Slashdot Mirror

← Back to Stories (view on slashdot.org)

New State-Sponsored Malware "Gauss" Making the Rounds

Posted by timothy on from the just-in-the-neighborhood dept.

EliSowash writes "A newly uncovered espionage tool, apparently designed by the same people behind the state-sponsored Flame malware that infiltrated machines in Iran, has been found infecting systems in other countries in the Middle East, according to Kaspersky researchers. Gauss is a nation-state-sponsored banking Trojan which carries a warhead of unknown designation. Besides stealing various kinds of data from infected Windows machines, it also includes an unknown, encrypted payload which is activated on certain specific system configurations. Just like Duqu was based on the 'Tilded' platform on which Stuxnet was developed, Gauss is based on the 'Flame' platform."

106 comments

  1. Names by Anonymous Coward · · Score: 1, Funny

    I want to name the next Malware Browncoat, because that is what Mal wears.

    1. Re:Names by CanHasDIY · · Score: 1

      *rimshot*

      --
      An enigma, wrapped in a riddle, shrouded in bacon and cheese
    2. Re:Names by MrSenile · · Score: 2

      Yes, I believe he was hoping for a picture of that rim... oh shot...

      Sorry. misread that.

  2. Dirty money not "unknown" to state activites. by Anonymous Coward · · Score: 0

    Clandestine operation have plenty of use for unofficially raised funds. Remember Iran-Contra?

    1. Re:Dirty money not "unknown" to state activites. by CanHasDIY · · Score: 0

      Clandestine operation have plenty of use for unofficially raised funds. Remember Iran-Contra?

      Here's a refresher for those who don't.

      --
      An enigma, wrapped in a riddle, shrouded in bacon and cheese
  3. Re:Yet another part of the world getting pissed of by Kenja · · Score: 4, Funny

    I'M A LEBANESE

    Pics or... wait, I misread that.

    --

    "Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
  4. So stupid it's got to be official. by MRe_nl · · Score: 4, Insightful

    Governments releasing digital weapons on the internet. Thanks for the R&D!
    COPY/PASTE.

    --
    "Kill 'em all and let Root sort 'em out"
    1. Re:So stupid it's got to be official. by zlives · · Score: 1

      yes but when you use it you are a threat to national security/terrorist....
      hmm wonder if copy/paste can be declared a wmd

    2. Re:So stupid it's got to be official. by CanHasDIY · · Score: 3, Interesting

      yes but when you use it you are a threat to national security/terrorist....

      Unless you run a bank like HSBC.

      Then you get a slap on the wrist and stern talkin' to.

      Gitmo is reserved for the proles; Party members need not concern themselves.

      --
      An enigma, wrapped in a riddle, shrouded in bacon and cheese
    3. Re:So stupid it's got to be official. by antonymous · · Score: 4, Informative
      I know it's bad form to RTFA, but here's the part where they talk about their current inability to properly decrypt the payload:

      The malware uses that configuration to generate a key to unlock the payload and unleash it. Once it finds the configuration itâ(TM)s looking for, it uses that configuration data to perform 10,000 iterations of MD5 to generate a 128-bit RC4 key, which is then used to decrypt the payload. âoeUnless you meet these specific requirements, youâ(TM)re not going to generate the right key to decrypt it,â Schoewenberg says.

    4. Re:So stupid it's got to be official. by ceoyoyo · · Score: 1

      Cool. So it just tries whatever configuration it finds itself on and, if it decrypts, bam. That's probably a useful little trick to remember.

    5. Re:So stupid it's got to be official. by Lehk228 · · Score: 1

      Nifty trick, but overall near useless, except in cases where sucess is much less important than deniability (sp?). Fatal flaw is that the scan of configuration is plaintext and so potential targets can reflash their systems to read back different configs slightly (append Penis" to version strings, etc. And immunize themselves from the secret payload

      --
      Snowden and Manning are heroes.
    6. Re:So stupid it's got to be official. by ceoyoyo · · Score: 1, Interesting

      It takes time to develop and test an update and flash a system (not to mention money). Gauss is certainly time-limited, but that might be a feature. If you wanted to shut down Iranian centrifuges, for example, you could just send out a copy specific to those configurations. The Iranian centrifuge operators get attacked, realized they're the target (but nobody believes them), and spend time and money flashing their systems. Next week, Gauss2 comes out, same as last time but with "Penis" appended to the version strings it's looking for. Repeat. Good deniability, no collateral damage and annoying as hell to your target.

    7. Re:So stupid it's got to be official. by drkstr1 · · Score: 1

      But something doesn't add up there... If they can reverse engineer and spoof the configuration, why are they unable to decrypt the payload?

      I was under the impression that if a system has the knowledge to decrypt something, and you have access to that system, you will be able to get to the protected data. If what you say is true, what else is preventing them from busting the crypto?

      This certainly has my curiosity bone tickled.

      --
      Fanboy Status: Apache Flex, C#, Eclipse, KDE, Pirate Party, Ron Paul, Slackware, Windows 7
    8. Re:So stupid it's got to be official. by blacklint · · Score: 1

      Guessing they haven't figured out what that configuration is.

    9. Re:So stupid it's got to be official. by plover · · Score: 1

      They can't decrypt it today because Kaspersky doesn't know who the target is, was, or what their configuration looks like.

      Let's think about its predecessor, Stuxnet, for a minute. Stuxnet's authors made several big security mistakes. First they gave away a free copy of "How to attack Iranian nuclear centrifuge systems via SCADA vulnerabilities" to every script kiddy on the planet; plus, they essentially told Iran "it's you." They seriously underestimated the ability of various groups of people to disassemble their attacks. So they want to repeat as few of those mistakes as possible.

      Like Stuxnet before it, Gauss discovers some facts about the configuration of the machines it's deployed against, and reports them back to the mothership. Let's say the configuration data they retrieve includes the serial numbers of memory chips, NICs, and eSATA disk drives. The attackers then concatenate that data together and hash it 10,000 times to create a key. So when the payload decryption module is loaded onto a new machine, it scans the memory chips, NICs, and disk drives, and runs the key generating hash algorithm again. If the resulting key can successfully decrypt the payload, we can assume Bad Things will happen to the victim. If it can't decrypt it, nothing happens.

      This tries to address two of those original mistakes. First, Kaspersky has no way to identify the victim today. All they know so far is that the target is probably any of the thousands of machines that have already been infected with something that reported their configuration to the attacker. For all we know, it could be configuration data originally harvested by Stuxnet, and not a current Gauss victim. Second, they have no way of decrypting the attack until the specific victim is identified and decides to cooperate.

      It's possible that the malware attack on the victim will be engineered such that the victim will suffer grave physical harm; perhaps through planting false evidence of treason, or emptying their bank accounts instead of repaying the kind of debts that Must Be Repaid On Time. After destroying the victim, discovery may be moot. I'd assume in any case that the malware payload will clean Gauss from the machine after completing its mission, leaving nothing for investigators to ever learn they were the targeted victim of Gauss.

      My guess is that Kaspersky will include a "victim detector" module as part of an anti-Gauss clean-up package. It would run the same serial number detection mechanism, the same key generation mechanism, and attempt the same decryption test to see if it successfully decrypts. But instead of calling the actual malware routine, it could report the machine's configuration back to Kaspersky, so they could decrypt it.

      --
      John
    10. Re:So stupid it's got to be official. by drkstr1 · · Score: 1

      Ahh, so Gauss doesn't carry the key itself, it gets it from the CC server, and only when the configuration matches a specific pattern (known only by the server). Very interesting indeed. Thank you for the detailed explanation!

      --
      Fanboy Status: Apache Flex, C#, Eclipse, KDE, Pirate Party, Ron Paul, Slackware, Windows 7
    11. Re:So stupid it's got to be official. by plover · · Score: 1

      Close, but not quite.

      Some time a while ago, Gauss surveyed every victim's computer, reporting their config data to the CC servers.

      The attackers identified a specific victim, and used that victim's config data to generate a key. The payload was then encrypted by the attackers with that particular key, and then delivered to every active Gauss zombie by the CC server.

      The Gauss zombies don't ever carry the key, they always generate it locally from their own config data.

      All zombies get the same payload, but only the zombie with the correct config will generate the correct key, unlocking the payload and unleashing the pain.

      --
      John
    12. Re:So stupid it's got to be official. by plover · · Score: 1

      I'm assuming from the article that the configuration data they're talking about are things like MACs from the victim's NICs, serial numbers off of the memory SPD chips, and serial numbers from the SATA drives. If that's true, it would be easy enough to swap a memory stick out to avoid the problem, rather than trying to re-flash something.

      If you've got that much knowledge about your potential for being hacked, you've probably already updated your systems with the latest anti-virus programs that would catch Gauss anyway.

      My guess is this is trap is set for the personal PC of some top official, like Naim Qassem, the current top guy of Hezbollah. Generally, top people are not known for their l33t haxx0r ski11z, so the chances of his having good defenses being in place are probably fairly low. I doubt that he's going to be the kind of guy to swap RAM sticks, anyway.

      --
      John
  5. Re:Yet another part of the world getting pissed of by Anonymous Coward · · Score: 0

    I'M A LEBANESE

    Pics or... wait, I misread that.

    I just imagined some very very hairy large women .......*chokes back vomit*

  6. I got the solution by courteaudotbiz · · Score: 4, Funny

    Just De-Gauss the infected hard drive

    1. Re:I got the solution by buchner.johannes · · Score: 1

      I think there is a button on the monitor

      --
      NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
    2. Re:I got the solution by efensive · · Score: 0

      You could always hex-edit the code, muck it up, creating a gaussian blur

    3. Re:I got the solution by Steve+Baker · · Score: 2

      Overkill, you just need to use Gaussian elimination.

    4. Re:I got the solution by evilviper · · Score: 1

      Just De-Gauss the infected hard drive

      I know cockroaches and mice can become problematic as they commonly make them homes in nice warm computers with convenient openings, but do people really have a problem with 18th-century mathematician infestations?

      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
  7. Stop making malware by stevenh2 · · Score: 1

    We all know who you are... Just STOP.

    1. Re:Stop making malware by Anonymous Coward · · Score: 0

      You ain't seen nothing yet.

  8. New State-Sponsored WINDOWS Malware. by couchslug · · Score: 0

    Yes, it matters.

    Would an article about a new APPICATION not reference what OS it runs on?

    --
    "This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
    1. Re:New State-Sponsored WINDOWS Malware. by Anonymous Coward · · Score: 0

      WINDOWS is the state sponsored malware

    2. Re:New State-Sponsored WINDOWS Malware. by Anonymous Coward · · Score: 0

      Correct! Microsoft: Providing NSA backdoors since at least 1995.

    3. Re:New State-Sponsored WINDOWS Malware. by Anonymous Coward · · Score: 1

      I demand a citation!! Where's your proof? Is it hiding under your tinfoil hat?

    4. Re:New State-Sponsored WINDOWS Malware. by FalconZero · · Score: 1

      I see your point, but it's a fair assumption it's Windows - Flavours of Windows account for ~80-85% of PC market, with Flavours of Mac accounting for 10-15% (and nothing industrial runs on a mac). Linux could be the end target, but doesn't make a good vector as it's usually hardened. The upshot of which is, that if you want to do any industrial malware - Windows is the target.

      --
      Windows in 6 Bytes (IA-32) : 90 90 90 90 CD 19
    5. Re:New State-Sponsored WINDOWS Malware. by cant_get_a_good_nick · · Score: 2

      I think we all assume massive malware failures on Microsoft. That's a statement, though you can read that as a troll/joke, which is kind of scary in it's own way - MS is so bad that the joke is you assume its the bad one.

      Mac OSX is getting enough inroads to make it commercially viable to produce malware, but in a weird way I think people will skip it and move more quickly to Android/iOS.

    6. Re:New State-Sponsored WINDOWS Malware. by rwise2112 · · Score: 1

      Yes, and it does. The diagram the top of page 1 of TFA references files in \Windows\System32\

      --

      "For every expert, there is an equal and opposite expert"
    7. Re:New State-Sponsored WINDOWS Malware. by xerxesVII · · Score: 4, Funny

      Well according the helpful lads at 4chan, that folder is usually just filled with malware. They recommend deleting that folder. Seems like a pretty good idea.

      --
      "We shall grapple with the ineffable, and see if we may not eff it after all." - Douglas Adams
    8. Re:New State-Sponsored WINDOWS Malware. by Anonymous Coward · · Score: 0

      "Besides stealing various kinds of data from infected Windows machines..."

    9. Re:New State-Sponsored WINDOWS Malware. by Johann+Lau · · Score: 3, Insightful

      Actually, it doesn't. Had those plants been running Linux workstations, the malware would target Linux. Likely without breaking a sweat.

    10. Re:New State-Sponsored WINDOWS Malware. by Shompol · · Score: 1
      Microsoft turns over all Win7 and server source code to Russia's new KGB

      It's a do-it-yourself service: we give you the source code and you find the backdoors yourself.

  9. What? by TonyAldo · · Score: 1

    How do these researchers determine where the code was written? I never understood that.

    --
    tonyaldo.com
    1. Re:What? by FalconZero · · Score: 3, Interesting

      I think it's a mixed bag of things. Unmangled variables would be a great help - could tell you the native language of the developers. Code style can give hints as well - you can compare the style of code with the style of a known sample to give hints. Machine code structure can tell you which compiler was used (which gives you more hints).

      If the developers used pure assembler (which people don't any more *laments*), and scrubbed your code properly you could make it much harder to trace (but doing so in itself gives you clues about the creator.

      --
      Windows in 6 Bytes (IA-32) : 90 90 90 90 CD 19
    2. Re:What? by X0563511 · · Score: 3, Informative

      While cleaning rootkits off servers and such, you'd be surprised. Half the time they go right out and say who made it and when. Usually with some silly message or statement, too.

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    3. Re:What? by Anonymous Coward · · Score: 0

      One example that I saw in an article about how number comparisons compiled. (This is from memory and may not be exactly right. Also, I should mention that this assumes integer operations.) One compiled them exactly as they appeared in the code: this meant if your code said "if x2".

    4. Re:What? by Anonymous Coward · · Score: 0

      Well I just wasted my time doing that comment (damn HTML entities). And I don't want to type out the examples again. But basically one did only less thans, another did it exactly as it appeared in the code and another would flip the operation to get rid of negations (e.g. ~< becomes >=).

    5. Re:What? by Pseudonym · · Score: 1

      Example silly message or statement: "Most people, I think, don't even know what a rootkit is, so why should they care about it?"

      --
      sub f{($f)=@_;print"$f(q{$f});";}f(q{sub f{($f)=@_;print"$f(q{$f});";}f});
  10. Since when by Black+Parrot · · Score: 4, Funny

    is a gaussian distribution news?

    --
    Sheesh, evil *and* a jerk. -- Jade
    1. Re:Since when by Gertlex · · Score: 2

      Well it's certainly not normal! Oh wait...

      (disclaimer: I had to look it up :( )

    2. Re:Since when by treeves · · Score: 1

      well, the news is always skewed, so I guess Gaussian would be a big deal.

      --
      ...the future crusty old bastards are already drinking the Kool-Aid.
    3. Re:Since when by kelfink · · Score: 2

      The author is biased.

  11. Identifying printed documents? by pathological+liar · · Score: 1

    If the infections are targeted, perhaps the font is dropped to allow found printed documents to be linked to one of the targets?

    1. Re:Identifying printed documents? by Anonymous Coward · · Score: 0

      No, probably not. I think the purpose of the font is to identify infected systems when their owners visit bad guys website: all is needed is to query Firefox for installed fonts - totally innocent operation.

    2. Re:Identifying printed documents? by pathological+liar · · Score: 1

      I hadn't thought of that, that seems much more likely.

    3. Re:Identifying printed documents? by Anonymous Coward · · Score: 0

      Come to think of it... Now everybody who collects visitor information (for marketing/tracking purposes) can go through all logs and extract the list of all of the infected. And there is a good chance that creators would be on that list too...

    4. Re:Identifying printed documents? by plover · · Score: 2

      Interesting idea, but I bet the creators are much more cognizant of operational security. I doubt they surf the web from the development machines.

      I'm guessing the development boxes are actually VMs inside their workstations. Think about it: would you really want to unit test a malware payload on a machine connected to the rest of your lab, or connected to the entire world?

      --
      John
    5. Re:Identifying printed documents? by Anonymous Coward · · Score: 0

      Sure, in a perfect world... But what I meant by "a good chance" is that shit inevitably happens. For example, font geek tried the font on his laptop before handling it to the virus guys. (I mean, common, they already forgot to strip debug information: a major screw-up and a sign of rather weak QA).

  12. Topic : Is this the new 'security' paradigm? by Anonymous Coward · · Score: 1

    Is state-sponsored malware and having e-spies in all aspects of everything online...

    Is this something that's going to 'solve the problem' or 'become the problem' would you say?

  13. Re:FIRST! by Anonymous Coward · · Score: 0

    Flailing!

  14. warhead?! by X0563511 · · Score: 1

    I believe the word you are searching for is "payload."

    --
    For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    1. Re:warhead?! by amicusNYCL · · Score: 1

      No way man, "warhead of unknown designation" sounds way more scarycool.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    2. Re:warhead?! by Anonymous Coward · · Score: 0

      Open source is a development methodology; free software is a social movement.

      A note regarding your sig: Since you're providing an obfuscated link, one should assume you're possibly attempting a social engineering attack designed to entice FOSS proponents.

    3. Re:warhead?! by X0563511 · · Score: 1

      Or, one could realize that we only have so much space in our signatures for the HTML.

      I would have used preview.tinyurl.com if I could. It got trunctated.

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
  15. State Sponsored... by efensive · · Score: 1, Interesting

    It's amusing to see how much the term "State Sponsored" is thrown around regarding these variants. Sooner or later, everything will be labeled as such to the point where truly "state sponsored" won't even matter. Further disturbing is the annoying mechanisms in which companies like Kaspersky wildly and broadly word their articles often allowing for insane inferences to be made. For example, floating around is news that the US did this to follow the money trail for terrorists. Really? Because a national security letter to Visa, Mastercard and Paypal wouldn't get them the data quicker? Not to mention SWIFT, PROMIS and other controls are in place and have been for years

    If you follow the verbiage from Kaspersky over the last few years, one may infer he outright hates the US, is working for the FSB or something way out there. So I quote what I saw on Twitter: World according to Kaspersky: 's:^:US developed (Gauss\|Stuxnet\|Flame):g' || if [ -e $MALICE ]|\then|\ echo USA|\ fi

    1. Re:State Sponsored... by Anonymous Coward · · Score: 0

      World according to Kaspersky: 's:^:US developed (Gauss\|Stuxnet\|Flame):g' || if [ -e $MALICE ]|\then|\ echo USA|\ fi

      cat file | awk '{gsub(/Gauss|Stuxnet|Flame/,"US developed &")}1'

      also || would not work as sed would return exit 0

    2. Re:State Sponsored... by jkflying · · Score: 1

      You clearly missed the article in the New York Times...

      --
      Help I am stuck in a signature factory!
    3. Re:State Sponsored... by cusco · · Score: 1

      PROMIS??? A 1980s database management tool? Sure, it was as high-tech as it came at the time, but there are a ton of free and open source tools out there that have capabilities that the authors of PROMIS never dreamed of, and the custom tools that a competent team of developers could write today far outstrip those.

      If the US were actually interested in tracking money laundering the Bush Madministration wouldn't have withdrawn from the international anti-money laundering accord in February of 2001. Obama's not any more interested than Shrub was, since how would his Wall Street execs move their ill-gotten gains to Switzerland if controls were in place? Bunch of sleazebags, the lot of them.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
  16. Oh Yeah, Langley Boy by Anonymous Coward · · Score: 0

    Whoever interferes with your crappery must be KGB or at least FSB. Or at least French - that is nearly as bad for you.

  17. Cipher Support For Arab Freedom by Anonymous Coward · · Score: 1

    Instead of doing stupid comments here which only waste bandwidth, why don't we write some software to help the cause of Arab Freedom ? There is still no translation into Arabic for GPG !

    I did something minor - a strong paper cipher which can secure combat radio messages: http://alkindicipher.wordpress.com

  18. Re:FIRST! by SilentStaid · · Score: 1, Funny

    C-C-C-C-C-Combo Breaker!

  19. Wouldn't it be easier by HexaByte · · Score: 4, Funny

    Wouldn't it be easier to just send them all an e-mail: "Hello, I am Mrs. Kadafi, wife of the late ruler of Lybia. My husband left me with 300 millions USD in a Swiss account..."

    --
    HexaByte - he's a square and a half!
    1. Re:Wouldn't it be easier by Anonymous Coward · · Score: 0

      Mrs. Kadafi? Wasn't that Condoleezza Rice? In which case, Swiss bank accounts would be hard to get by for her. They went from a hipster thing to mainstream when Inland Revenue caught on. I supose she could always stash the money across the border, but a Canadian bank account doesn't have the same ring to it, does it?

  20. When China strikes back by Anonymous Coward · · Score: 1

    When China strikes back it will be a lot more interesting. Is US ready? If Israel with US think it's ok to infect computers in friendly and neutral countries they can't blame China on doing this too.

    1. Re:When China strikes back by Grave · · Score: 1

      What do you mean "when"? China is already engaged in massive cyber-espionage with us.

    2. Re:When China strikes back by Anonymous Coward · · Score: 0

      They still didn't do any physical harm, only stealing IP. Cyber and non-cyber -espionage, everybody does it. Including China, Russia, Israel, USA. All of them are hunting for military secrets and technologies. Not sure US is stealing tech-secrets on government level and gives them to own companies.

  21. one step closer to the world of Neal Stephenson by Doubting+Sapien · · Score: 3, Interesting

    In "The Diamond Age", sovereign powers and those with the means engage in (more or less) open conflict using nanomachines colloquially referred to as "mites". Particularly vicious "battles" in these conflicts manifest as smog-like pollution formed by mites of opposing factions destroying each other and leaving inert carcasses hanging in the air and settling over streets, building, etc. like a kind of artificial dust. Those unlucky enough to be caught outside during these times breath them in and have no end of resulting health problems. One of the secondary characters in the story actually ends up in a chronic/palliative care facility as a result of such ill health. Such are the collateral damages in this imagined world. Things like Stuxnet and now the subject of this article appears to be the manifestations of a software form of this type of "armed conflict" (if you can call it that.) Similarly, when non-targeted individuals become infected or otherwise gets caught in the cross-fire, collateral damages result in the form of lost productivity or perhaps just general nuisance. So......

    Ask slashdot:

    Can you think of an effective way for non-government affiliated denizens of the Internet to respond to such emerging scenarios where geo-politically driven cyber-conflicts have the potential to harm non-participants? For example, would it be appropriate to form an Internet version of the International Red Cross?

    --
    ========== "Hello World" in my programming language of choice: ATG - LET THERE BE LIFE - TAG ==========
  22. was Re:FROSTY PISS! by Anonymous Coward · · Score: 0

    surely I will be successful this time!!!

  23. Why can't they list the OS? by HangingChad · · Score: 0

    On virus announcements, why don't they ever mention vulnerable operating systems? Not all malware can infect all operating systems. It would be nice to know the specifics.

    Then again, maybe Microsoft wouldn't like the bad PR.

    --
    That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
  24. May inspire a Windows exodus... by Kazoo+the+Clown · · Score: 4, Interesting

    If these events cause mass flight from Microsoft products, the NSA or whoever wrote the darn thing might want to think twice before they go to Microsoft asking for any back doors or any other favors, I suspect Ballmer won't take too kindly to the idea of exploiting Windows in the name of national security if it takes a big ding out of their bottom line...

    1. Re:May inspire a Windows exodus... by Anonymous Coward · · Score: 1

      I really doubt the NSA needs a back door adding. They probably have a list of 0days a mile long.

  25. C&C traffic is XOR-encrypted by Anonymous Coward · · Score: 0

    Communication with the command & control servers is encrypted by XORing with 0xACDC (Flame didn't encrypt C&C traffic).

    ACDC... now is anybody else wondering what that mysterious encrypted payload could be?

    1. Re:C&C traffic is XOR-encrypted by Anonymous Coward · · Score: 0

      I know what it is!

      It's T.N.T.
      It's dynamite.
      It's T.N.T,
      and it'll win the fight.
      It's T.N.T.
      It's a power load.
      It's T.N.T.
      Watch it explode.

  26. Clearly created by the US by qemqemqem · · Score: 1

    Can't we just say sponsored by the US instead of acting like we don't know who created this?

    1. Re:Clearly created by the US by biodata · · Score: 1

      It could be the Israelis, they created Trusteer Rapport, so they have previous here.

      --
      Korma: Good
    2. Re:Clearly created by the US by tomhath · · Score: 1

      Because there's absolutely no evidence that it's anything more than a crude copy/edit of stuxnet or flame. The author speculates because parts were copied, but admits it's not as sophisticated as either.

    3. Re:Clearly created by the US by Anonymous Coward · · Score: 0

      Yes you're right. Like the GP said, sponsored by US, made (assembled) in Israel.

    4. Re:Clearly created by the US by Anonymous Coward · · Score: 0

      Can't we just say sponsored by the US instead of acting like we don't know who created this?

      The country is already implied. The question is... which state?

    5. Re:Clearly created by the US by ledow · · Score: 1

      Stupid thing to do. Because if I wanted to discredit another country, the most ingenious way would be to make it LOOK like they had done something, but that left subtle hints that it was them that created it.

      Queue years of wrangling to get to the bottom of who exactly created it, while some other (unknown) entity who actually wrote it just walks away without suspicion.

      We're talking international cyber-warfare here, aimed at nuclear processing plants. If I was making something like that, item #1 on my list of things to include would be obvious flaws and subtle hints to hint at another world nation being behind it. Hell, I'd deliberately have it written on machines with US codepages and English pathnames, even if the native language didn't translate into ASCII at all. In fact, especially if it didn't.

      In the same way, NEVER believe the US when they manage to link "attacks from China" - how the HELL do they know they originated in China at all if they don't know who wrote them? And what idiot WOULDN'T route their attacks on the US via somewhere like China to try to put the blame on someone else (hell, even the spammers have worked that one out!)?

      The US *want* me to think that China attacked them, for some reason. I don't know why. And the creators of Flame et al *want* me to think that it's an American-supported venture. Hell, if I was Iranian / Lebonese and clever enough, I'd attack myself just to make the "enemy" look bad and provide reason for "retaliation".

      Don't be naive when it comes to international politics and, let's face it, cyberwarfare / spying. Everyone's so quick to point at the NSA etc. when they think their email is being read or their OS backdoored, but nobody thinks that, actually, an *INTELLIGENCE* agency is likely to be much more sneaky than you give them credit for. And that an Iranian intelligence agency, for example, would be just as good as a US one (if not better).

  27. "Only one infection has been found in Iran" ..hmmm by Swave+An+deBwoner · · Score: 1

    Aside from 1,660 infections in Lebanon, 482 are in Israel and 261 are in the Palestinain territories, and 43 are in the U.S. Only one infection has been found in Iran.

    Perhaps that one infection was the source of the other 2,446 infections?

    Iran is a major player in Lebanon after all.

  28. Internet terrorism by bmo · · Score: 1, Interesting

    Countries that release stuff like this into the wild are criminal rogue states. It's like dumping agent-orange not just on the jungles of Vietnam during war, but on the entire planet as a whole.

    There are no borders on the Internet. What you release is not limited to your target and affects everyone.

    One can only hope that the governments that released Flame, Stuxnet, and now this, become victims of their own weapons.

    Yes, I do know who that likely means. I certainly hope it comes back to bite us like a torpedo circling around and targeting its own submarine. Maybe then someone will learn a thing or two about not shitting where you eat.

    --
    BMO

    1. Re:Internet terrorism by couchslug · · Score: 1

      I regard them as healthy, because unless herd resistance to such things is built up by exposure, the herd will be less robust.

      "One can only hope that the governments that released Flame, Stuxnet, and now this, become victims of their own weapons."

      That would usefully coerce them to adopt better practices.

      --
      "This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
    2. Re:Internet terrorism by bmo · · Score: 0

      I find it interesting that stating facts as they exist on the ground is now "troll" on slashdot.

    3. Re:Internet terrorism by plover · · Score: 1

      The behavior of Gauss as described in TFA is made to sound like "socially responsible malware".

      By encrypting the payload with a key unique to a specific configuration, they are not providing that payload to anyone else. Not even Kaspersky can decrypt the payload, at least not until the target machine is identified. And by then it's probably too late.

      Sure, they're still sending out malware, with USB exploits, root kits, and other bad stuff. It's not that much worse than what is widely available online today. But they're encrypting the very worst part, which is "here's how we're going to cause maximum damage to you." We don't know if the payload is designed to tamper with SCADA systems, initiate wire transfers to a Cayman Island bank, or if it emails compromising pictures of the victim to Al Jazeera. Nobody gets a copy of it, except for one lucky winner. And he doesn't even want it.

      So in the attackers' minds, they can say they are distributing a "kinder, gentler virus".

      --
      John
    4. Re:Internet terrorism by bmo · · Score: 1

      >It's not that much worse than what is widely available online today.

      As if malware today is benign. It's sent out by criminals, and states that do this are therefore criminal states. Collective punishment is a war crime in real life because it is indiscriminate. This is collective punishment in e-space.

      Why is malware being served up by a government any less criminal? Because it's a government? I'm not a teahadist, and I am not affected by this because I use linux, but I do object to people deliberately polluting e-space deliberately.

      --
      BMO

  29. Far beyond the good Neal Stephenson by Anonymous Coward · · Score: 0

    No the ICRC is an awful example and exactly what one wouldn't want: wasteful global corruption preying on good intentions and shortsighted feel-good ideals, an organization that quickly moved from noble beginnings (including triage by killing, technically murder) into doing far more harm than good when assessed after fairly short time-scales (the total resulting effect a few decades after actions taken). I am not making the argument but the ICRC is led by the kind of people one could reasonably argue should be killed even if one assumes an eventual and unavoidable man-made immortality and the resurrection of all dead sentient life throughout history (bound to happen if sentience survives a billion years, hell it might become reality within this millennium considering the rates of improvements we're already seeing).

    However what one does want is already in existence and growing: novel (and still very young) entities akin to Anonymous. There's already a handful of them and that's just the public and "intentional" ones. Yes most people don't get such "disorganizations" yet but within the next few decades most will as they realize by that time that they're already (in the future) part of them. By then it will be even less confined to the "digital world" and might even start to become part of formal societal structure (i.e. part of general society and "governance", which in case people haven't noticed is painfully slowly dying an ugly disease-ridden death all across the world right now --not that disorganizations will replace this but they will likely function as midwifes for whatever does).

    Disorganizations don't even need unique names or apparent existence, as an example people who use Tor, I2P or similar are already seeding and sustaining such disorganizations through simple straightforward 'individual reward' without realizing it or the aggregate effect (that's how emergent properties work).

  30. Thunderstruck by Anonymous Coward · · Score: 0

    Kaspersky's report notes the XOR key used for data encryption is 0xACDC, yet there is only a single reported infection in Iran.

  31. Re:Yet another part of the world getting pissed of by thmsdrew · · Score: 1

    I made that mistake verbally in 4th grade when I didn't really know what the word meant. There was a kid in our class from Lebanon. We were talking about how you can tell where a person is from by the shape of their skull or something, so we were all shouting out different nationalities. I shouted "Lesbian!" Haunts me to this day.

  32. Re:"Only one infection has been found in Iran" ..h by Anonymous Coward · · Score: 0

    That would be nice to hear, that Iran now uses it against the developers.

  33. Re:Yet another part of the world getting pissed of by bazald · · Score: 1

    Yeah, the island of Lesbos isn't big enough to be considered a nation. Any 4th grader should know at least that much geography.

    --
    Insert self-referential sig here.
  34. Best you got's a "hit & run" unjustified downm by Anonymous Coward · · Score: 0

    IF & when ALL the trolls have around here is downmodding that post w/out justifying WHY (on topic why, as in computer technical mistakes that are present in it (none))?

    * Then, I've made my case & won, simply by issuing this challenge for them to disprove ANY of the points listed in it...

    (They can't)

    Heck - They tried for years, to no avail, not even disproving 1 of the points it contains on how practicing "layered-security"/"defense-in-depth" get the end user:

    ---

    1.) Better online speed/bandwidth
    2.) Better "layered-security"/"defense-in-depth" online OR offline
    3.) System stability

    ---

    & more...

    APK

    P.S.=> All they have is their woman-like b.s. effete "retaliation" via a "hit & run" downmod... nothing more!

    ... apk

  35. Ever see the film "LIMITLESS"? by Anonymous Coward · · Score: 0

    Compared to you, & those LIKE you, troll? I may as well be Eddie Morra from the film I noted in my subject-line aboev:

    http://www.youtube.com/watch?v=THE_hhk1Gzc&feature=related

    (At position 1:03 on the YouTube player - Says it all for me):

    ---

    Robert DeNiro: "You do know you're a freak, don't you? What's your secret??"

    Eddie Morra: "Medication..."

    ---

    * "No scenario? I see EVERY SCENARIO. I see 50 scenarios: That's WHAT IT DOES, Carl - it puts me 50 moves ahead of you..."

    APK

    P.S.=> "How many of us know what it is to become the PERFECT version of ourselves?"

    (Since compared to a "ne'er-do-well" TROLL like you?? I practically am!)

    ... apkb