MalwareTech

From https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html, posted earlier:

<quote>
In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen).

I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis. This technique isn’t unprecedented and is actually used by the Necurs trojan (they will query 5 totally random domains and if they all return the same IP, it will exit); however, because WannaCrypt used a single hardcoded domain, my registration of it caused all infections globally to believe they were inside a sandbox and exit... thus we initially unintentionally prevented the spread and further ransoming of computers infected with this malware. Of course now that we are aware of this, we will continue to host the domain to prevent any further infections from this sample.
</quote>

blah alot of yours are ai and javascript stuffs..

i love rss and i mainly use it to stay up to date on sysadmin stuff..
https://hnrss.org/frontpage

https://news.ycombinator.com/showrss

https://hnrss.org/ask

https://hnrss.org/polls

https://www.reddit.com/r/technology+SCCM+DNS+virtualization+talesfromtechsupport+sysadmin+usefulscripts+homelab+itdept+powershell+Fedora+sysadmindiaries+devops+k12sysadmin+higheredsysadmin+netsec+linuxadmin+websec+networking+macsysadmin+worldnews+synology+AsahiLinux+NextCloud+apple+archlinux+openwrt+AZURE+wazuh+linux+mac+kde+ubuntu+linux4noobs+linux_gaming+nvidia+amd+macos+InformationTechnology+dell+msp+raspberry_pi+ubiquti+homelab+elementchat+proxmox+vyos+PrometheusMonitoring+pihole+MSI_Gaming/.rss

http://decentsecurity.com/blog?format=RSS

https://coffee-and-dreams.uk/feed.xml

https://derflounder.wordpress.com/feed/

https://fedoramagazine.org/rss

http://krebsonsecurity.com/feed/

https://krypted.com/feed

https://www.malwaretech.com/feed

https://managingosx.wordpress.com/feed/

https://matrix.org/blog/feed

https://orowith2os.gitlab.io/feed.xml

http://paradisefacade.com/?format=rss

https://sinrega.org/index.xml

http://eclecticlight.co/feed/

https://blog.vyos.io/rss.xml

https://worldofmatthew.com/index.xml

Keep in mind that Hutchins had no idea what registering the domain would do at the time of registration. It was pure dumb luck that it turned out for the best, it could very well have been a disaster. In fact he even admits that he went through a panic phase after domain registration where he thought he'd triggered the malware [1]. Which makes all the "He's a hero" articles bogus if not amusing to say the least.

"After about 5 minutes the employee came back with the news that the registration of the domain had triggered the ransomware meaning we’d encrypted everyone’s files (don’t worry, this was later proven to not be the case), but it still caused quite a bit of panic."

This nytimes article is just terrible. Absolutely terrible.
Sarah Jeong should be ashamed. After this and the way she treated Naomi Wu [2], I don't think I'm going to be giving her any journalistic credence.

[1] https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html

[2] https://medium.com/@therealsexycyborg/shenzhen-tech-girl-naomi-wu-my-experience-with-sarah-jeong-jason-koebler-and-vice-magazine-3f4a32fda9b5

> It says Windows, but is it x86 or x64?

x64

> Can it make a binary that's both x86 and x64 for Windows?

Seems to be a PE32+, so it won't run on 32-bit Windows.

> Is that even possible?

Yes, it should be. A 32-bit process on 64-bit Windows can run 64-bit code by changing the segment selector - make a far call or jump to 0x33:<address>. See [0] for more details.

There are some caveats though. kernel32.dll refuses to be loaded as both the 32-bit and 64-bit versions in the same executable. So the executable can probably only import ntdll. One thing one might do is just compile both a 32-bit and 64-bit version of the actual program as dll's and embed them inside the launcher and then extract and load them using only api's in ntdll. In the case of APE it would probably just embed an x64-on-x86 emulator and run the executable in that in case it's being run on x86.

Another solution might be to create a .NET AnyCPU executable which will run as 64-bit on 64-bit versions of Windows.

[0]: https://www.malwaretech.com/2014/02/the-0x33-segment-selector-heavens-gate.html

The point of the killswitch is to detect if the worm is running inside a sandbox. Some sandboxes will resolve any domain you try to ping, so an easy way to detect this is to ping a non-existent domain name. I'm not totally sure how pinging an existing domain would give you the same behavior, but doing something like checking a handful of random non-existent domains from a large list could do the trick.

From the sounds of it, it seems like the researchers didn't expect the killswitch to disable the malware outside of the sandbox any more than the author of the malware did[0].

[0]: https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html

OOP and Boost also Templates has benefits when it comes to increasing barrier of static reverse engineering.

For example, Security researcher "Marcus Hutchins" famously echoed that Boost is a cluster fuck of OOP sadness [0]

Similarly, a close friend of mine "Omer Yair" mentioned [1],

"A well written OOP malware might be harder to RE statically than a poorly written C code. Writing OOP malware badly though just makes it similar to C code so not sure of the benefits going that route."

[0] https://www.malwaretech.com/2017/04/the-kelihos-botnet.html
[1] https://twitter.com/yair_omer/status/1262020385203200000