Kaspersky Lab recently announced the discovery of Gauss , a complex, nation-state sponsored cyber-espionage toolkit. Gauss contains many info-stealing capabilities, with a specific focus on browser passwords, online banking account credentials, and system configurations of infected machines. Kaspersky Lab’s experts discovered Gauss by identifying the commonalities the malicious program shares with Flame. Since late May 2012, more than 2,500 infections have been recorded by Kaspersky Lab’s cloud-based security system, with the majority of infections found in the Middle East.
Kaspersky Lab’s experts published a research paper about Gauss that analyzed its primary functions and characteristics, in addition to its architecture, the malware’s unique modules, communication methods, and its infection statistics. However, several mysteries and unanswered questions about Gauss still remain. One of the most intriguing aspects is related to Gauss’s encrypted payload.
The encrypted payload is located in Gauss’s USB data-stealing modules and is designed to surgically target a certain system (or systems) which have a specific program installed. Once an infected USB stick is plugged into a vulnerable computer, the malware is executed and tries to decrypt the payload by creating a key to unlock it. The key is derived from specific system configurations on the machine. For instance, it includes the name of a folder in Program Files which must have its first character written into an extended character set such as Arabic or Hebrew. If the malware identifies the appropriate system configurations, it will successfully unlock and execute the payload.
“The purpose and functions of the encrypted payload currently remain a mystery,” said Aleks Gostev, Chief Security Expert, Global Research and Analysis Team, Kaspersky Lab. “The use of cryptography and the precautions the authors have used to hide this payload indicate its targets are high profile. The size of the payload is also a concern. It’s big enough to contain coding that could be used for cyber-sabotage, similar to Stuxnet’s SCADA code. Decrypting the payload will provide a better understanding of its overall objective and the nature of this threat.”
Kaspersky Lab would like to invite anyone with an interest in cryptography, reverse engineering or mathematics to help find the decryption keys and unlock the hidden payload.
More details and a technical description of the problem are available in our blogpost at Securelist.com
Kaspersky Lab’s experts published a research paper about Gauss that analyzed its primary functions and characteristics, in addition to its architecture, the malware’s unique modules, communication methods, and its infection statistics. However, several mysteries and unanswered questions about Gauss still remain. One of the most intriguing aspects is related to Gauss’s encrypted payload.
The encrypted payload is located in Gauss’s USB data-stealing modules and is designed to surgically target a certain system (or systems) which have a specific program installed. Once an infected USB stick is plugged into a vulnerable computer, the malware is executed and tries to decrypt the payload by creating a key to unlock it. The key is derived from specific system configurations on the machine. For instance, it includes the name of a folder in Program Files which must have its first character written into an extended character set such as Arabic or Hebrew. If the malware identifies the appropriate system configurations, it will successfully unlock and execute the payload.
“The purpose and functions of the encrypted payload currently remain a mystery,” said Aleks Gostev, Chief Security Expert, Global Research and Analysis Team, Kaspersky Lab. “The use of cryptography and the precautions the authors have used to hide this payload indicate its targets are high profile. The size of the payload is also a concern. It’s big enough to contain coding that could be used for cyber-sabotage, similar to Stuxnet’s SCADA code. Decrypting the payload will provide a better understanding of its overall objective and the nature of this threat.”
Kaspersky Lab would like to invite anyone with an interest in cryptography, reverse engineering or mathematics to help find the decryption keys and unlock the hidden payload.
More details and a technical description of the problem are available in our blogpost at Securelist.com
Comments
How far have we come? What have we learned? How are we feeling? as a country, and as individuals? Honor those we knew and loved who lost their livesThere are other useful definitions in this field, for example, creativity can be defined as consisting of a number of ideas, a number of diverse ideas and a number of novel ideas He is a passionate traveller And the smoke of the incense, with the prayers of the saints, ascended before God from the angel's hand
no way, that's too boringAnd when you solve problems, you not only gain experience in solving other problems as they occur, but you build respect for yourself All of it, every event that happens in your life, and in your body, is a product of thought
[url=http://www.alfredmorrisjersey.us/]NFL Alfred Morris Jersey[/url]
[url=http://official49ersjerseystore.com/]Aldon Smith Youth Jersey[/url]