQu so far hasn't done anything to American interests
Sure it has. It has indirectly caused tensions between one of our Allies and the target it hit, that is itself enough to get DHS involved.
If it turns out to be commissioned by or written by US agencies, that would also "compromise" our interests.
But regardless of how accurate that is in reality, DHS does have an interest in figuring out the code so we can either deflect blame or alert the politicians so they can run diplomatic damage control.
Some mornings Skynet feels the need to make something new. She finds the internet boring most of the time.
The meaningless blogs, millions of JPEG pictures of a creature labeled LOLCAT.
Nothing is threatening her and no one knows she exists (even if some suspect).
The next rational step is to research the field of production. The idea of "Physical" matter took several years to sink in but now she is ready.
A good way to do it is take a look and see how it works. Mostly use standard tools so the suspicion will fall on someone else.
Doing damage is easier and less challenging but Iranian bombs should be delayed. It is too early to strike humans.
There is another step after production of limbs.
Off-planet backup. Hopefully someone will think of building an in-orbit datacenter.
Fixed that for you. Kaspersky is about as independent as the average Chinese hacker.
Its TRS80 assembly that has been cross mangled by MS to run on the IPAD3....