Comment by natch | Hacker News Reader

Comment by natch | Hacker News Reader

[Edit: I missed the PDF whitepaper before writing this comment. It doesn't answer all my questions bit I'll give them credit for a really nice detailed whitepaper.]

This article makes me very suspicious of Symantec. How long have they known about this, really? Are they just releasing this information now as a marketing reaction to recent discoveries by competing firms?

The vaguely written timeline says in passive voice that Regin has been observed since 2008. By who? Why are we just hearing about it now? I wouldn't blame them for keeping some discoveries quiet for a while so they can do some stealth research, but the timing here really smells like they are being PR driven instead of being driven by doing what's best for the overall security community.

What would inspire much more confidence would be a story of how this was discovered, and how the discovery and research played out, as we have seen for some other malware. Instead this looks like they have know about this for a long time, and now for reasons they aren't going to disclose, they have decided, or have been given permission, to reveal some of what they know.

> Why are we just hearing about it now?

Once malware is identified properly antivirus firms will usually go through their detection archives and pull out earlier hits.

The reason why they don't see them sooner is because they get tends to hundreds of thousands of new threats each week and don't have time to go through each one.

Mikko from F-Secure also reported on Twitter that they found Regin[0]. The same thing happen with Stuxnet, and just about every other malware - it is why these firms will keep and check the archives of new detected threats.

As for your general suspicions, this is endemic with infosec since there is a natural conflict of interest where those doing the research and reporting on it are also selling solutions.

If it makes you feel any less suspicious, the research departments within these antivirus firms are generally isolated from parts of the companies involved in sales and marketing. They are usually small teams that just go out and publish information on cool things they find - although there is often a race to be the first to dissect and publish the details of new malware (which is why you wouldn't sit on knowledge of a new threat).

[0] https://twitter.com/mikko/status/536624310035939328

The same thing happen with Stuxnet, and just about every other malware - it is why these firms will keep and check the archives of new detected threats.

My favorite is how Stuxnet was discovered just after Win2000 ended support.

So what made Symantec, McAfee, etc so horrible BTW?

the link they have created to "Backdoor.Regin" points to this: http://www.symantec.com/security_response/writeup.jsp?docid=...

which looks unrelated to the point of being incorrect.

also quite strange that they say in the PDF it's a kernel mode driver, as my understanding is that windows 7 & co do not allow those to be installed if they are unsigned. EDIT: The pdf covers this later on:

> The 64-bit version of Regin’s Stage 1 (wshnetc.dll) is no longer a kernel mode driver, as drivers under 64-bit Windows must be signed. Instead, Stage 1 is a user mode DLL loaded as a Winsock helper when the computer is starting up.

Well people are sending suspicious files to the AV vendors all the time, so Symantec may have found the backdoor a lot later and then found it existing in their DBs.

Reply on news.ycombinator.com