I would think not. For something bad to happen from registering the domain, there would have to be some kind of weird booby-trap in the malware. What's the motivation for a malware author to do that? If they can do something worse, the incentive is to just do it, rather than wait for a security researcher to do something first that they may or may not ever do. It's not impossible, but it's a little ridiculous and wildly unprecedented in the field of malware analysis.

When there's a global infection spreading wildly and crippling essential organizations, you want everyone to act fast, not spend weeks making sure everything is perfect. If you see the malware connecting out to an unregistered domain, you just register it now. Whoever is first gets it, and the attacker could realize their mistake at any time. Even without knowing what this malware does with the connection, odds are 99.9% that the situation is better with the domain controlled by a security researcher than by a malware author. Punishing researchers if something done in good faith turned out badly would incentivize them to overanalyze everything and delay taking any potential beneficial action until it's too late.

Under that same assumption of assuming maximum damage, what was the motivation for the malware author to put in a killswitch?

The theory is that the malware wouldn't execute in sandboxes for malware analysis, since the analysis environment will accept all connections from the sandbox.

So, if connection = successful, then we're being analyzed and don't execute.

If connection = unsuccessful, then we're on a real workstation, execute!

Then the scheme fell apart when someone registered that domain, so all connections = successful and malware will not execute (but machine still infected).

Probably to prevent it from fucking their own computer network up. Just change your local resolver to be authoritative for the domain(s) in question, and bob's your uncle.

But next they'll likely use more domains, and more expensive ones, so that random security researchers can't just expense the registration on the corporate credit card. I know .ng costs 50k, but .np might be pretty comical to deploy if you're not really worried about a global off switch.

If that's the motivation, just use a non-existant TLD, or, even better, .local

If the motivation is to have a killswitch, you don't want something expensive, because the attackers would then have to pay for it if they want to activate it for whatever reason.

.ng domains cost a few hundred bucks per year, the times when they cost >10k are long gone

The motivation for the domain check is to see if you are in a sandbox environment, and if you are, don't do anything. If you read the article, he talks about this.

The end of the article suggests it's an attempt to detect sandboxed environments that fake all domains.

I don't think that's a thing. And certainly not a common enough thing to use as a sandbox evasion technique. The sandbox is either connected to the internet or to a proxy that replays past connections.

Seems like a reasonable thing to do on a sandbox specifically set up for the purpose of analyzing malware. It's not helpful to just block all connections, because you want to see what it's trying to connect to and what it's trying to send there. You don't know what it's going to try to connect to, so you can't redirect only specific things. Letting it connect to the actual internet is obviously just crazy. Redirecting everything to an internal honeypot sounds pretty reasonable.

Maybe I'm wrong, but I would guess that sandbox evasion techniques aren't intended to stop one-off reverse engineering, but rather to get around the bulk programmatic analysis that Google or FireEye does. Those require an internet connection or a replaying proxy because a lot of modern malware comes as a minimal package that downloads its payload from the web.

I would hope sandbox environments aren't connected to the internet, spreading malware to others while your doing your research.

A responsible researcher would have a fully isolated, both from the corp net, and the internet. Then will slowly being to allow connections out as they can confirm that's not how it's spreading...

Many sandbox environments resolve whatever they're queried for with the same IP address. This is addressed in the article.

How many ISPs spoof failed DNS queries so they can feed you ads? That alone would make this useless as an evasion technique.

It means the malware would not execute for users on those ISPs because they false-positive for being a sandbox; that doesn't make it useless unless every ISP is doing that.

OTOH it means that laptops won't activate until they are on a work network, for an SMB worm that's probably not a bad strategy.

Clearly not that many considering how well it did manage to spread.

Somebody else hijacking the c&c servers?

Security researchers absolutely should have liability for poking malware in the wild on their own initiative.

If you're a bomb enthusiast or researcher, you'd absolutely be liable if you tried to defuse a bomb without being requested to by the police. This is no different because of the potential for massive collateral damage. You want to see what happens when the domain is registered? Resolve the DNS on your own network.

It's only when acting under government direction that you should be immunized from liability.

>>It's only when acting under government direction that you should be immunized from liability.

Why? I 10000% disagree that the Government should be immunized from liability in the first place. This entire mess is a direct result of the NSA not being held accountable and hoarding Vulnerabilities.

Your reliance on government == good, everyone else === bad is alarming to me.

That said, I do not believe neither the government nor a Research should be held liable under the circumstance proposed in the hypothetical we are discussion.

I do believe the NSA should be required by law and policy to alert any and all software vendors to vulnerabilities they discover.

Whew, you almost got me. :-)

Got all riled up and then saw the username.

Enjoy!

I was being serious.

I am curious why you disagree with me, though.

Folks disagree with you for the same reason they pass [good samaritan laws](https://en.wikipedia.org/wiki/Good_Samaritan_law): intent.

A bit more econo-mathematically stated: we expect more good than bad to come by us if we indemnify them from whatever liability they may have had by accidentally triggering the mechanism. Perhaps because there's more smart people outside the government than inside it, just as there are more smart people outside any corporation than inside it, or anywhere really, because human ingenuity is widely distributed.

My exact point was that this was closer to diffusing a bomb you happen across than a good Samaritan law because of the collateral damage potential, which we normally assess the tradeoffs of through collective means such as government, and because it's a non-emergency situation.

Good Samaritan laws only apply to emergency care rendered to people in need of it (and only if they don't refuse). You wouldn't even be covered if you grabbed someone's broken arm and tried to set it without permission. (That would actually be assault, for which you'd be liable.) You definitely wouldn't be covered if you unilaterally released a protein in to the atmosphere because you suspected it would stop the flu. You'd probably get charged with using a WMD if it backfired and people got sick.

I think people who are arguing that it's a good Samaritan situation are simply being selfish, because they don't want to have to consider how their actions might impact others or act with restraint and professionalism.

There are plenty of ways to proceed with getting help from security consultants even if there is liability -- eg, confining their actions to a single network and being indemnified by the owner.

Globally poking a widespread infection without a care in what the infected prefer is emphatically not what Good Samaritan laws are meant to protect and should carry global liability.

Ed: To address the question under me, since I'm "posting too fast" --

My problem is that many of these FBI programs exist in a legal limbo -- the researchers are working with the government, but I'm not sure they have the kinds of immunization agreements that government contractors usually get (eg, that you have to sue the government not the contractor since the actions are taken under government authority because you're working for the government) nor that they have to observe the restrictions placed on government actions. Too much of cyber security exists in these (intentionally) gray areas.

I dislike this Wild West state of affairs and want the matter of liability and restrictions/accountability to be directly addressed, even if it's just making de jure the de facto situation. I think cybersecurity, as currently practiced, is probably ripe for some nasty lawsuits if a researcher screws up a situation like this.

Does anyone believe that if the registering the DNS address had bricked the NHS systems, the NCSC would've taken the fall?

Setting the good Samaritanness aside, In the NHS situation, is it really plausible that there was more 'bomb' to go off to justify restraint? And given that the researcher had explicit support from the FBI and NCSC, do you think there is some level of professionalism not met?

> Does anyone believe that if the registering the DNS address had bricked the NHS systems, the NCSC would've taken the fall?

Since you seem to take the possibility seriously, what benefit would the authors of ransomware derive from that? Some sort of game theoretic red-wire to slow down forensics?

Anti-tampering mechanisms on C2 systems, using the data/computer as a hostage. You're not trying to slow down analysis, you're creating a consequence for tampering with DNS C2 records.

I think malware authors derive a game theoretic advantage by having tampering with DNS C2 systems result in data loss, because a non-trivial portion of people will prefer to pay and retrieve their data. Some of the frustration from that will be pointed at the people who actually tripped the switch.

Further, because of the current legal status, if a security researcher issues the command to the DNS C2 system that deletes the data (by messing with the DNS records), not the malware authors, they're quite possibly liable for the data loss, going to face hacking charges, etc. (Hacking charges because they knowingly issued commands to malware that gave them unauthorized access to computer systems.)

I don't believe that security researchers should be the ones making that call -- I think the only sane way to make it is through collective mechanisms like government.

>I don't believe that security researchers should be the ones making that call

It is said that there is no problem in computer science which cannot be solved by one more level of indirection.

http://wiki.c2.com/?OneMoreLevelOfIndirection

Just make someone else responsible for it. Problem solved.

The same government that can't be bothered to update their systems?

Yes.

Read my other comments for a more nuanced view discussing how it would play out in the real world, with changes relegated to particular networks and trade groups making deals for systems under their control.

But the only groups that should be able to authorize decisions about other people's things (free of liability or possible prosecution) are groups under collective control, ie governments.

Really?

Imagine a person in a locked building with ticking bomb, authorities are nowhere in sight. People, including loved ones, are vulnerable.

Should that person just wait and do nothing for the fear of you, sir, SomeStupidPoint, had created a law that holds that person accountable if something goes wrong?

Its her life and your law doesn't mean a thing, if not downright unethical and tormenting. She has every right to try to defuse or shield the bomb.

Should the IT departments of fortune 500 companies not try to respond and save their assets or should they just wait for Authorities?

You think a ticking time bomb is a crime scene, I think of it as a self-defense situation that hasn't played out completely yet. She has full right to self-defense, successful or not.

Look, ma, words on paper, that must stop bad things from happening right? Ma? Maaaa?

For the first part I just thought that you might don't understand a few things about how the internet works, but when you then wrote

> It's only when acting under government direction that you should be immunized from liability.

I also thought that you meant it as a satire.

Anticipating your next question, can I ask what kind of internet police he should have asked?

If you think that you're causing a net positive, then you should be able to monetize some of that value to cover the damages or otherwise negotiate to be indemnified by stakeholders.

I don't think globally releasing changes meant to tweak malware is a good idea, because of jurisdictional issues and liability. Down thread, I suggest confining changes to a network and indemnification from network owners (who may in turn be indemnified by network subscribers).

In practice, this would look like trapping malware DNS queries to security researcher controlled servers at the Comcast network DNS level, rather than registering a global name for it, with the researchers being indemnified by Comcast (who likely is indemnified as part of your subscription agreement).

This has well tread liability law behind it and moves us out of the situation where every random group feels free to potentially cause harm to hundreds of thousands or millions of computers across the globe because they're "good guys" and shoot from the hip.

I expect that network operates would quickly establish industry groups and a certification process for getting researchers to help protect their networks, and we would quickly be back to mostly the same situation, sans questionable legality. (They likely would be liable for occasional collateral damage and pay that out of industry membership dues to the group.)

So,

A good Samaritan must know all workings of the malware, including trip wires, actual triggers and threat scales. And, must know if any threats that get released (not yet in sandbox) as a consequence of his investigations.

A good Samaritan must seek and get all necessary approvals using a procedure and checklist. If such procedure, checklist and inventory of authorities to seek approval from does not exist, the good Samaritan should immediately embark upon the task of defining one. Fully realizing that just creation of such listing would require constitutional amendment.

A good Samaritan should be able to look away from current mayhem (patient support systems, ambulances, public infrastructure collapsing) while above things are settled first.

On an existing command chain, sure, up to a point. US doesn't have any control if someone at Kaspersky had done it or some kid in Asia trying to understand how it works.

What you are proposing is going to make people on good side to disengage at the thought of prosecution. You would be shooting your soldiers for not successfully defending you. Worst, you would shoot enemy of your enemy for triggering the common threat.

The control that you desire goes against nature. Unless you put every single human being in matrix, you won't have that control.

> Would the security researcher be held in any way accountable for activating the ransomware?

I think that would be the equivalent of an arsonist also leaving a water activated chemical at the scene of the fire, and then blaming the firemen for using water to put out the fire when it made the situation worse.

The ransomware was already active for hours by that point. The answer the employee provided did not make any sense. Not now, not the first time I read the blog.

That's what bugs me about the blog post but it may only be an issue with how it's written or my understanding.

From the Talos Intelligence blog:

>The above subroutine attempts an HTTP GET to this domain, and if it fails, continues to carry out the infection. However if it succeeds, the subroutine exits.

It's not clear if the subroutine being shown is the main entry point in which case return 0 exits (which is good for us), or if it's part of a larger framework that would be doing stuff later on (which is potentially bad for everyone because it could decide to do other things if it finds that domain sinkholed?)

The blog author checked on whether or not the domain name changes, but didn't specify any details about anything going on higher in the stack:

>All this code is doing is attempting to connect to the domain we registered and if the connection is not successful it ransoms the system, if it is successful the malware exits (this was not clear to me at first from the screenshot as I lacked the context of what the parent function may be doing with the results).

So my question is how much knowledge did they have of the rest of the code when registering the domain? Would the analysis environment have provided more information if the malware had continue to run after realizing the domain was sinkholed?

It's an interesting thought experiment. The closest analogy I can think of is pulling the wrong wire on a bomb.

Let's be honest if he didn't someone else malicious or otherwise would have. This is the internet.

Better in the hands of someone like this.