The Hacker Project - a free online game

Feedback Terminal => Suggestions => Topic started by: ph on June 26, 2010, 08:26:51 AM



Title: New malware suggestion
Post by: ph on June 26, 2010, 08:26:51 AM
I’ve got a few ideas about new kind of malware:

Rootkit – it can hide processes. Only the owner of the process can see it. The owner of the server which rootkit has to install Rootkit AV to disinfect his server and see hidden processes.

Fork bomb – if someone installed fork bomb on your server you wouldn’t get access to your HD. The solution to remove it is change your IP. Higher version of fork bomb means faster installation.

Stealware – if you had installed stealware and you solved the mission, all HPDs and ability points from that mission would be transferred to the owner of stealware.

Keylogger – this kind of malware would send all IP of your connection to the owner of keylogger.

Zombie bot – if you installed it on the server of your enemy, you could use 10% power (CPU, memory and bandwidth) of his server.

Polymorphic generator – if you had any kind of malware, you could use polymorphic generator to change/mutate that malware. Any use of the polymorphic generator would create different (modified) malware. To “treat” that malware (remove polymorphic code) you would have to use Polymorphic AV generator. It would generate special AV (only for that malware) which would remove it from your server.

Backdoor – even if you changed your IP or your password the owner of the backdoor would always have you in the IPDatabase.


Title: Re: New malware suggestion
Post by: Brok Ironfist on June 26, 2010, 09:13:57 AM
Rootkit:  I would really like to see some type of process hider/unhider.

Fork Bomb:  A denial of service attack.  nice.

Stealware: I like this.  Could be used to help group mates, as well.  They install it on your box and you do missions... they get income.

Keylogger:  Very cool idea.  Keep track of every IP they visit.  Yeah, I like it.

Zombie Bot:  Another neat idea.  Perhaps if it added the stolen power to your system (like a distributed server) then you could do more on your computer.  If the Bot were to be lost, you could be stuck in a Overclocked situation forcing you to kill processes, upgrade your server or even added a bot to another server.    I could see massive Zombie Bot armies hitting many of the public and secret server right away to get a jump start on research. 

Polymorphic generator:  Kind of like an encryptor for virii?  People have asked for this for a while.  I think it could gain quite a bit of support, especially if Virii become easier to kill (see glitch's thread).  This would add an extra step to prevent it.  Nice.

BackDoor:  Another good idea.


Very nice ideas, PH.  I support all of them!




Title: Re: New malware suggestion
Post by: bontrose on June 26, 2010, 11:15:54 AM
i like it but you would need diminishing returns for multiple zombie bots on one server


Title: Re: New malware suggestion
Post by: Hatejacket on June 26, 2010, 11:29:47 AM
I agree with Brok. These are some nice ideas.


Title: Re: New malware suggestion
Post by: Exousia on June 26, 2010, 11:53:18 PM
I believe some of these have been pondered before, but I'm always interested in building a better mouse trap, as it were.


Title: Re: New malware suggestion
Post by: Hatejacket on June 27, 2010, 03:32:20 AM
I'd like to see a worm that takes a while to install, not long to disinfect (Under 1 hour for v5) and doesn't allow you to change IP until it's disinfected.


Title: Re: New malware suggestion
Post by: ph on June 27, 2010, 07:06:23 AM
Polymorphic generator:  Kind of like an encryptor for virii? 

Encryptor which special/different 'key' for each virii. To disinfect mutated virii you would have to create mutated AV.
It means inf number of virii and inf number of AV.


Title: Re: New malware suggestion
Post by: Brok Ironfist on June 27, 2010, 08:57:49 AM
Polymorphic generator:  Kind of like an encryptor for virii? 

Encryptor which special/different 'key' for each virii. To disinfect mutated virii you would have to create mutated AV.
It means inf number of virii and inf number of AV.

How about this.  When the virii is encrypted with the Polymorphic generator it gets a 'key' attached to it.

FileShare .3 (X6x2tt1Rs)   <- key in parens and becomes part of the name.

You would then have to start a special research project and paste in that specific key.  The research takes something like 15 hours per 0.1 of a fileshare or 15 hours per 1.0 of a Adware.  Once the research has been completed it creates a special program and saves it into your file list.   AV (x6x2tt1rs)  This file is then run against the virii and once completed is destroyed in the process.  Execution time: Instant.






Title: Re: New malware suggestion
Post by: bontrose on June 27, 2010, 03:48:53 PM
do you keep the special av as well( it would eat up space)


Title: Re: New malware suggestion
Post by: WolfDoc on June 27, 2010, 09:48:35 PM
Keylogger – this kind of malware would send all IP of your connection to the owner of keylogger.

Love this Idea....Used everyday by real hackers....

-------------------------------------------------------------------------------
Backdoor – even if you changed your IP or your password the owner of the backdoor would always have you in the IPDatabase.

Like it But sort of have this...But we could use Tracking Software, Make HP more interesting...

-----------------------------------------------------------------------------
Fork bomb – if someone installed fork bomb on your server you wouldn’t get access to your HD. The solution to remove it is change your IP. Higher version of fork bomb means faster installation.

Interesting But think be better if Owner didnt have access his fiances instead of HD...Would have to Remove to unfreeze ur HPD...
--------------------------------------------------------------------------------------

Stealware – if you had installed stealware and you solved the mission, all HPDs and ability points from that mission would be transferred to the owner of stealware.

Good Idea but ability points i think would be taking it a lil to far..

But all good ideas PH, glad ur came around and started Get social...lol


But as well

HateJacket...
I'd like to see a worm that takes a while to install, not long to disinfect (Under 1 hour for v5) and doesn't allow you to change IP until it's disinfected.

I like to see something of this nature added as well please


But What u think SirEmi? Do able






Title: Re: New malware suggestion
Post by: bontrose on June 28, 2010, 10:28:32 AM
dont forget a trojan horse!


Title: Re: New malware suggestion
Post by: ph on June 28, 2010, 03:00:36 PM
dont forget a trojan horse!

i though about trojan horse.
but really have no idea how that kind of malware could be used ;)
maybe it should show us fake runnin' processes?


Title: Re: New malware suggestion
Post by: Thraxian on June 28, 2010, 04:29:33 PM
Trojan horse (n.):  a program that appears desirable but actually contains something harmful

First thought: using Research, you create a new version of a virus, but name it to make it appear like a password or firewall application.  When someone downloads and "installs" the new application, they actually install a virus.  Ie.  a virus named "Special Password Break"

Problem: We don't install password or firewall applications on our local systems.  We just have to run them.  Viruses are not installed by running them.  So it is not possible to trick a user into installing such a virus.

Solution: Make the Run/Install buttons the same for helpful and harmful software.  You install (and subsequently uninstall) applications to provide firewall and password protection, or to break passwords or bypass firewalls.  You also install viruses (but uninstalling them is a bit more difficult)



Second thought: in a similar screen to research, allow users to "embed" a virus inside a helpful application.  When the application is run, the CPU/memory is a bit higher than normal due to the virus code that also runs.

Alternative #1: When the application is started, the virus is started as well.  Running the application a second time will not install a second version of the virus, however.  The application can be ended as normal, but the virus must be AV'd to get rid of it.

Alternative #2: Since the virus is embedded in the application, when the application ends, so does the virus.  It becomes more important to include the virus in files that are always running, like log deleters, firewall blockers, etc.


Either way, it will be up to the user to detect that a program is larger than it "should" be for a given version.  AV programs could be run to scan the system looking for "infected" files, not just to clean viruses already loaded in memory.


Title: Re: New malware suggestion
Post by: ãłþħά-∆9 on June 28, 2010, 04:48:39 PM
I suggested a trojan before, like  a virus that binds to an ordinary program, and when that program is downloaded/ran it instantly slaps a virus on the target...Don't know where i suggested it... Alot of good ideas get lost in threads

Could also lead to new software - Virus Binder/Unbinder

Seperates and fuses viruses with regular files, a malware log-deleter plz  :14:


Title: Re: New malware suggestion
Post by: Brok Ironfist on June 29, 2010, 06:21:33 AM
I suggested a trojan before, like  a virus that binds to an ordinary program, and when that program is downloaded/ran it instantly slaps a virus on the target...Don't know where i suggested it... Alot of good ideas get lost in threads

Could also lead to new software - Virus Binder/Unbinder

Seperates and fuses viruses with regular files, a malware log-deleter plz  :14:

That would be perfect implementation of a trojan horse. 


Title: Re: New malware suggestion
Post by: bontrose on June 29, 2010, 10:46:54 AM
that wold be great