Bencsáth was a teacher, not a malware hunter, and had never done such forensic work before. At the CrySyS Lab, where he was one of four advisers working with a handful of grad students, he did academic research for the European Union and occasional hands-on consulting work for other clients, but the latter was mostly run-of-the-mill cleanup work—mopping up and restoring systems after random virus infections. He’d never investigated a targeted hack before, let alone one that was still live, and was thrilled to have the chance. The only catch was, he couldn’t tell anyone what he was doing. Bartos’ company depended on the trust of customers, and if word got out that the company had been hacked, they could lose clients.
The triage team had taken mirror images of the infected hard drives, so they and Bencsáth spent the rest of the afternoon poring over the copies in search of anything suspicious. By the end of the day, they’d found what they were looking for—an “infostealer” string of code that was designed to record passwords and other keystrokes on infected machines, as well as steal documents and take screenshots. It also catalogued any devices or systems that were connected to the machines so the attackers could build a blueprint of the company’s network architecture. The malware didn’t immediately siphon the stolen data from infected machines but instead stored it in a temporary file, like the one the triage team had found. The file grew fatter each time the infostealer sucked up data, until at some point the attackers would reach out to the machine to retrieve it from a server in India that served as a command-and-control node for the malware.
Excellent overview of where applications are going. Richard Monson-Haefel, (whom i met at the 2008 Web 2.0 Conference) explains the convergence of four emerging application models: Web Clients (Browsers), RiA Clients, Client/Server, and Widget Engines. He comes up with a convergence point called "Fit Client", offering Adobe Air as the leading example. Richard walks through each application model, discussing limitations and advantages. Good stuff, especially this comment: "The widget engine is really a wonderful architecture that gives you the power of the desktop (via the widget engine) and the management of the Web (via widget downloads). Widget engines can out-perform RIA solutions and they can store larger data sets. The limitation of Widget engines is not in their architecture, it is that they have been designed for applications with fairly weak capabilities compared to client/server. Widgets tend to be single-purpose applications with limited access to the native operating system. That said, the widget architecture itself - the separation of the platform from the applications - is important. It makes it possible to create applications (widgets) that are portable across operating systems and are packaged for easy download and installation. "
