News for hackers. Stuff that matters.

A comment on Accidentally Stopping a Global Cyber Attack.

Re:Accidentally Stopping a Global Cyber Attack by johnchristopher on Saturday May 13, 2017 @09:05AM (#14330742)
> After about 5 minutes the employee came back with the news that the registration of the domain had triggered the ransomware meaning we’d encrypted everyone’s files (don’t worry, this was later proven to not be the case), but it still caused quite a bit of panic. I contacted Kafeine about this and he linked me to the following freshly posted tweet made by ProofPoint researcher Darien Huss, who stated the opposite (that our registration of the domain had actually stopped the ransomware and prevent the spread).

That's quite an high abstraction level programming thing to do to use a domain name registration state as a boolean. Is that a regular thing ?

[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by stefanpie on Saturday May 13, 2017 @09:46AM (#14330936)
I believe the malware was designed to do that as part of a way to test and see if it's in a sandboxed environment if someone was trying to analyze it. If I understood this correctly, checking the domain was a way to do that (although I might be completely wrong).
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by Laforet on Saturday May 13, 2017 @10:21AM (#14331117)
Can somebody explain how this will work? AFAIK it does not even check for obvious things such as vmware processes running in the background.
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by mynameisvlad on Saturday May 13, 2017 @11:22AM (#14331415)
It was explained quite clearly in the article. Sandboxed environments will generally have a catch all that replies to any IP requests with a sinkhole server. To prevent analysis, it'd do a lookup to a known unregistered domain and if it got back an IP address (which should not happen except in the sandbox with an unregistered domain) then it quits because it assumes it's sandboxed and being analyzed.
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by meowface on Saturday May 13, 2017 @03:23PM (#14332538)
I still can't understand how the malware authors could be so smart (or, if not smart, at least competent enough to build ransomware from scratch, make it wormable with ETERNALBLUE, and launch a massive and effective spam campaign) and yet so stupid.

They could've achieved the same sandbox detection effect by just registering the domain and pointing it at 1.1.1.1 or whatever. The non-sandboxed connections would still fail, and no one else could take the domain.

[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by BoorishBears on Saturday May 13, 2017 @06:12PM (#14333274)
I don't think the creator would be too keen to create anything unnecessary that could be linked back to them through a paper trail.
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by Avalyst on Sunday May 14, 2017 @06:57AM (#14335091)
I find it interesting that they didn't randomize a couple of long strings and tried to resolve those instead like the article mentioned has been done in the past
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by iainmerrick on Monday May 15, 2017 @11:29AM (#14342320)
They could've achieved the same sandbox detection effect by just registering the domain

That would leave a paper trail, potentially revealing who's behind the malware.

[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by rurban on Sunday May 14, 2017 @09:14AM (#14335483)
You wouldn't do that with a .com domain, rather with a .local domain or such.
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by hobofan on Saturday May 13, 2017 @11:46AM (#14331517)
I would guess that a simple DNS/HTTP works just as well. In contrast checking for vmware processes or similar would probably result in a code signature that can be picked up much more easily by malware scanners.
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by lionyo on Saturday May 13, 2017 @11:18AM (#14331397)
Sometimes sandboxes resolve all DNS, so if you point to to a nonsensical URL and it resolves, then you may be in a sandbox.
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by misterdata on Saturday May 13, 2017 @11:27AM (#14331434)
More likely used during testing by the author itself?
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by Retr0spectrum on Saturday May 13, 2017 @09:14AM (#14330792)
I'm not really sure what you're trying to say, but reading the rest of the article will answer your question.
[ Parent | on HN ]
[dead]
Re:Accidentally Stopping a Global Cyber Attack by Retr0spectrum on Saturday May 13, 2017 @09:58AM (#14330990)
All I understood was that you seemed unsure about the purpose of the domain check, so I pointed you in the right direction. Sorry if that came off as condescending.
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by johnchristopher on Sunday May 14, 2017 @07:56AM (#14335249)
Well, since you didn't mean it then I am the one who is sorry. I have obviously misjudged you, overreacted and misunderstood your phrasing.

I apologize and will try to do better next time.

[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by tomcam on Saturday May 13, 2017 @05:09PM (#14333040)
Did not register as condescension to me
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by JdeBP on Saturday May 13, 2017 @06:21PM (#14333306)
It's a fairly regular thing. If you are a Google Chrome user, then your WWW browser has been doing much the same check, for fairly similar reasons (detecting whether it is running inside an environment where DNS service is being generally altered to redirect clients to a special server), for the past half decade.

* https://mikewest.org/2012/02/chrome-connects-to-three-random...

[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by nthcolumn on Saturday May 13, 2017 @09:47AM (#14330943)
I think that it is more likely that there was meant to be something else on the other end which did something but x0rz got there first so it broke.
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by 21 on Saturday May 13, 2017 @09:35AM (#14330878)
I think a distributed global database is a more appropriate analogy.
[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by sinaa on Saturday May 13, 2017 @09:12AM (#14330783)
This may well give birth to a new paradigm: Domain-Driven Programming.

Each condition is satisfied by a different domain lookup.

[ Parent | on HN ]
Re:Accidentally Stopping a Global Cyber Attack by Demiurge on Saturday May 13, 2017 @09:26AM (#14330828)
Wow, now, let us imagine using aggregation of millions of states of human minds as a Boolean constant used in millions of scenarios for about four years straight.
[ Parent | on HN ]