Hacker News Reader

Comment by aazaa | Hacker News Reader

I feel dumb not knowing what a "Wiper" is, especially with that headline and the odd writing style of the article (the term "epic troll" gets thrown around a lot and is not what I'd expect to come from a security research org). It turns out to be what it sounds like:

> A wiper is a class of malware whose intention is to wipe the hard drive of the computer it infects.

https://en.wikipedia.org/wiki/Wiper_(malware)

View on HN

I've never heard the term before either. At first I was wondering how a viper snake had performed an epic troll on the Iranian train system... and then I re-read and pictured a windshield-wiper. I couldn't figure out the real meaning before clicking the link.

I am on your side when it comes to infosec naming things, for short history there has been some big attacks by Wiper type malware in the past most notably TV5, South Korea (Winter Olympics 2018),SONY, ARAMCO 2017 there's also some samples currently targeting the Tokyo Olympics

Spoilers, and a tangent I find interesting...

Viper/Wiper was the punchline for an animated TV miniseries/sequence of GI Joe.

(For non-USians: GI Joe was a US weekday after-school TV militainment and merchandizing franchise targeted at children. Which, from the perspective of an adult who grew up watching that as a kid, feels fascinating.)

Yeah I've been following malware for a while and this is the first time I've heard of a Wiper. I guess it's like ransomware without the ransom

In 2011 the Iranian oil industry was hit with the Flame malware (they didn't know this at the time), which bulk erased drives of servers and workstations. Due to poor translations it was reported in western media as "Wiper" or "Viper," after the "drive wiping" functionality.

A year later when Saudi Aramco had the drives of tens of thousands of machines wiped (likely by Iran), the press assumed it was related or the work of the same group and also called it "Wiper."

Now it is a generic term for any malware that erases drives, often in a coordinated attack.

LOL probably NSO supplying both sides.

I feel dumber because I legit thought the trains' physical wipers (you know for rain etc) were somehow compromised?

If you could hack the physical wipers to make them troll the head of the government, that would be pretty epic. If nothing else, I'd like to see both the attack chain and the method to use the wipers to troll someone.

No need to be so hard on yourself! It’s practically a safe bet that Smart Wipers will be a real attack vector any day now, if they aren’t already

I assumed it was a Stuxnet-style attack where they made the wipers go at the wrong speed until they tore themselves apart.

In this malware, they go to great lengths to wipe and encrypt all kinds of different types of data... (The mbr, the boot.ini, the event log, the scheduled tasks, the attackers batch file, the user's documents). When the simple approach would just be to send a low level command to the disk to write zeros across the whole thing.

Why not take that simple approach?

Reply on news.ycombinator.com