Virus writers are experimenting with Google’s Go as a programming language for malware.
The Encriyoko Trojan uses components written in Go, which is a compiled language developed by the search giant and unveiled in 2009. Once installed on a Microsoft Windows PC, the Trojan attempts to use the Blowfish algorithm to encrypt all files matching various criteria including particular document types and a range of file sizes. The key used to encrypt the data is either pulled from a particular file on the D: drive or is randomly generated. This renders the data useless to its owner if the cipher cannot be recovered.
“Restoration of the encrypted files will be difficult, if not impossible,” Symantec warns in a blog postabout the Trojan.
The malware is circulating in the wild, and disguises itself as a tool to “root” Samsung Galaxy smartphones – a process that would otherwise allow customised operating systems to be installed on the phones. The Symantec bods reckon that VXers are probably experimenting with the Google’s Go, which is not to be confused with the Japanese board game of the same name. It’s possible the unknown virus writers are simply using a programming language they’ve taken a liking to.
“The advantage for VXers could be that they are more familiar with that specific language as opposed to some other languages and the language itself may offer some degree of flexibility in coding terms,” Paul Wood, a security researcher at Symantec told El Reg.
“It also might be more resilient to reversing attempts by researchers as Go isn’t really mainstream. The latter may be more a perception by the coders than in reality.” ®
The Register News