Accidentally Stopping a Global Cyber Attack

Re:Accidentally Stopping a Global Cyber Attack by lordnacho on Saturday May 13, 2017 @02:19PM (#14332229)

Pretty interesting, if I'm reading it correctly the existence of the domain is checked, and if is there, the program is aborted, in order to stop sandbox analysis.

I was wondering why they didn't just do a simple variant:

1) Instead of relying on DNS, which anyone can create, why not make a user account on some well known forum site. Like HN or Reddit.

2) Open the site, look for the user's page, and check his message titles by hashing them against some hash that can be in your code.

3) Detonate if you don't see the code, or the user account doesn't exist.

This would have the useful characteristic that you could start/stop the attack using just an internet browser, anywhere. And the code word that you are after would be crypto hashed, so the defenders would have to find your keyword somehow from the hash. Heck, you could confound everyone by turning the thing on or off according to location, time of day, and so on.

For extra points make it a blockchain thing. They're already using that for payment, right?

[ Parent | on HN ]

Re:Accidentally Stopping a Global Cyber Attack by space_fountain on Saturday May 13, 2017 @02:23PM (#14332245)

My understanding is the idea is more to check if a non registered domain behaves as if it was registered. Some sandboxing methods apparently lead to this for some reason.

[ Parent | on HN ]

Re:Accidentally Stopping a Global Cyber Attack by fooey on Saturday May 13, 2017 @03:03PM (#14332440)

or just check against a handful of www.{{UUID}}.com domains instead of hard coding anything

[ Parent | on HN ]

Re:Accidentally Stopping a Global Cyber Attack by stordoff on Sunday May 14, 2017 @08:00PM (#14338205)

Reddit has been used to point to C&C servers in the past[0], so I wouldn't be surprised if some malware does send commands directly via Reddit.

[0] https://www.intego.com/mac-security-blog/iworm-botnet-uses-r...

[ Parent | on HN ]

Re:Accidentally Stopping a Global Cyber Attack by LastZactionHero on Saturday May 13, 2017 @04:18PM (#14332790)

Sometimes you've got a deadline and you just have to ship it.

[ Parent | on HN ]

Re:Accidentally Stopping a Global Cyber Attack by aji on Saturday May 13, 2017 @02:23PM (#14332247)

or instead of relying on the domain name existing, look at the contents of the web page

[ Parent | on HN ]