The Mystery of the Duqu Framework

Re: That code looks familiar

It’s easier to figure this out if you consider vendor sourcing. The work was probably done by a government. And, whether the software was sourced through a US agency or whether a US agency itself was the creator, the net result is the same: you’re looking for a major GSA-contracted firm who A) has clearance, B) has a compiler team, C) has a track record of providing similar product to the US government, and D) has a compiler codebase that looks kind of unfamiliar and not mainstream.

The likely suspects fitting that set of criteria are IBM, Microsoft, SAS and SAIC. All the others (remnant AT T, HP, remnant SGI… who am I forgetting?) incorporate a considerable amount of fairly recognizable shared compiler code in their offerings. Since you’ve disqualified Microsoft, my bet is on IBM.

I don’t think it’s SAS, because their compiler codebase is ancient. I don’t think it’s SAIC, because for them this would be a fairly difficult project. Three reasons why I think IBM.

First is that IBM has a library of bizarro options to select from. There’s an internal HLASM-to-C frontend. There’s all the CSet descendants. They’ve got research versions of damn near everything. (I’d try getting ahold of the ia32 version of CSet – probably hard to come by, but out there). They’ve also got a Windows source license, and if you were going to write a virus, that’s always handy.

Second is that IBM has a history of doing projects like this. If there was a federal bid, they almost certainly would have been a bidder.

Third is that the project could have been run out of IBM Haifa. A number of the old IBM AV team probably either were there or ended up there, so it wouldn’t be too far out of their wheelhouse. And if you wanted to build a state-sponsored virus, you’d almost certainly want to build it in a country who already has near-active hostilities with the intended target for the virus such that those acts of aggression don’t become de facto acts of war for you.

If you want to dig into that, have someone from IBM wander through the employee-written and internal software libraries for all the preprocessor frontends for various languages and compiler backends that output to ia32. Probably none of that is inherently secret. I bet you’ll find something that produces similar output.

Views: 0

You can skip to the end and leave a response. Pinging is currently not allowed.

Leave a Reply

Powered by WordPress | Designed by: Premium WordPress Themes | Thanks to Themes Gallery, Bromoney and Wordpress Themes