Slashdot Mirror
Self-Destructing Virus Kills Off PCs
mpicpp sends word about particularly bad virus making the rounds, with this snippet from the BBC: "A computer virus that tries to avoid detection by making the machine it infects unusable has been found. If Rombertik's evasion techniques are triggered, it deletes key files on a computer, making it constantly restart. Analysts said Rombertik was 'unique' among malware samples for resisting capture so aggressively. On Windows machines where it goes unnoticed, the malware steals login data and other confidential information. Rombertik typically infected a vulnerable machine after a booby-trapped attachment on a phishing message had been opened, security researchers Ben Baker and Alex Chiu, from Cisco, said in a blogpost. Some of the messages Rombertik travels with pose as business inquiry letters from Microsoft. The malware 'indiscriminately' stole data entered by victims on any website, the researchers said. And it got even nastier when it spotted someone was trying to understand how it worked. 'Rombertik is unique in that it actively attempts to destroy the computer if it detects certain attributes associated with malware analysis,' the researchers said."
A virus that evades detection is supposed to have no noticeable effects, not obvious ones like rebooting. And how well does something on your email attachment really "resist capture"?
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
This seems like it would be incredibly simple to analyze the second time around. Offline backup into a VM and snapshotting would render the auto-destruct very educational.
This was an obvious evolutionary next step
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Of all the destructive things one could do, it rewrites the MBR? That's it? That's fairly easy to fix, and your data is still easily intact by copying it with a second machine.
To be honest, a much more dangerous one would be one that sits dormant for, oh, say six months or so. In doing that, it gets itself into all of your backups (if you have any), and now you're going to have trouble separating your data from the virus. If it then activates a random amount of days (1-14) after being restored, it's not obvious which backups are infected and which ones aren't.
Of course, this is all purely theoretical, and I highly discourage anyone from actually implementing this - it's just an idea...
"Set a man a fire, he'll be warm for the rest of the night. Set a man afire, he'll be warm for the rest of his life."
A computer is not "destroyed" if you have to repair the MBR or reinstall Windows. It may be a pain to do, but the computer itself is fine.
Does nothing to the machine at all, just attacks the operating system ...not news ...
Puteulanus fenestra mortis
This malware is very hard to detect under normal conditions. But it is outfitted with counter measures. When it detects activities that are consistent with malware detection, study and or/and removal it responds in many destructive ways. It makes it difficult for a white hat to suss it. But, no, it does not give itself away by cutting up rough. It only starts the visible signs of infection when it deems the jig is up anyway.
There is a very good (and somewhat scary) article from The Register. on Rombertik.
This is as nasty a piece of work as you will ever not wish to see anywhere near your equipment.
"No fear. No envy. No meanness." Liam Clancy