Hacker News Reader

Comment by ehsankia | Hacker News Reader

I'm curious about the WannaCry situation. If the killswitch was truly to detect being in a VM, could they still not have bought the domain and just left unresponsive, or even better, just generate a random new domain every single time.

I guess they just didn't foresee someone buying the domain.

View on HN

Buying a domain would make deanonymizing them easier and would take energy from the main effort.

And how effective is that defense, anyway? I mean, couldn't you just clone the VM, and start responding or not responding to different domains until you hit on the right one? Or hell, have your VM check a domain and respond correctly if the domain isn't registered?

Yea, this part was confusing to me as well. How would a VM "simulate" the internet? Does it return a dummy page? I don't understand what mental model of VM behavior that the virus creators had in mind when they designed this killswitch.

The part about how to simulate a site isn't confusing, the part about why you'd want to do that is the confusing part. If I was researching malware in a VM I'd want to take a very passive approach, and allow it to talk to the real internet, and inspect the traffic.

It does do that, but in order for it to inspect what's going on, the VM has to accept an outgoing connection as legitimate.

By intercepting every DNS request and routing it to your honey pot server which logs the packets the malware sends to the mothership. What the malware author should do is simply randomly generate the DNS name at the cost of the unlikely chance of hitting a valid domain name instead of hardcoding it.

> or even better, just generate a random new domain every single time.

I'm no expert, but I do recall reading in one of the WC write-ups that there is known malware that does this.

It's called a DGA or domain generation algorithm, I believe Conficker was one of the first botnet's to use this approach about 10 years ago, it's pretty standard trade craft nowadays.

https://en.wikipedia.org/wiki/Domain_generation_algorithm

Well this is slightly different. DGA seems to actually use it as a rendez-vous host, whereas in this case, it literally is a dummy domain that they didn't even bother registering, with the only purpose of checking if they were in a VM. In which case, generating any long hash domain would most likely not be registered and would do the job.

Reply on news.ycombinator.com