Malware in Lisp? Now you're just being cruel

Malware authors looking to evade analysis are turning to less popular programming languages like Delphi or Haskell. Computer scientists affiliated with the University of Piraeus and Athena Research Center in Greece and Delft University of Technology in the Netherlands have taken a look at recent malware to better understand …

[cdegroot]

plus ça change...

A buddy of mine got contracted to write license key code in the early '90s and did that by implementing it in a mini programming language that he implemented in a homebrewn Forth and mixed with various obfuscation techniques everywhere.

We did a lot of reverse engineering back in the day and it was the first time I gave up.

[Version 1.0]

Re: plus ça change...

We have AI these days so I'm cautious of a new website appearing that would have AI encouraging everyone to visit and pay their monthly phone fees when they talk on their phone e.g. EightyAndTea.com

[-tim]

Lisp is in an amazing number of places

Lisp and even cut down versions are often used for programing inside drivers and boot processes. This was used to boot Sun systems for decades and still is found in other unix boot systems. It is common in embedded control systems and even runs inside mice and keyboards. It is in some x86 systems hiding in the security processors. Smart network cards that can do hardware offloading sometimes use Lisp embedded in the chip. It is in telescope controllers from back yard scopes to things in orbit. Lisp like C can deal with low level hardware devices down to the register level and it is extremely efficient as an interpreted language.

My most annoying problem with Lisp is I had to fix some broken hardware and I found a perfect example of some Lisp code to fix it and it was on my web page from many years ago.

[Anonymous Coward]

Re: Lisp is in an amazing number of places

I seem to recall the Sun machines I used having Forth as the language you used to interact with it. Unless you mean the Forth interpreter and firmware itself was written in Lisp?

[anthonyhegedus]

Re: Lisp is in an amazing number of places

Are you sure you don't mean FORTH?

[-tim]

Re: Lisp is in an amazing number of places

Both FORTH and Lisp are hiding in all sorts of places because they were easy to implement. Lisp is often in things that originated at MIT and there were many early highly portable open source implementations that could be stripped down.

[Anonymous Coward]

Re: Lisp is in an amazing number of places

Did you mean Fortran version H?

[that one in the corner]

Re: Lisp is in an amazing number of places

That really does sound like Forth and not Lisp: the first major use of Forth was for controlling radio telescopes (Chuck Moore worked at an observatory at the time he created the language).

Running a Lisp in an embedded controller is taking a big risk that the garbage collector needs to run at an inopportune moment. There are variants that purport to provide real time guarantees and you can alway try just triggering gc at known points, but on the whole IMHO there'd have to be a dang good reason to use Lisp versus anything more - shall we say "direct" - such as Forth. Now, splitting the system up, with a bigger computer running a Lisp-based planner and Forth (or C or ...) to drive the hardware via MCUs, that would play to each's strengths.

[anthonyhegedus]

Re: Lisp is in an amazing number of places

FORTH works using RPN (stack-based postfix notation) and List runs using Polish Notation (prefix notation). FORTH is good for systems with extremely low memory and needing precise control of hardware. Lisp I believe was used for ML or perhaps expert systems. FORTH isn’t used much any more, if at all, though Lisp variants still exist and can be used in AI research.

[that one in the corner]

Re: Lisp is in an amazing number of places

> Lisp I believe was used for ML or perhaps expert systems

Lisp has been used for pretty much everything interesting, including every aspect of AI research planning, natural language (not LLMs but directed syntax & semantics), theorem provers, theorem generators, logic programming, novel search and pattern recognition, fuzzy systems, weighted reasoning (leading to, yes, Expert Systems). In all of these areas more specialised languages have been created (e.g. Prolog, Loglang ... for logic programming) but Lisp-based tends to be a good starting point and for experimentation with modifying mechanisms before speeding things up with, e.g. a Prolog core written in Pascal or C.

Lisp is also good for "practical"(!) uses, like writing compilers, symbolic mathematics, text processing - yes, alternatives exist (compiler-compilers and lexical analyser generators abound, coded in your bog-standard languages like C/C++/Java (oh, why did Antlr go down that route, sob?) but if you have The Next Big Grammar Idea give Lisp a go for all the early trials before turning it into something faster, "more palatable" for the masses: your AST editing is probably going to involve lots of list transforms (see below re "every sufficiently large...").

> FORTH isn’t used much any more, if at all, though Lisp variants still exist and can be used in AI research.

Lisp is still definitely alive - it is still the core of Emacs, "modern" variants like Scheme or Guile are available and used inside applications. And, of course, "every sufficiently large C program will re-implement Lisp, badly".

Forth is still used as well. The issue with saying things like "language X is no longer used", especially for older languages, is that there are undoubtedly *more* people using X now than there were in its heyday. There is simply a smaller percentage of all current programmers using it - because there is now an utterly ludicrous number of programmers around! After all, there probably isn't a market for more than five computers in the world.

PS

Lisp is the one of the two that is more likely to be correctly spelt in all-caps, as it is a shortened form of LISt Processing and hence (mis)treated like an initialism or an acronym; Forth never an acronym or initialism, it was only spelt in all caps because in its origins you could only use all caps for file names- and they weren't long enough to include the missing letter 'u'!

PPS

Raw Lisp uses prefix notation, but anyone doing a decently long-lived sized system (hopefully) defines a grammar to front end it (as also happens with other "AI languages", such as Prolog). The fact that Emacs didn't do that just seems - weird. Maybe nobody could actually figure out what "a language for defining interactive editing text" could/should look like?

[Potemkine!]

Re: Lisp is in an amazing number of places

In French, LISP is said to mean Language Incompréhensible Sans Parenthèse, "Incomprehensible Language Without Parentheses".

[breakfast]

Re: Lisp is in an amazing number of places

And yet in the programming language world cup it always does well in its brackets.

[joeldillon]

Re: Lisp is in an amazing number of places

PostScript was essentially in the FORTH family. Long since generally replaced by PDF, but you'll still see it around now and then.

[Peter Ford]

Re: Lisp is in an amazing number of places

Isn't PDF just a wrapper around PostScript?

[Brad Ackerman]

Re: Lisp is in an amazing number of places

PDF is based on PostScript but isn't Turing-complete (at least if one doesn't count the JavaScript that's allowed to be added to non-PDF/A documents).

[Anonymous Coward]

I expect this sort of thing...

...to become more common.

One of the startling abilities of AI coding assistants is they are pretty damned good at taking a codebase written in one language and converting it to another...and in doing so, it accelerates your ability to learn it because you still have to fix the imperfections...but because you know how the codebase works, even if you don't know the language, you remove one of the barriers to quickly learning a programming language.

[A Non e-mouse]

No malware written in Perl, yet, to avoid reverse engineering?

[cdegroot]

That would be too evil.

[b0llchit]

Ehm,... challenge accepted?

[Doctor Syntax]

Not as evil as APL.

[graemep]

APL is not evil, just misunderstood.

[Doctor Syntax]

Gee, Officer Krupke!

[LybsterRoy]

MicroAPL & APL68000

Having been a user of APL both on mainframe (IBM 4341) and supermicros back in the early 80s I would say that APL was a beautiful and very powerful language that was nearly impossible to read and understand two days after you'd written it.

Any other MicroAPL & APL68000 users out there?

[AnAnonymousCanuck]

All my perl code was malware, not fit for the purpose :)

AAC

[that one in the corner]

Haven't you noticed the increase in line noise over the last few years? That is all being caused by a system running a genetic algorithm to randomly evolve Perl code. So far, we have been lucky, but one day it'll click into place and, with what seems like a burst of static, everything is pwned at once.

Or I may be remembering a horror movie - Pontypool?

[Jou (Mxyzptlk)]

Sounds like novel from Isaak Asimov, or Justin Woolley, or Edward Aston, or John Brunner, or David L. Young, or William Gibson, or....

[PRR]

> ...algorithm to randomly evolve .... one day it'll click into place and, with what seems like a burst of static, everything is pwned at once.

John Sladek, _Mechasm_ (The Reproductive System), 1968' "a project to build machines that build copies of themselves, a process that gets out of hand"; real Boomer literature.

[Jou (Mxyzptlk)]

Whitespace interpreter

"There is the malware!"

"Where?"

"There!"

"I can't see it"

<switch to hex view....>

"Oh!"

Edit: And you can hide it inside Lorem Ipsum, or normal source code and so on.

[Clausewitz4.1]

Re: Whitespace interpreter

"Edit: And you can hide it inside Lorem Ipsum, or normal source code and so on."

Hex Workshop from bpsoft. The best hex I used.

[Jou (Mxyzptlk)]

Re: Whitespace interpreter

Does it sell good spells, curses and other witchcraft?

[Neil Barnes]

Re: Whitespace interpreter

From the emporium of John Wellington Wells, Esq?

[Anonymous Coward]

Re: Whitespace interpreter

Whitespace: Because Forth is readable.

[Paddy]

Re: Whitespace interpreter

Who else drag-selected the text to check where the newlines were?

[captain veg]

Visual Basic

"security researchers hated Visual Basic 6 binaries due to the complexity of reverse engineering the software"

This seems most unlikely to me. If you compiled to bytecode it was trivially easy to decompile. Native x86 output was via the C2.exe back-end compiler from Visual C++ (along with its linker), so could hardly be worse than that language.

-A.

[that one in the corner]

Shellcode bytes in sequential order

Hang on, so to avoid detection all you need to do is just avoid writing

system("/bin/takeoversystem -now")

and replace the constant with a buffer filled by a few strcat()'s from strings declared in different places, with dummies in between and maybe a few Xor's to "hide" the contents of the strings?

That seems a lot easier than learning another language[1]

[1] but not as much fun, to the proper geeky coder, so are we really just seeing another phase of Revenge Of The Nerds? In which case, we can blame the jocks for being the root cause of it all!

[the spectacularly refined chap]

Re: Shellcode bytes in sequential order

"Shellcode" in this context means the payload used as first point of entry - it's cracker leetspeak. Generally small and difficult to paraphrase. It's the kind of thing that in e.g. a buffer overflow attack you would place in the buffer in question before overflowing the buffer and executing it.

[Anonymous Coward]

Malware in Lisp?

Higher attacks brackets?

[Jou (Mxyzptlk)]

Re: Malware in Lisp?

Must have automatic bracket completion.

[Doctor Syntax]

Re: Malware in Lisp?

The deafening clatter of closing parentheses.

[richardcox13]

Re: Malware in Lisp?

https://xkcd.com/297/

"Lisp ... Elegant weapons for a more civilised age."

[Brave Coward]

So...

From ELIZA to ELUDA ?

[fg_swe]

Bloody Amateurs

Thank god the malware authors seem to be low intelligence, badly read folks.

I read of much tougher stuff 30 years ago.

[Gene Cash]

Malware in Lisp

Yes, I do have EMACS installed... why do you ask?

Naming it CAR & CDR instead of FIRST & REST was the true malware move.

[that one in the corner]

Re: Malware in Lisp

Why? Don't you know where your Address and Decrement Registers are?

And what do you end up using instead of CADR? FIRST_OF_THE_REST is readable but a pain to type! Which only leaves us needing "better" names for CDDR, CAAADR etc etc (you soon get used to using those to pick your way through flattened graphs, k-way trees and other fun data structures).

[that one in the corner]

Re: Malware in Lisp

Bah.

> Don't you know where your Address and Decrement Registers are

Where the Address and Decrement parts of your Registers are

Don't let the tablet's orteaukorekt delete lumps of sentence when you miss the space button andrunallthewordstogether.

[that one in the corner]

Re: Malware in Lisp

> Naming it CAR & CDR instead of FIRST & REST was the true malware move

Aside from being sarky about whether or not you know where the names CAR and CDR came from, it is more important - if anyone wants to use Lisp - to realise that calling them FIRST and REST would only make sense in one - albeit common - use of the Cons Cell. The two halves of the cell are equally capable of holding the same kinds of data and, if it makes sense to your algorithms, you can quite happily always have a pointer in the CAR and an atom in the CDR.

More - sensibly? - you'll use the cell to hold a binary tree - in which case, let's moan that the accesors aren't called LEFT and RIGHT or BEFORE and AFTER. Of course, if it makes your code more readable, you can always just define functions with those names...

But I was very serious about the happy fact that CAR and CDR allow for simple compound accessors just by adding in a few more As and Ds, which "alternative" names really don't - as the Common Lisp docs show :-)

[vekkq]

how big is the haskell malware, i wonder? cant compile a hello world under half a mb.

[that one in the corner]

Maybe that is part of the trick to getting malware onto people's systems.

Either make it tiny, so nobody notices it slipping down the wire, or so big that you get a dialogue box saying "3 minutes, 2 minutes, 17 minutes..." and then users just take it in their stride "bloody thing is doing ANOTHER update!" and go get another coffee.

[Anonymous Coward]

More a failure of anti virus software, I feel ?

Or is that unfair.

My experience of writing a virus was in x86 assembler directly. Took a while, was very small and the payload was inactive. I was more proud of the fact that after it infected a machine, it switched back to uninfect it. Trialling it with a few friends machines, I confirmed that it could infect a system and then disappear without a trace having moved on.

I often wondered if anyone else had done this. And if that had, how would we know ?

This was back in the late 80s.

[doublelayer]

Re: More a failure of anti virus software, I feel ?

There were some malware that cleaned themselves up after doing something, but it wasn't that common because it wasn't very useful. After all, most of the reasons to install malware somewhere benefited from staying there for a while, whether it's ransomware, a botnet member, looking for bank passwords, or messing with users. Even those that just scanned once for something interesting would probably stay around to increase the chance of spreading. The most likely versions to self-delete would be things targeted at a specific victim that didn't need to spread, but even those were unlikely to do so because, if you were targeting someone specifically, you probably wanted to do plenty of things to them.