: I do not believe the malware story
: I am going to call this one - supposedly a 22 year old
: "IT expert" back engineered NSA malware within a
: few hours, found a back door, and shut it down. I'm not
: buying it.

Well, that's fine, but the story's not about his "back engineering" anything. Rather, he looked into the code and spotted a place where the virus calls to a particular website that was nonexistent at the time. That bit of code may well have been readable, a bit of text that would be necessary to the call to that site, in amongst other code in binary or hexadecimal.

The story has it that the IT dude registered the domain as part of monitoring what the virus was doing and how far it had spread - and it turned out that getting that domain name into the global DNS was how the original programmer chose to make it possible for himself to shut down the spread of the virus if he wanted or needed to.

If that much of the story is correct, it would not take long at all to release a new version of the malware. All it would take would be a few relatively minor changes to the source code and recompiling the software.

The remaining unanswered question is, "How does it all get started?" That is, what's the route and method of the initial infection(s), so that the updated virus then can start spreading? Apparently there's an exploitable vulnerability in unpatched Windows computers that's involved, whatever that vulnerability may be.

--hobie

*************************************************************************