New State-Sponsored Malware "Gauss" Making the Rounds

← Back to Stories (view on slashdot.org)

New State-Sponsored Malware "Gauss" Making the Rounds

Posted by timothy on Thursday August 9, 2012 @06:31AM from the just-in-the-neighborhood dept.

EliSowash writes "A newly uncovered espionage tool, apparently designed by the same people behind the state-sponsored Flame malware that infiltrated machines in Iran, has been found infecting systems in other countries in the Middle East, according to Kaspersky researchers. Gauss is a nation-state-sponsored banking Trojan which carries a warhead of unknown designation. Besides stealing various kinds of data from infected Windows machines, it also includes an unknown, encrypted payload which is activated on certain specific system configurations. Just like Duqu was based on the 'Tilded' platform on which Stuxnet was developed, Gauss is based on the 'Flame' platform."

66 of 106 comments (clear)

Min score:

Reason:

Sort:

Names by Anonymous Coward · 2012-08-09 06:36 · Score: 1, Funny

I want to name the next Malware Browncoat, because that is what Mal wears.
1. Re:Names by CanHasDIY · 2012-08-09 06:57 · Score: 1
  
  *rimshot*
  
  --
  An enigma, wrapped in a riddle, shrouded in bacon and cheese
2. Re:Names by MrSenile · 2012-08-09 07:29 · Score: 2
  
  Yes, I believe he was hoping for a picture of that rim... oh shot...
  Sorry. misread that.
Re:Yet another part of the world getting pissed of by Kenja · 2012-08-09 06:39 · Score: 4, Funny

I'M A LEBANESE
Pics or... wait, I misread that.

--

"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
So stupid it's got to be official. by MRe_nl · 2012-08-09 06:40 · Score: 4, Insightful

Governments releasing digital weapons on the internet. Thanks for the R&D!
COPY/PASTE.

--
"Kill 'em all and let Root sort 'em out"
1. Re:So stupid it's got to be official. by zlives · 2012-08-09 06:43 · Score: 1
  
  yes but when you use it you are a threat to national security/terrorist....
  hmm wonder if copy/paste can be declared a wmd
2. Re:So stupid it's got to be official. by CanHasDIY · 2012-08-09 07:00 · Score: 3, Interesting
  
  yes but when you use it you are a threat to national security/terrorist....
  Unless you run a bank like HSBC.
  
  Then you get a slap on the wrist and stern talkin' to.
  
  Gitmo is reserved for the proles; Party members need not concern themselves.
  
  --
  An enigma, wrapped in a riddle, shrouded in bacon and cheese
3. Re:So stupid it's got to be official. by antonymous · 2012-08-09 07:23 · Score: 4, Informative
  
  I know it's bad form to RTFA, but here's the part where they talk about their current inability to properly decrypt the payload:
  
  The malware uses that configuration to generate a key to unlock the payload and unleash it. Once it finds the configuration itâ(TM)s looking for, it uses that configuration data to perform 10,000 iterations of MD5 to generate a 128-bit RC4 key, which is then used to decrypt the payload. âoeUnless you meet these specific requirements, youâ(TM)re not going to generate the right key to decrypt it,â Schoewenberg says.
4. Re:So stupid it's got to be official. by ceoyoyo · 2012-08-09 07:55 · Score: 1
  
  Cool. So it just tries whatever configuration it finds itself on and, if it decrypts, bam. That's probably a useful little trick to remember.
5. Re:So stupid it's got to be official. by Lehk228 · 2012-08-09 08:17 · Score: 1
  
  Nifty trick, but overall near useless, except in cases where sucess is much less important than deniability (sp?). Fatal flaw is that the scan of configuration is plaintext and so potential targets can reflash their systems to read back different configs slightly (append Penis" to version strings, etc. And immunize themselves from the secret payload
  
  --
  Snowden and Manning are heroes.
6. Re:So stupid it's got to be official. by ceoyoyo · 2012-08-09 08:29 · Score: 1, Interesting
  
  It takes time to develop and test an update and flash a system (not to mention money). Gauss is certainly time-limited, but that might be a feature. If you wanted to shut down Iranian centrifuges, for example, you could just send out a copy specific to those configurations. The Iranian centrifuge operators get attacked, realized they're the target (but nobody believes them), and spend time and money flashing their systems. Next week, Gauss2 comes out, same as last time but with "Penis" appended to the version strings it's looking for. Repeat. Good deniability, no collateral damage and annoying as hell to your target.
7. Re:So stupid it's got to be official. by drkstr1 · 2012-08-09 11:50 · Score: 1
  
  But something doesn't add up there... If they can reverse engineer and spoof the configuration, why are they unable to decrypt the payload?
  I was under the impression that if a system has the knowledge to decrypt something, and you have access to that system, you will be able to get to the protected data. If what you say is true, what else is preventing them from busting the crypto?
  This certainly has my curiosity bone tickled.
  
  --
  Fanboy Status: Apache Flex, C#, Eclipse, KDE, Pirate Party, Ron Paul, Slackware, Windows 7
8. Re:So stupid it's got to be official. by blacklint · 2012-08-09 14:00 · Score: 1
  
  Guessing they haven't figured out what that configuration is.
9. Re:So stupid it's got to be official. by plover · 2012-08-09 17:54 · Score: 1
  
  They can't decrypt it today because Kaspersky doesn't know who the target is, was, or what their configuration looks like.
  Let's think about its predecessor, Stuxnet, for a minute. Stuxnet's authors made several big security mistakes. First they gave away a free copy of "How to attack Iranian nuclear centrifuge systems via SCADA vulnerabilities" to every script kiddy on the planet; plus, they essentially told Iran "it's you." They seriously underestimated the ability of various groups of people to disassemble their attacks. So they want to repeat as few of those mistakes as possible.
  Like Stuxnet before it, Gauss discovers some facts about the configuration of the machines it's deployed against, and reports them back to the mothership. Let's say the configuration data they retrieve includes the serial numbers of memory chips, NICs, and eSATA disk drives. The attackers then concatenate that data together and hash it 10,000 times to create a key. So when the payload decryption module is loaded onto a new machine, it scans the memory chips, NICs, and disk drives, and runs the key generating hash algorithm again. If the resulting key can successfully decrypt the payload, we can assume Bad Things will happen to the victim. If it can't decrypt it, nothing happens.
  This tries to address two of those original mistakes. First, Kaspersky has no way to identify the victim today. All they know so far is that the target is probably any of the thousands of machines that have already been infected with something that reported their configuration to the attacker. For all we know, it could be configuration data originally harvested by Stuxnet, and not a current Gauss victim. Second, they have no way of decrypting the attack until the specific victim is identified and decides to cooperate.
  It's possible that the malware attack on the victim will be engineered such that the victim will suffer grave physical harm; perhaps through planting false evidence of treason, or emptying their bank accounts instead of repaying the kind of debts that Must Be Repaid On Time. After destroying the victim, discovery may be moot. I'd assume in any case that the malware payload will clean Gauss from the machine after completing its mission, leaving nothing for investigators to ever learn they were the targeted victim of Gauss.
  My guess is that Kaspersky will include a "victim detector" module as part of an anti-Gauss clean-up package. It would run the same serial number detection mechanism, the same key generation mechanism, and attempt the same decryption test to see if it successfully decrypts. But instead of calling the actual malware routine, it could report the machine's configuration back to Kaspersky, so they could decrypt it.
  
  --
  John
10. Re:So stupid it's got to be official. by drkstr1 · 2012-08-10 03:19 · Score: 1
  
  Ahh, so Gauss doesn't carry the key itself, it gets it from the CC server, and only when the configuration matches a specific pattern (known only by the server). Very interesting indeed. Thank you for the detailed explanation!
  
  --
  Fanboy Status: Apache Flex, C#, Eclipse, KDE, Pirate Party, Ron Paul, Slackware, Windows 7
11. Re:So stupid it's got to be official. by plover · 2012-08-10 06:51 · Score: 1
  
  Close, but not quite.
  Some time a while ago, Gauss surveyed every victim's computer, reporting their config data to the CC servers.
  The attackers identified a specific victim, and used that victim's config data to generate a key. The payload was then encrypted by the attackers with that particular key, and then delivered to every active Gauss zombie by the CC server.
  The Gauss zombies don't ever carry the key, they always generate it locally from their own config data.
  All zombies get the same payload, but only the zombie with the correct config will generate the correct key, unlocking the payload and unleashing the pain.
  
  --
  John
12. Re:So stupid it's got to be official. by plover · 2012-08-10 07:08 · Score: 1
  
  I'm assuming from the article that the configuration data they're talking about are things like MACs from the victim's NICs, serial numbers off of the memory SPD chips, and serial numbers from the SATA drives. If that's true, it would be easy enough to swap a memory stick out to avoid the problem, rather than trying to re-flash something.
  If you've got that much knowledge about your potential for being hacked, you've probably already updated your systems with the latest anti-virus programs that would catch Gauss anyway.
  My guess is this is trap is set for the personal PC of some top official, like Naim Qassem, the current top guy of Hezbollah. Generally, top people are not known for their l33t haxx0r ski11z, so the chances of his having good defenses being in place are probably fairly low. I doubt that he's going to be the kind of guy to swap RAM sticks, anyway.
  
  --
  John
I got the solution by courteaudotbiz · 2012-08-09 06:47 · Score: 4, Funny

Just De-Gauss the infected hard drive
1. Re:I got the solution by buchner.johannes · 2012-08-09 07:20 · Score: 1
  
  I think there is a button on the monitor
  
  --
  NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
2. Re:I got the solution by Steve+Baker · 2012-08-09 08:22 · Score: 2
  
  Overkill, you just need to use Gaussian elimination.
3. Re:I got the solution by evilviper · 2012-08-09 13:33 · Score: 1
  
  Just De-Gauss the infected hard drive
  I know cockroaches and mice can become problematic as they commonly make them homes in nice warm computers with convenient openings, but do people really have a problem with 18th-century mathematician infestations?
  
  --
  Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
Stop making malware by stevenh2 · 2012-08-09 06:50 · Score: 1

We all know who you are... Just STOP.
What? by TonyAldo · 2012-08-09 07:00 · Score: 1

How do these researchers determine where the code was written? I never understood that.

--
tonyaldo.com
1. Re:What? by FalconZero · 2012-08-09 07:29 · Score: 3, Interesting
  
  I think it's a mixed bag of things. Unmangled variables would be a great help - could tell you the native language of the developers. Code style can give hints as well - you can compare the style of code with the style of a known sample to give hints. Machine code structure can tell you which compiler was used (which gives you more hints).
  
  If the developers used pure assembler (which people don't any more *laments*), and scrubbed your code properly you could make it much harder to trace (but doing so in itself gives you clues about the creator.
  
  --
  Windows in 6 Bytes (IA-32) : 90 90 90 90 CD 19
2. Re:What? by X0563511 · 2012-08-09 07:33 · Score: 3, Informative
  
  While cleaning rootkits off servers and such, you'd be surprised. Half the time they go right out and say who made it and when. Usually with some silly message or statement, too.
  
  --
  For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
3. Re:What? by Pseudonym · 2012-08-09 13:56 · Score: 1
  
  Example silly message or statement: "Most people, I think, don't even know what a rootkit is, so why should they care about it?"
  
  --
  sub f{($f)=@_;print"$f(q{$f});";}f(q{sub f{($f)=@_;print"$f(q{$f});";}f});
Re:New State-Sponsored WINDOWS Malware. by Anonymous Coward · 2012-08-09 07:02 · Score: 1

I demand a citation!! Where's your proof? Is it hiding under your tinfoil hat?
Since when by Black+Parrot · 2012-08-09 07:04 · Score: 4, Funny

is a gaussian distribution news?

--
Sheesh, evil *and* a jerk. -- Jade
1. Re:Since when by Gertlex · 2012-08-09 07:21 · Score: 2
  
  Well it's certainly not normal! Oh wait...
  (disclaimer: I had to look it up :( )
2. Re:Since when by treeves · 2012-08-09 07:29 · Score: 1
  
  well, the news is always skewed, so I guess Gaussian would be a big deal.
  
  --
  ...the future crusty old bastards are already drinking the Kool-Aid.
3. Re:Since when by kelfink · 2012-08-09 08:30 · Score: 2
  
  The author is biased.
Re:New State-Sponsored WINDOWS Malware. by FalconZero · 2012-08-09 07:06 · Score: 1

I see your point, but it's a fair assumption it's Windows - Flavours of Windows account for ~80-85% of PC market, with Flavours of Mac accounting for 10-15% (and nothing industrial runs on a mac). Linux could be the end target, but doesn't make a good vector as it's usually hardened. The upshot of which is, that if you want to do any industrial malware - Windows is the target.

--
Windows in 6 Bytes (IA-32) : 90 90 90 90 CD 19
Identifying printed documents? by pathological+liar · 2012-08-09 07:13 · Score: 1

If the infections are targeted, perhaps the font is dropped to allow found printed documents to be linked to one of the targets?
1. Re:Identifying printed documents? by pathological+liar · 2012-08-09 10:00 · Score: 1
  
  I hadn't thought of that, that seems much more likely.
2. Re:Identifying printed documents? by plover · 2012-08-10 10:21 · Score: 2
  
  Interesting idea, but I bet the creators are much more cognizant of operational security. I doubt they surf the web from the development machines.
  I'm guessing the development boxes are actually VMs inside their workstations. Think about it: would you really want to unit test a malware payload on a machine connected to the rest of your lab, or connected to the entire world?
  
  --
  John
Topic : Is this the new 'security' paradigm? by Anonymous Coward · 2012-08-09 07:18 · Score: 1

Is state-sponsored malware and having e-spies in all aspects of everything online...
Is this something that's going to 'solve the problem' or 'become the problem' would you say?
Re:New State-Sponsored WINDOWS Malware. by cant_get_a_good_nick · 2012-08-09 07:22 · Score: 2

I think we all assume massive malware failures on Microsoft. That's a statement, though you can read that as a troll/joke, which is kind of scary in it's own way - MS is so bad that the joke is you assume its the bad one.
Mac OSX is getting enough inroads to make it commercially viable to produce malware, but in a weird way I think people will skip it and move more quickly to Android/iOS.
Re:New State-Sponsored WINDOWS Malware. by rwise2112 · 2012-08-09 07:26 · Score: 1

Yes, and it does. The diagram the top of page 1 of TFA references files in \Windows\System32\

--

"For every expert, there is an equal and opposite expert"
warhead?! by X0563511 · 2012-08-09 07:31 · Score: 1

I believe the word you are searching for is "payload."

--
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
1. Re:warhead?! by amicusNYCL · 2012-08-09 07:37 · Score: 1
  
  No way man, "warhead of unknown designation" sounds way more scarycool.
  
  --
  "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
2. Re:warhead?! by X0563511 · 2012-08-09 08:45 · Score: 1
  
  Or, one could realize that we only have so much space in our signatures for the HTML.
  I would have used preview.tinyurl.com if I could. It got trunctated.
  
  --
  For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
State Sponsored... by efensive · 2012-08-09 07:32 · Score: 1, Interesting

It's amusing to see how much the term "State Sponsored" is thrown around regarding these variants. Sooner or later, everything will be labeled as such to the point where truly "state sponsored" won't even matter. Further disturbing is the annoying mechanisms in which companies like Kaspersky wildly and broadly word their articles often allowing for insane inferences to be made. For example, floating around is news that the US did this to follow the money trail for terrorists. Really? Because a national security letter to Visa, Mastercard and Paypal wouldn't get them the data quicker? Not to mention SWIFT, PROMIS and other controls are in place and have been for years

If you follow the verbiage from Kaspersky over the last few years, one may infer he outright hates the US, is working for the FSB or something way out there. So I quote what I saw on Twitter: World according to Kaspersky: 's:^:US developed (Gauss\|Stuxnet\|Flame):g' || if [ -e $MALICE ]|\then|\ echo USA|\ fi
1. Re:State Sponsored... by jkflying · 2012-08-09 19:51 · Score: 1
  
  You clearly missed the article in the New York Times...
  
  --
  Help I am stuck in a signature factory!
2. Re:State Sponsored... by cusco · 2012-08-10 12:00 · Score: 1
  
  PROMIS??? A 1980s database management tool? Sure, it was as high-tech as it came at the time, but there are a ton of free and open source tools out there that have capabilities that the authors of PROMIS never dreamed of, and the custom tools that a competent team of developers could write today far outstrip those.
  
  If the US were actually interested in tracking money laundering the Bush Madministration wouldn't have withdrawn from the international anti-money laundering accord in February of 2001. Obama's not any more interested than Shrub was, since how would his Wall Street execs move their ill-gotten gains to Switzerland if controls were in place? Bunch of sleazebags, the lot of them.
  
  --
  "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
Re:New State-Sponsored WINDOWS Malware. by xerxesVII · 2012-08-09 07:42 · Score: 4, Funny

Well according the helpful lads at 4chan, that folder is usually just filled with malware. They recommend deleting that folder. Seems like a pretty good idea.

--
"We shall grapple with the ineffable, and see if we may not eff it after all." - Douglas Adams
Cipher Support For Arab Freedom by Anonymous Coward · 2012-08-09 07:57 · Score: 1

Instead of doing stupid comments here which only waste bandwidth, why don't we write some software to help the cause of Arab Freedom ? There is still no translation into Arabic for GPG !
I did something minor - a strong paper cipher which can secure combat radio messages: http://alkindicipher.wordpress.com
Re:FIRST! by SilentStaid · 2012-08-09 07:59 · Score: 1, Funny

C-C-C-C-C-Combo Breaker!
Wouldn't it be easier by HexaByte · 2012-08-09 08:03 · Score: 4, Funny

Wouldn't it be easier to just send them all an e-mail: "Hello, I am Mrs. Kadafi, wife of the late ruler of Lybia. My husband left me with 300 millions USD in a Swiss account..."

--
HexaByte - he's a square and a half!
When China strikes back by Anonymous Coward · 2012-08-09 08:18 · Score: 1

When China strikes back it will be a lot more interesting. Is US ready? If Israel with US think it's ok to infect computers in friendly and neutral countries they can't blame China on doing this too.
1. Re:When China strikes back by Grave · 2012-08-09 09:33 · Score: 1
  
  What do you mean "when"? China is already engaged in massive cyber-espionage with us.
one step closer to the world of Neal Stephenson by Doubting+Sapien · 2012-08-09 08:21 · Score: 3, Interesting

In "The Diamond Age", sovereign powers and those with the means engage in (more or less) open conflict using nanomachines colloquially referred to as "mites". Particularly vicious "battles" in these conflicts manifest as smog-like pollution formed by mites of opposing factions destroying each other and leaving inert carcasses hanging in the air and settling over streets, building, etc. like a kind of artificial dust. Those unlucky enough to be caught outside during these times breath them in and have no end of resulting health problems. One of the secondary characters in the story actually ends up in a chronic/palliative care facility as a result of such ill health. Such are the collateral damages in this imagined world. Things like Stuxnet and now the subject of this article appears to be the manifestations of a software form of this type of "armed conflict" (if you can call it that.) Similarly, when non-targeted individuals become infected or otherwise gets caught in the cross-fire, collateral damages result in the form of lost productivity or perhaps just general nuisance. So......
Ask slashdot:
Can you think of an effective way for non-government affiliated denizens of the Internet to respond to such emerging scenarios where geo-politically driven cyber-conflicts have the potential to harm non-participants? For example, would it be appropriate to form an Internet version of the International Red Cross?

--
========== "Hello World" in my programming language of choice: ATG - LET THERE BE LIFE - TAG ==========
Re:New State-Sponsored WINDOWS Malware. by Johann+Lau · 2012-08-09 09:01 · Score: 3, Insightful

Actually, it doesn't. Had those plants been running Linux workstations, the malware would target Linux. Likely without breaking a sweat.
May inspire a Windows exodus... by Kazoo+the+Clown · 2012-08-09 09:26 · Score: 4, Interesting

If these events cause mass flight from Microsoft products, the NSA or whoever wrote the darn thing might want to think twice before they go to Microsoft asking for any back doors or any other favors, I suspect Ballmer won't take too kindly to the idea of exploiting Windows in the name of national security if it takes a big ding out of their bottom line...
1. Re:May inspire a Windows exodus... by Anonymous Coward · 2012-08-09 18:14 · Score: 1
  
  I really doubt the NSA needs a back door adding. They probably have a list of 0days a mile long.
Clearly created by the US by qemqemqem · 2012-08-09 09:44 · Score: 1

Can't we just say sponsored by the US instead of acting like we don't know who created this?
1. Re:Clearly created by the US by biodata · 2012-08-09 10:45 · Score: 1
  
  It could be the Israelis, they created Trusteer Rapport, so they have previous here.
  
  --
  Korma: Good
2. Re:Clearly created by the US by tomhath · 2012-08-09 10:47 · Score: 1
  
  Because there's absolutely no evidence that it's anything more than a crude copy/edit of stuxnet or flame. The author speculates because parts were copied, but admits it's not as sophisticated as either.
3. Re:Clearly created by the US by ledow · 2012-08-10 00:00 · Score: 1
  
  Stupid thing to do. Because if I wanted to discredit another country, the most ingenious way would be to make it LOOK like they had done something, but that left subtle hints that it was them that created it.
  Queue years of wrangling to get to the bottom of who exactly created it, while some other (unknown) entity who actually wrote it just walks away without suspicion.
  We're talking international cyber-warfare here, aimed at nuclear processing plants. If I was making something like that, item #1 on my list of things to include would be obvious flaws and subtle hints to hint at another world nation being behind it. Hell, I'd deliberately have it written on machines with US codepages and English pathnames, even if the native language didn't translate into ASCII at all. In fact, especially if it didn't.
  In the same way, NEVER believe the US when they manage to link "attacks from China" - how the HELL do they know they originated in China at all if they don't know who wrote them? And what idiot WOULDN'T route their attacks on the US via somewhere like China to try to put the blame on someone else (hell, even the spammers have worked that one out!)?
  The US *want* me to think that China attacked them, for some reason. I don't know why. And the creators of Flame et al *want* me to think that it's an American-supported venture. Hell, if I was Iranian / Lebonese and clever enough, I'd attack myself just to make the "enemy" look bad and provide reason for "retaliation".
  Don't be naive when it comes to international politics and, let's face it, cyberwarfare / spying. Everyone's so quick to point at the NSA etc. when they think their email is being read or their OS backdoored, but nobody thinks that, actually, an *INTELLIGENCE* agency is likely to be much more sneaky than you give them credit for. And that an Iranian intelligence agency, for example, would be just as good as a US one (if not better).
"Only one infection has been found in Iran" ..hmmm by Swave+An+deBwoner · 2012-08-09 10:48 · Score: 1

Aside from 1,660 infections in Lebanon, 482 are in Israel and 261 are in the Palestinain territories, and 43 are in the U.S. Only one infection has been found in Iran.

Perhaps that one infection was the source of the other 2,446 infections?

Iran is a major player in Lebanon after all.
Internet terrorism by bmo · 2012-08-09 13:08 · Score: 1, Interesting

Countries that release stuff like this into the wild are criminal rogue states. It's like dumping agent-orange not just on the jungles of Vietnam during war, but on the entire planet as a whole.
There are no borders on the Internet. What you release is not limited to your target and affects everyone.
One can only hope that the governments that released Flame, Stuxnet, and now this, become victims of their own weapons.
Yes, I do know who that likely means. I certainly hope it comes back to bite us like a torpedo circling around and targeting its own submarine. Maybe then someone will learn a thing or two about not shitting where you eat.
--
BMO
1. Re:Internet terrorism by couchslug · 2012-08-09 21:44 · Score: 1
  
  I regard them as healthy, because unless herd resistance to such things is built up by exposure, the herd will be less robust.
  "One can only hope that the governments that released Flame, Stuxnet, and now this, become victims of their own weapons."
  That would usefully coerce them to adopt better practices.
  
  --
  "This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
2. Re:Internet terrorism by plover · 2012-08-10 10:13 · Score: 1
  
  The behavior of Gauss as described in TFA is made to sound like "socially responsible malware".
  By encrypting the payload with a key unique to a specific configuration, they are not providing that payload to anyone else. Not even Kaspersky can decrypt the payload, at least not until the target machine is identified. And by then it's probably too late.
  Sure, they're still sending out malware, with USB exploits, root kits, and other bad stuff. It's not that much worse than what is widely available online today. But they're encrypting the very worst part, which is "here's how we're going to cause maximum damage to you." We don't know if the payload is designed to tamper with SCADA systems, initiate wire transfers to a Cayman Island bank, or if it emails compromising pictures of the victim to Al Jazeera. Nobody gets a copy of it, except for one lucky winner. And he doesn't even want it.
  So in the attackers' minds, they can say they are distributing a "kinder, gentler virus".
  
  --
  John
3. Re:Internet terrorism by bmo · 2012-08-10 11:08 · Score: 1
  
  >It's not that much worse than what is widely available online today.
  As if malware today is benign. It's sent out by criminals, and states that do this are therefore criminal states. Collective punishment is a war crime in real life because it is indiscriminate. This is collective punishment in e-space.
  Why is malware being served up by a government any less criminal? Because it's a government? I'm not a teahadist, and I am not affected by this because I use linux, but I do object to people deliberately polluting e-space deliberately.
  --
  BMO
Re:Yet another part of the world getting pissed of by thmsdrew · 2012-08-09 23:42 · Score: 1

I made that mistake verbally in 4th grade when I didn't really know what the word meant. There was a kid in our class from Lebanon. We were talking about how you can tell where a person is from by the shape of their skull or something, so we were all shouting out different nationalities. I shouted "Lesbian!" Haunts me to this day.
Re:New State-Sponsored WINDOWS Malware. by Shompol · 2012-08-10 01:46 · Score: 1

Microsoft turns over all Win7 and server source code to Russia's new KGB
It's a do-it-yourself service: we give you the source code and you find the backdoors yourself.
Re:Yet another part of the world getting pissed of by bazald · 2012-08-10 05:33 · Score: 1

Yeah, the island of Lesbos isn't big enough to be considered a nation. Any 4th grader should know at least that much geography.

--
Insert self-referential sig here.