Slashdot Mirror

← Back to Stories (view on slashdot.org)

Malware Used in Aramco Attack Likely Work of Amateurs

Posted by Unknown on from the insult-injury dept.

wiredmikey writes with this excerpt from Security Week: "The Disttrack/Shamoon malware, while destructive, appears to be the work of amateurs and not elite and sophisticated developers, according to the latest analysis. The malware proved that it was possible for developers to subvert legitimate kernel-mode applications for malicious purposes, but it appears that the malware could have been even more destructive and dangerous, if it had not been for a series of programming mistakes in the code, according to recent analysis from Kaspersky Lab. Other suggestions that the developers behind the Shamoon malware are not high-profile programmers include that the command-and-control server is hard-coded as two addresses, which limits the tool since if the address ever changes, the infected machine can no longer receive instructions. The developers were most likely motivated by political reasons, as the malware overwrote existing files with a fragment of an image of a burning American flag. The Malware has also been reported to be linked to the recent Saudi Aramco attack, which some reports have suggested that insiders may have been partly involved. Saudi Aramco hasn't officially said what type of malware hit its systems."

6 of 18 comments (clear)

  1. What gave it away? by puddingebola · · Score: 1

    Was it the part where it launched Space Invaders?

  2. Mmmmmm...Mustamova by Impy+the+Impiuos+Imp · · Score: 1

    > The Disttrack/Shamoon malware, while
    > destructive,appears to be the work of
    > amateurs and not elite and sophisticated
    > developers

    Or...it's the work of extremely elite developers. Now that the cat's out of the bag that the major powers are actively engaged in cyber warfare...

    --
    (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
    1. Re:Mmmmmm...Mustamova by Gilmoure · · Score: 1

      Wiait, did they or did they not have accredited degrees in Hacking and/or Cracking and were they licensed contractors with the state?

      --
      I drank what? -- Socrates
  3. Learn from mistakes by Mr10001 · · Score: 1

    It's great to know they made mistakes, however... now they can learn from them?

  4. Re:The culprit by kelemvor4 · · Score: 1

    "It compiles. Ship it!"

    No, the summary clearly indicates that this code was written by amateurs rather than professionals.

  5. Forwarded email to Dmitry Tarakanov by tlambert · · Score: 1

    Hi Dmitry! Thanks for the great code review! If you could please look at the new patches we've put up on github, and sign off on them, then the changes can make next Monday's release!

    Seriously, how stupid is publishing this stuff?