FBI malware signature WTF.

DaveK

According to Ars, the FBI has released a Yara signature for detecting the malware involved in the Sony Pictures hack:

rule unknown_wiper_error_strings{
meta: unique custom error debug strings discovered in the wiper malware
strings:
  $IP1 = "203.131.222.102" fullword nocase
  $IP2 = "217.96.33.164" fullword nocase
  $IP3 = "88.53.215.64" fullword nocase
  $MZ = "MZ"
condition:
  $MZ at 0 and all of them
}

I'm sure glad the FBI is protecting us against the devastating threat of attack from both upper- and lower-case numeric IP addresses!

chubertdev

heh

http://blog.amyworrall.com/post/46329875785/core-text-and-upper-case-numbers

anonymous234

@DaveK said:

condition: $MZ at 0 and all of them

I like that syntax.

Loking forward to the day I can write python statements like this

while True:
     call function() and the rest of stuff
     sleep(15) or not

flabdablet

Isn't that Applescript?

anonymous234

No, it's applesauce.
http://explosm.net/db/files/Comics/kApplesauce0001.jpg