Attackers Now Using Honeypots to Trap Researchers

This has been going on since the late 80s to early 90s; at that time, viruses scanned the disks for signs of "abnormality". For example, a sophisticated virus would check to see how many directories where in the disk, how many of them were non-system, it checked timestamps to see if everything was pristine. If it found files containing number constants, it checked to see if $number-- and $number++ existed. And as soon as it was confident the system was a research box and not a user box, the virus would exhibit extremely benign behavior, or do without stealthiness and go full on violent, trying to destroy hardware equipment (i.e. spinning floppy at max speed. Asserting and holding controller lines for expensive hard-disks.)

This probing behavior is not the default, but it's triggered if the virus had some slight suspicion about the machine (checking performance, too fast or too slow?, checking to see if a debugger was resident, scanning the heap for anti-virus tool signatures, see if a few interrupts were hooked, etc.)

IIRC, I read about this first in one of the Phalcon/Skism philes, though it could have been NuKe.

The heuristics sound complex, specially when you think about it as a HLL programmer working in a protected environment. But they were very straightforward in DOS, where one had direct access to system data structures, and entire structure-traversal strategies could be as simple as bit manipulation.

/me just got the sudden urge to find that article. brb ..

P.S. And this really bugs me: why do black-hats consistently out-class "normal" programmers when it comes to systems programming? Pound for pound, the average underground "file" has more information density, sometimes an order of magnitude (bear with me here) than the normal "app dev" articles you see elsewhere. If I am hacking on a new platform the first thing I do is get the official manuals and specs, then I look for its underground text files.