High Level Coding Language Used To Create New POS Malware (isightpartners.com)

An anonymous reader writes: A new malware framework called ModPOS is reported to pose a threat to U.S. retailers, and has some of the highest-quality coding work ever put into a ill-intentioned software of this nature. Security researchers iSight say of the ModPOS platform that it is 'much more complex than average malware'. The researchers believe that the binary output they have been studying for three years was written in a high-level language such as C, and that the software took 'a significant amount of time and resources to create and debug'.

Comments

High level?

[Anonymous Coward]

C is a high level coding language now?

I guess contrasted with the way that one guy in last week's Q&A asked Brian Kernighan about "low level languages like Haskell" ?

Re:High level?

[GrumpySteen]

C is a high level coding language now?

Depends on how old you are.

Re:High level?

[hey!]

Speaking as someone who learned C in 1980, C was originally thought of as a low-level language -- a suitable replacement in most cases for assembly language that, while abstracting underlying details like the CPU instruction set and registers, remained relatively small and "close to the hardware". Then later 80s I was asked to take over a course on C, and when I looked at the course description I was surprised to see it described as a "high level language". I asked the person who wrote the description what he meant by "high level language", and he really had no idea. He said he meant it was "powerful", which of course is just as vague when comparing any two Turing equivalent languages.

Of course "high level" vs. "low level" is relative. C is "high level" in comparison to assembly, or "B", in which the only datatype was a computer word. On the other hand C "low level" in comparison to most other languages that hide away the details of the hardware like instruction set and registers and such. So it depends on what you're comparing to; but in general I think people who describe C as "low level" know more about what they're talking about than those who call it a "high level" language.

The important thing isn't whether C is "high" or "low" level; it is what makes C work, which is largely about what was left out. It didn't have all the bells and whistles of something like PL/1, which made the language easy to implement, even on a tiny 8 bit microcomputer, and easy to learn, in the form of a slim, almost pamphlet-like book (The C Programming Language, 1st edition was 228 paperback-sized pages long).

Even so, C has become very slightly more "higher level" over the years. The original K&R C was more weakly typed than the later ANSI C. Particularly when you were dealing with pointers, the declared type of a pointer in K&R C was more of a mnemonic aid to the programmer than anything else.

C is high level?

[Dutch Gun]

I think they're misusing the term "high level" when it comes to programming languages. I suspect what they're trying to get at is that it's sophisticated and competently coded.

I wonder why they assume it's C and not C++, incidentally, since they're presumably looking at decompiled assembly? I haven't done much C vs C++ side-by-side analysis of the two... is there an obvious difference in the generated assembly? I guess maybe v-table structures would point to C++, where C programmers likely wouldn't invent such constructs.

Re:C is high level?

[vux984]

is there an obvious difference in the generated assembly?

There would be in most projects that were not outright trying to obscure they were using C++.

Its been a while since I looked at disassembled code, but you used to be able to easily tell what compiler and even version of that compiler was used just from the boilerplate setup code; the way things were 'arranged', exception handlers etc, and obviously library usage was frequently a dead giveaway. Your not going to see a either an iostream or an STL container in a C program.

Re:High level or low level?

[Anonymous Coward]

The "level" refers to the level of abstraction away from how the underlying machine operates, it's an inherently relative concept. Relative to the "binary output they have been studying for three years" C is indeed a high level language.

It would be ironic

[Ukab the Great]

If the state of software engineering has arrived at the point that so many honest-work programmers are being forced to spend so much time writing quick and dirty garbage to get them past the next sprint that, in order to have a job writing good clean code, they have to go black hat.

Re:It would be ironic

[DigiShaman]

Regardless of the zeitgeist of how ruthless the IT industry intrinsically is, we're all held accountable to our own actions. If you go black hat, nothing *made* you do it. The correct response would be to find another occupation entirely; even if that means digging ditches.

Redundant: POS Malware

[sconeu]

By definition, if it's malware, it's a POS. Even if it's written well.

Re:Gun analogy

[ColdWetDog]

Sure, but they both hurt like hell when you shoot yourself in the foot with them.