SNAKE Added to Perfect Virus Report Card

Three years ago I did my first Virus Report Card (February 7, 2011), comparing Stuxnet, Zeus/SpyEye and Duqu to The Perfect Virus (see all 22 Principles of the Perfect Virus here). Just a month ago, I updated it with the Mask/Careto virus (see the update here). Thanks to the Russian "Snake" technology unleashed in Ukraine, here is yet another update.

While SNAKE lost some stealth points, it is nevertheless a step up in the virus food chain in that it allows the Command and Control (C&C) system to actually take over the target servers. With the exception of Stuxnet, which wreaked havoc with Iranian nuclear centrifuges, the other virus technologies infected client computers that had established a trusted relationship with more secure institutions in order to loot the data assets of the less-than-secure client. SNAKE, on the other hand, goes for the gold and actually takes over the target infrastructure. That's a big leap and one I suggested yesterday might have been a big Russian mistake letting out of the bag in Ukraine.

The BAE Systems report (read it here) did an exceptionally thorough job analyzing SNAKE and suggesting ways to determine it's presence on your system. Major points of special interest:

1. SNAKE appears to be exclusively targeted toward Windows clients and servers. That has all kinds of implications that are beyond the scope of this writeup, although I would advise extreme caution to those who drive automobiles with computers powered by Windows mobile technology ("Hey Achmid, watch me have a bunch of cars slam on their breaks during The Great Satan's rush hour!").
2. While SNAKE has the capability to dynamically reassign C&C servers for peer-to-peer control, it comes equipped with a large number of hard-coded C&C server locations. That seems silly, and may indicate expediency and a tight time line forced deployment of a less-than-perfectly secure virus.
3. Point 2 above is reinforced by the fact that SNAKE was delivered with debugging hooks still compiled into the code that exposes the names of two developers (vlad and gilg) as well as the  name of this particular variant (sengoku). Sure, this could be a not-so-subtle "false flag" pointer to Russia, but my opinion is that the last-compiled versions of SNAKE on January 28, 2014 were rushed into operation in Ukraine because of Russian premeditation.
4. Another possible "false flag" indicator is that the decryption XOR mask used by SNAKE was the same one used in the Agent.BTZ virus that hit Pentagon secure systems in 2008. While this seems rather silly for any government trying to avoid the "A" word (attribution), again it is my opinion that expediency trumped stealth. Ergo, Russia must have made a conscious decision to play the SNAKE cards face up due to their view of Ukraine's importance to them.
5. Finally, Putin's ego and his desire to again be a major player on the global cyberwarfare stage may have dictated that Russia's fingerprints be firmly on this technology.

We still don't have a good idea how SNAKE was initially delivered in Ukraine, but given the number of Russian-leaning Ukrainians in important positions, one well-placed thumb drive could have done it all.

Net-net: 2014 is shaping up to be a most interesting year.