Slashdot Mirror
High Level Coding Language Used To Create New POS Malware (isightpartners.com)
An anonymous reader writes: A new malware framework called ModPOS is reported to pose a threat to U.S. retailers, and has some of the highest-quality coding work ever put into a ill-intentioned software of this nature. Security researchers iSight say of the ModPOS platform that it is 'much more complex than average malware'. The researchers believe that the binary output they have been studying for three years was written in a high-level language such as C, and that the software took 'a significant amount of time and resources to create and debug'.
C is a high level coding language now?
I guess contrasted with the way that one guy in last week's Q&A asked Brian Kernighan about "low level languages like Haskell" ?
Not to iDefense, er, iPartners, or whoever they are now.
nothing to see here - move along
I think they're misusing the term "high level" when it comes to programming languages. I suspect what they're trying to get at is that it's sophisticated and competently coded.
I wonder why they assume it's C and not C++, incidentally, since they're presumably looking at decompiled assembly? I haven't done much C vs C++ side-by-side analysis of the two... is there an obvious difference in the generated assembly? I guess maybe v-table structures would point to C++, where C programmers likely wouldn't invent such constructs.
Irony: Agile development has too much intertia to be abandoned now.
The "level" refers to the level of abstraction away from how the underlying machine operates, it's an inherently relative concept. Relative to the "binary output they have been studying for three years" C is indeed a high level language.
that you need to call it out?
With everything going modular these days, I'm sure there's a lot of hand written assembly exploit code that then pulls down modules likely written in C. Not that it's good or bad, just odd to call it out.
With paths like this embedded in the binaries, I'd question that statement:
High Level Editors Used to Create POS Blog Site Called "SlashDot"
FTFY
I'd probably stick to thousands......there are some programmers out there that really aren't that skilled.....at least not in programming.....cut and paste, maybe.
If the state of software engineering has arrived at the point that so many honest-work programmers are being forced to spend so much time writing quick and dirty garbage to get them past the next sprint that, in order to have a job writing good clean code, they have to go black hat.
Since it wasn't machine code or assembly language. Anything that needs a compiler is, by definition, a high-level language.
Interpreted languages and intermediary languages don't rank on this scale at all. They're far above the definition of high-level.
Seriously, doesn't anybody teach this stuff in Introduction to Computer Shit 101 anymore?
I have a name for them, Google search programmers.
I don't know, but earlier today they'd discovered that an old mechanical computer is in fact a mechanical computer and it's probably quite old.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
C is a high level language, like a 9 mm handgun round is high velocity ammunition.
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
Until you find an emulator developer who complains that the emulator in a Nintendo product "is incredibly inefficient, written in HLL code, developed by somebody whom knew nothing about emulation nor about ARM nor about Z80/8080 processors." (This refers to C, as early C compilers targeting this product generated inefficient code.) Also a reset mechanism in Nintendo DS hardware "allows the NDS7 debugger to capture accidental jumps to address 0, that appears to be a common problem with HLL-programmers, asm-coders know that (and why) they should not jump to 0."
By definition, if it's malware, it's a POS. Even if it's written well.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
Since this malware was such a POS, it did no damage.
Do you mind going back to posting in the Federal Register where your comment makes some sense?
Faster! Faster! Faster would be better!
This new piece of malware shows sophistication of design, but that's not unheard of. Older malware was often customized by compile time switches and definitions; this just abstracts some of that away.
Many people (i.e. journalists and managers) think of malware authors as pimple-faced script kiddies hacking in their mothers' basements. They think that large, well-designed projects require teams of skilled developers who would only do so for a fat paycheck.
What's happened now is that vulnerabilities are so profitable that the threat landscape is no longer the exclusive domain of the single hacker - criminal gangs want a piece of it. They can afford to pay team salaries to engineer a solution.
And malware authors have learned to avoid the biggest risks of getting caught. In the old days a virus writer would also be the distributor. Modern authors get paid by selling their exploit code, along with customization and support contracts, to gangs of attackers. The attackers take on the risks, the developers collect fat checks. In some cases of vertical attacks (ATM skimmers for example), the "owner" of the malware uses cryptography to encrypt the skimmed data, preventing the low-level attackers from profiting from the stolen data. The profits go to the top first, and the paychecks cascade down (assuming honor among thieves.)
So what's newsworthy here is that they believe this malware to be further evidence of a new breed of well organized criminal software developers.
John
What Operating system does this sophisticated malware platform run on?
Just shows that if you don't have the skills, code you write even in C# will still be a POS. Oh wait.
No. In his English he is capable of comprehending the use of the indefinite article. Hint: it's not necessary in that particular instance. Apparently your an English has a different rules.
Comment removed based on user account deletion
However standard practice for skilled computer criminals is to release their programs to script kiddies, so that the many script kiddie attacks will help to obfuscate a hide the organised crime attacks.
This would seem to indicate that programs that contain encrypted elements might well have to be banned as it will make much easier for security programs to simply block the installation of all programs that contain encrypted elements, that the user is blocked from checking with a security program.
Chaos - everything, everywhere, everywhen
You can strip a lot of that stuff out, but you'd be surprised how many people don't bother. The function names for shared libraries won't be stripped out, though, and shared libraries get called a lot in typical software.
"First they came for the slanderers and i said nothing."
Somebody coded another piece of shit malware?