Trust us, we know what we're doing! [humour]

Rainer Weikusat

unread,

Mar 27, 2013, 6:01:59 AM3/27/13

to

With apologies for this off topic post but the original seemed too,
well, original for not sharing it.

With great regret and deep grief, I've assembled myself here to
commemorate the very lamentable death of the beloved 'script
kiddie'. After decades of vigorously pushing the envelope ever more
towards yet unknown frontiers of technical ignorance, expert security
researchers have finally managed to undersmart their erstwhile
antagonists decisively, truly a giant leap for them but probably not
even a small step for mankind.

The bash script is a wiper designed to work with any Linux
distribution, with specific commands for SunOS, AIX, HP-UX
distributions. It wipes out the /kernel, /usr, /etc, and /home
directories.
http://www.symantec.com/connect/blogs/remote-linux-wiper-found-south-korean-cyber-attack

William Ahern

unread,

Mar 28, 2013, 1:03:11 AM3/28/13

to

I wonder if the following distinctions might constitute a useful
fingerprint:

1) backticks instead of $()
2) "if [] \n then" instead of "if []; then"
3) [] instead of test
4) dd_for_foo : action-preposition-subject

The snippet evidences an experienced and deliberate coding style, but not
one that's familiar to me.

Or maybe they just copy+pasted it from somewhere....

Ian Collins

unread,

Mar 28, 2013, 2:53:05 AM3/28/13

to

I thought the humour was a supposedly technically literate authour
classifying Solaris, AIX and HP-UX as Linux distributions...

--
Ian Collins

Jorgen Grahn

unread,

Mar 28, 2013, 7:48:05 AM3/28/13

to

On Thu, 2013-03-28, William Ahern wrote:
> Rainer Weikusat <rwei...@mssgmbh.com> wrote:
>> With apologies for this off topic post but the original seemed too,
>> well, original for not sharing it.

...

>> The bash script is a wiper designed to work with any Linux
>> distribution, with specific commands for SunOS, AIX, HP-UX
>> distributions. It wipes out the /kernel, /usr, /etc, and /home
>> directories.
>> http://www.symantec.com/connect/blogs/remote-linux-wiper-found-south-korean-cyber-attack
>>
>
> I wonder if the following distinctions might constitute a useful
> fingerprint:
>
> 1) backticks instead of $()
> 2) "if [] \n then" instead of "if []; then"

I would have used case ... esac.

> 3) [] instead of test
> 4) dd_for_foo : action-preposition-subject

I interpreted it as tool-for-platform. It also reminded me of "Windows
for Workgroups" for some reason.

> The snippet evidences an experienced and deliberate coding style, but not
> one that's familiar to me.
>
> Or maybe they just copy+pasted it from somewhere....

For 1--3, that seems likely. 4 may be original.

/Jorgen

--
// Jorgen Grahn <grahn@ Oo o. . .
\X/ snipabacken.se> O o .

William Ahern

unread,

Mar 28, 2013, 4:25:14 PM3/28/13

to

Ian Collins <ian-...@hotmail.com> wrote:
> William Ahern wrote:
> > Rainer Weikusat <rwei...@mssgmbh.com> wrote:
> >> With apologies for this off topic post but the original seemed too,
> >> well, original for not sharing it.
> >
> >> With great regret and deep grief, I've assembled myself here to
> >> commemorate the very lamentable death of the beloved 'script kiddie'.
> >> After decades of vigorously pushing the envelope ever more towards yet
> >> unknown frontiers of technical ignorance, expert security researchers
> >> have finally managed to undersmart their erstwhile antagonists
> >> decisively, truly a giant leap for them but probably not even a small
> >> step for mankind.
> >
> >> The bash script is a wiper designed to work with any Linux
> >> distribution, with specific commands for SunOS, AIX, HP-UX
> >> distributions. It wipes out the /kernel, /usr, /etc, and /home
> >> directories.
> >> http://www.symantec.com/connect/blogs/remote-linux-wiper-found-south-korean-cyber-attack
> >>
> >
> > I wonder if the following distinctions might constitute a useful
> > fingerprint:

<snip>

> I thought the humour was a supposedly technically literate authour
> classifying Solaris, AIX and HP-UX as Linux distributions...

Ha. I missed that part. I guess I spend too much time skipping comments and
going straight to the code.