Bitdefender Labs
labs.bitdefender.com · Company blog · on HN since 2012
Bitdefender Labs is the security vendor's research blog, with malware analyses, ransomware, botnets, backdoors, and device vulnerabilities.
What HN saysHN links it for ransomware and malware analysis, such as the Linux ransomware with a predictable key and a DarkSide decryption tool. One commenter called an article fairly competent despite its clickbait title.
24HN people shared it
5linked it in comments
21stories submitted
134story points
5 years agolast shared
2012people per year2026
Most-shared posts
- 1Linux Ransomware Debut Fails on Predictable Encryption Key5 people · 17 points · first shared 2015 · 1 comments on HN
- 2Backdoor on OS X systems allows full access2 people · 9 points · first shared 2016 · 2 comments on HN
- 3Inside Netrepser – A JavaScript-Based Targeted Attack2 people · 3 points · first shared 2017 · discussion on HN
- 4Bitdefender finds a Hypervisor Wiretap to read TLS communications2 people · 3 points · first shared 2016 · discussion on HN
- 5FLAME – Leaked Data Carried by Human Vector2 people · 2 points · first shared 2012 · discussion on HN
- 6Inside the Million-Machine Clickfraud Botnet1 people · 67 points · first shared 2016 · 18 comments on HN
- 7Unpatched Wordpress Instance on Yahoo Blog Leads to Cookie Theft1 people · 18 points · first shared 2013 · 1 comments on HN
- 8More Flaws in Guardzilla Cameras Allow Remote Hijack of the Security Device1 people · 3 points · first shared 2018 · discussion on HN
- 9Attackers Pose as Account Owners via Facebook Login Flaw1 people · 2 points · first shared 2016 · discussion on HN
- 10“Hide N Seek” IoT Botnet Using Custom-Built P2P Communication1 people · 2 points · first shared 2018 · discussion on HN
- 11Massive GoldenEye ransomware campaign slams worldwide users1 people · 2 points · first shared 2017 · discussion on HN
- 12Mandrake – owning Android devices since 20161 people · 2 points · first shared 2020 · discussion on HN
- 13Hold My Beer Mirai – Spinoff Named ‘LiquorBot’ Incorporates Cryptomining1 people · 1 points · first shared 2020 · discussion on HN
- 14Interplanetary Storm Botnet Shows Signs of Proxy-for-Hire Infrastructure1 people · 1 points · first shared 2020 · discussion on HN
- 15Bitdefender Solves GANDCRAB with Free Decryption Tool – Available Now1 people · 1 points · first shared 2018 · discussion on HN
What HN people wrote when they linked it
dhx · 2012-06-12
It is worth noting that the 8.3 short name of the hidden file was HUB001.DAT[1]. This is because VFAT allows the specification of both a short name (8.3) and long name (LFN) for each file/directory.
You can find 8.3 '.' entry names by searching a partition for \x2e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
A file with an LFN of '.' could be found with (hopefully this is correct) \x00\x2e\x00\x00\x00\x00\xff\xff\xff\xff\x0f
It appears as if 8.3 file names starting with '.' are treated specially but LFNs starting with '.' carry no significant meaning.
I struggled to find references to other malware that has used a similar approach. Does anyone have more information?
Surely Windows does not attempt to automatically execute files with a LFN (UTF-16 name) of '.'?
[1] http://labs.bitdefender.com/2012/06/flame-the-story-of-leaked-data-car…
[2] https://en.wikipedia.org/wiki/File_Allocation_Table#Directory_entry
rurban · 2021-05-10
* There exists a decryption tool for DarkSide
https://labs.bitdefender.com/2021/01/darkside-ransomware-decryption-to…
* Critical infrastructure should not be allowed to run on Microsoft Windows
* The remote workers, through which the attack was performed, didn't even use a VPN, just TeamViewer and MS Remote Desktop.
nisa · 2018-06-19
This seems to be source for the article: https://labs.bitdefender.com/2018/06/six-years-and-counting-inside-the… (there is a PDF linked), no mention of surviving a format or clean reinstall.
jaclaz · 2017-10-21
It seems like some variant of the Linux.Encoder.1 (2015):
http://www.zdnet.com/article/crypto-ransomware-strikes-linux-but-attac…
https://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-p…
probably "python based" and, as mentioned on the gentoo forums, the ransomware mesage is very similar to the one in:
https://github.com/jdsecurity/CryptoTrooper
Hello71 · 2015-11-17
Previously: https://news.ycombinator.com/item?id=10524791
tl;dr: if you run nearly-a-year-unpatched software (Magento) you will be hacked by script kiddies.
This is a fairly competent article, other than the obviously click-bait title. Although the Bitdefender post linked as a source contains much more technical detail and less copy-paste tutorial: http://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-pr…