- Really speculating here, but maybe impenetrable obfuscation was actually undesirable? I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it. A successful cyber-attack means that future attacks of the same sort are possible, and adds a bargaining chip to the Israeli/US side. This can lead to Iranian concessions down the road. Without a proven success, a similar negotiation tactic would have to be much more difficult.
Alternatively, maybe they just thought it is not that important? They were attacking important infrastructure. They were actually going against a country... which had access to the destination machines. As long as they go through usual AVs and don't do extensive dynamic updates of the malware, how much time would they gain? How many experienced people were really looking at that thing? Since their attack wasn't really done the day after the malware was released, even hiding the payload for a month or more wouldn't make much difference in reality, would it?
> "I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it."
Or perhaps it was engineered to be as complex as necessary to accomplish the job (sabotage), but simple enough that Israel didn't have to show all of its cyber-warfare cards.
There's a good chance that any worm, no matter how engineered, will be detected and reverse engineered. It makes sense not to go all-in on any single one and reveal your techniques unless the difficulty of intrusion calls for it.
>Really speculating here, but maybe impenetrable obfuscation was actually undesirable? I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it.
I think the idea (Making the red team have to put up with expensive and costly countermeasures to malware) is a good one, however I think it is unlikely the reason this was detected.
The technique I describe is actually less-risky in terms of false positives. If you don't get the right combination of inputs right, you literally can't decrypt the payload. Even 1 bit of error gives a completely invalid key. It also isn't a new technique. I've seen it in shipping products for at least 12 years.
The one valid criticism is that it is more work to implement. But it's not that hard.
Comments
I know nothing about malware, but I know a lot about shipping production software.
- Simpler is better than complicated. As pointed out in one of the comments on the article, increasing complexity increases risk of failure.
- Proven techniques are, uhh, proven. Newer techniques are inherently riskier.
- Really speculating here, but maybe impenetrable obfuscation was actually undesirable? I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it. A successful cyber-attack means that future attacks of the same sort are possible, and adds a bargaining chip to the Israeli/US side. This can lead to Iranian concessions down the road. Without a proven success, a similar negotiation tactic would have to be much more difficult.
Alternatively, maybe they just thought it is not that important? They were attacking important infrastructure. They were actually going against a country... which had access to the destination machines. As long as they go through usual AVs and don't do extensive dynamic updates of the malware, how much time would they gain? How many experienced people were really looking at that thing? Since their attack wasn't really done the day after the malware was released, even hiding the payload for a month or more wouldn't make much difference in reality, would it?
> "I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it."
Or perhaps it was engineered to be as complex as necessary to accomplish the job (sabotage), but simple enough that Israel didn't have to show all of its cyber-warfare cards.
There's a good chance that any worm, no matter how engineered, will be detected and reverse engineered. It makes sense not to go all-in on any single one and reveal your techniques unless the difficulty of intrusion calls for it.
>Really speculating here, but maybe impenetrable obfuscation was actually undesirable? I wonder if the authors, (seems to be Israel and/or US), wanted Iran to figure out who was behind it.
I think the idea (Making the red team have to put up with expensive and costly countermeasures to malware) is a good one, however I think it is unlikely the reason this was detected.
The technique I describe is actually less-risky in terms of false positives. If you don't get the right combination of inputs right, you literally can't decrypt the payload. Even 1 bit of error gives a completely invalid key. It also isn't a new technique. I've seen it in shipping products for at least 12 years.
The one valid criticism is that it is more work to implement. But it's not that hard.