Hacker News Reader

Comment by tptacek | Hacker News Reader

I'm having trouble parsing this comment. Your suggestion is that the author is sophisticated and that's why they chose RC5? RC5 is a broken 1990s cipher. If the authors wanted to minimize code size, they'd have used a native stream cipher, not a 64-bit block cipher.

I'm also having trouble with the idea that the author of this trojan might be GCHQ or NSA (or sponsored by them), but that cryptanalytic techniques from the late 1970s are off the table.

View on HN

> the author is sophisticated and that's why they chose RC5

I'm saying that because the author is sophisticated, they know that the strength of the algorithm doesn't matter (so long as it's not something ridiculously simple).

DES, AES, RC5, RC6, whatever. They're all good enough because Symantec (or whoever is analyzing the malware) is going to get the plaintext no matter what. Symantec is not going to do any cryptanalysis whatsoever. Symantec is going to run the sample malware in a debugger and watch it get decrypted. The malware must decrypt itself in order to run.

The malware must decrypt the parts that it runs. (There's an obfuscation technique that's apparently quite strong in existence, but it produces gigabyte executables for simple 5-condition if statements you can brute force by hand, so it's ludicrously impractical.)

This could be worse. It could have encrypted routines for which the commands are the decryption keys. It doesn't appear to be particularly polymorphic. If there's a BIOS/PCI dropper, it's (sadly) long gone here.

Choosing RC5 is an irrelevant implementation detail; they probably used whatever was in hand at the time. The only requirement is that the function makes things random-looking, really. I agree with alister in that the reason---if there was any reasoning applied here---was likely code size / simplicity.

Look at Flame's encryption functions [1, §4]. This is the malware that burned a chosen-prefix MD5 collision elsewhere, but still went ahead and used the simplest mangling functions possible. You also find plenty of other 'state-sponsored' malware using similarly stupid/weak/outdated encryption.

[1] http://www.crysys.hu/skywiper/skywiper.pdf

I guess if you're saying you can't read RC5 as being a point in favor of or against GCHQ, I find your argument plausible. RC5 is more plausible at least than RC6, which (a) few people have at hand and (b) calls significantly more attention to itself.

It's not supposed to really encrypt anything. It's an obfuscation method. It doesn't matter how "broken" it is, as long as anti-virus applications have no idea about how to "decrypt" it.

They might as well XOR'ed the data, but opted in for RC5 for some reason.

Reply on news.ycombinator.com