Slashdot Mirror
Marcus Hutchins' Code Used In Malware May Have Come From GitHub (itwire.com)
troublemaker_23 quotes ITWire: A security researcher says code has been discovered that was written by British hacker Marcus Hutchins that was apparently 'borrowed' by the creator of the banking trojan Kronos. The researcher, known as Hasherezade, posted a tweet identifying the code that had been taken from Hutchins' repository on GitHub.
Hasherezade also found a 2015 tweet where a then-20-year-old Hutchins first announces he's discovered the hooking engine he wrote for his own blog -- being used in a malware sample. ("This is why we can't have nice things," Hutchins jokes.) Hasherezade analyzed Kronos's code and concluded "the author has a prior knowledge in implementing malware solutions... The level of precision lead us to the hypothesis, that Kronos is the work of a mature developer, rather than an experimenting youngster."
Monday on Twitter Hutchins posted that "I'm still on trial, still not allowed to go home, still on house arrest; but now I am allowed online. Will get my computers back soon."
Hasherezade also found a 2015 tweet where a then-20-year-old Hutchins first announces he's discovered the hooking engine he wrote for his own blog -- being used in a malware sample. ("This is why we can't have nice things," Hutchins jokes.) Hasherezade analyzed Kronos's code and concluded "the author has a prior knowledge in implementing malware solutions... The level of precision lead us to the hypothesis, that Kronos is the work of a mature developer, rather than an experimenting youngster."
Monday on Twitter Hutchins posted that "I'm still on trial, still not allowed to go home, still on house arrest; but now I am allowed online. Will get my computers back soon."
So he's criminally negligent.
and she wouldn't give it to me!
All Heil GROUPTHINK
Smith and Wesson have an awful lot to answer for then.
This just reminds how important it is to keep the code you write secure so that it will not be used by hackers.
Bouncing through a stack buffer is not generally atomic in any way. Just pad your data to 8 to begin with.
If the code existed before on a public resource, it clearly raises a reasonable doubt.
The old GTA3 era multiplayer mods, TES3: Morrowind's 3rd party graphics updates, all the work done to support windows 3.1/win9x era games on windows xp, vista, 7, and above.
All of these have required function hooking techniques and dll overrides in order to work. Many of them required because of microsoft changing the functional operation of existing functions rather than creating unique iterations of them/versioned libraries as they did with later dx9 releases (dx3-9 at least involved breakage of various core functions during directx upgrades, some of which caused whole classes of applications to break, whether due to non-standard usage of functions, improper documentation/examples on microsoft's part, or accidental breakage of functions later on which made it to release without being fixed.)
The result being that hooks and dll overrides are common for all sorts of legacy applications just to ensure they continue working.
This is the FBI, fer crissakes! The guys who were deeply, deeply penetrated by the Chinese military intelligence during the Clinton/Bush administrations (and are probably still in control). And then there is this: https://www.wired.com/2016/02/... http://www.cnn.com/2016/02/08/... http://fortune.com/2016/02/09/...
The code is code for a service intercept. Those can be tricky to get right, but are used in all manner of system enhancements, are not primarily useful for malware at all.
Intercept code I have used in the past:
* Added time, place, privilege level, and called-by-code conditions to file accesses
* Allowed file open to alter the running priority of processes
* Allowed failed access for some of the above to optionally open a different file, transparently
* Allowed files stored on backing storage (tape, network, disk, compressed files) to transparently appear local and present (or to be migrated to such storage)
* Allowed file extension or creation that would use space to trigger "get space" processes
* Allowed user mode undelete operations
* Allowed control of storage space use to minimize storage fragmentation
* Allowed controls based on access rate
These and more useful kinds of extensions are among things that can be implemented with an intercept. Not one of these has anything to do with malware.
So kindly stop and think a bit before claiming the code was done to help malware function.
A malware developer not posting his malware on GitHub under his own name, I'd imagine.
He's a proven maker of "hacking tools", so off to the slammer already.
Github is also a hoster of "hacking tools", so part of the conspiracy, and therefore needs a helping of that good old zero tolerance.
I'd love to go to America to visit yellow stone... but this kinda shit puts me off. Massive jails and anyone vaguely doing computer security is a criminal unless in top secret government 3 letter agency.
It's about time we get some GPL'd malware! ;)
Anons need not reply. Questions end with a question mark.
Wait, he's on house arrest in someone else's house?
Translation: "What are you hiding!? I must assume you are guilty because authority said so and I'm a complete idiot."
There are plenty of reasons why a function hook is used. Hell the bioses of many computers used it to add support for hardware that the OS would have needed drivers written for. (Hell, on that note, Hardware Interrupts in general could be considered function hooks.) Most of the time a function hook is used because it's not the programmers code, or the source is unavailable, design limitations prohibit altering the existing code permanently, or because the original functionality is still needed in some cases.
Not all uses of function hooks are for malicious purposes. It's a normal programming technique, and labeling it as "evil" is tantamount to declaring all programming as "evil" because it could have malicious intent. Which if you are going to cast such a wide net, I would suggest reconsidering your use of computers for any purpose. That or maybe take the time to study what you are railing against so you can make a better argument.
Without the nexus of a (financial) transaction with the perpetrator it is rather difficult to prove a conspiracy to violate the computer fraud and abuse act.
For treasonous crimes like this, they lock you in Bieber's house.
Everything is meant to be modified sooner or later. Your statement falls apart if one single valid reason is shown.
Registry and file monitoring, notifications for printer status require hooking and are perfectly legal if done by the user.