Full Disclosure mailing list archives
Re: The Mystery of the Duqu Framework
From: Alberto Fabiano <alberto () computer org>
Date: Sat, 10 Mar 2012 17:43:14 -0300
On Sat, Mar 10, 2012 at 17:16, William Pitcock <nenolod () systeminplace net> wrote:
On 3/10/2012 9:00 AM, 夜神 岩男 wrote:On 03/10/2012 03:51 AM, fd () deserted net wrote:http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duqu_Framework Haven't seen this (or much discussion around this) here yet, so I figured I'd share.From the description, it looks like someone pushed some code from a Lisp[1] variant (like Common Lisp, which is preprocesed into ANSI C by GCL, for example, before compilation) into a C++ DLL. Normal in the deper end of Linux dev or Hurd communities, but definitely not standard practice in any established industry that makes use of Windows. I could be wrong, I didn't take the time to walk myself through the decompile with any thoroughness and compare it to code I generate. Anyway, I have no idea the differences between how VC++ and g++ do things -- so my analysis would probably be trash. But from the way the Mr. Soumenkov describes things it seems this, or something similar, could be the case and why the code doesn't conform to what's expected in a C++ binary.LISP would refer to specific constructor/destructor vtable entries as "cons" and there would be no destructor at all. The structs use vtables which refer to "ctor" and "dtor", which indicates that the vtables were most likely generated using a C++ compiler (since that is standard nomenclature for C++ compiler symbols). It pretty much has to be Microsoft COM. The struct layouts pretty much *reek* of Microsoft COM when used with a detached vtable (such as if the implementation is loaded from a COM object file). The fact that specific vtable entries aren't mangled is also strong evidence of it being Microsoft COM (since there is no need to mangle vtable entries of a COM object due to type information already being known in the COM object). If it looks like COM, smells like COM, and acts like COM, then it's probably COM. It certainly isn't "some new programming language" like Kaspersky says. That's just the dumbest thing I've heard this year.
Well, looks like COM, smells like COM , and acts like COM, but C++ is´nt the unique language that use COM, still has a way familiar... can be another language.
William _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
-- Alberto Fabiano C. de Medeiros alberto () computer org PGP Key ID: 232D3D06 - .... . -... . ... - .-- .- -.-- - --- .--. .-. . -.. .. -.-. -- .... . ..-. ..- - ..- .-. . .. ... - -- .. -. ...- . -. - .. - .- .-.. .- -. -.- .- -.-- k'bɪt Y> "The best way to predict the future is to invent it." --Alan Kay k'bɪt X> "Chance favors the prepared mind." --Louis Pasteur k'bɪt Z> "The world is full of fascinating problems waiting to be solved" --Eric S.Raymond _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: The Mystery of the Duqu Framework, (continued)
- Re: The Mystery of the Duqu Framework Andrew King (Mar 19)
- Re: The Mystery of the Duqu Framework Sanguinarious Rose (Mar 10)
- Re: The Mystery of the Duqu Framework William Pitcock (Mar 10)
- Re: The Mystery of the Duqu Framework coderman (Mar 10)
- Re: The Mystery of the Duqu Framework Christian Sciberras (Mar 10)
- Re: The Mystery of the Duqu Framework Valdis . Kletnieks (Mar 10)
- Re: The Mystery of the Duqu Framework coderman (Mar 10)
- Re: The Mystery of the Duqu Framework coderman (Mar 10)
- Re: The Mystery of the Duqu Framework William Pitcock (Mar 10)
- Re: The Mystery of the Duqu Framework 夜神 岩男 (Mar 11)
- Re: The Mystery of the Duqu Framework Alberto Fabiano (Mar 11)
- Re: The Mystery of the Duqu Framework coderman (Mar 11)
- Re: The Mystery of the Duqu Framework Marco Ermini (Mar 14)