Re: [OT] Even viruses are now i18n!

From: Antoine Leca (Antoine10646@leca-marti.org)
Date: Fri Apr 23 2004 - 11:15:12 EDT

  • Next message: Edward H. Trager: "Re: Unihan.txt and the four dictionary sorting algorithm"

    On Friday, April 23, 2004 3:05 PM, Marco Cimarosti va escriure:

    > Antoine Leca wrote:
    >> The virus cannot have any knowledge of a language code. And
    >> much less of the language used by its next victim...
                                ^
    Oops: I forgot to repeat "code" here. Looks like it confused people.

    > It sends e-mails to addresses stolen from the previous victim's
    > address list, so it can analyze the top-level domain of these
    > addresses (".it", ".fr", etc.).
    >
    > Although, strictly speaking, these
    > domains normally correspond to *country* codes, they are a pretty
    > good hint of the language of the next victim.

    I know that (see the rest of my post). Spammers too, as it seems...

    This is really a hint for the language. Not knowledge of its code.
    I was corrected on the point that .TK did not stand for a TLD (my point),
    but rather was a language code, Turkmen, which happens to be related to the
    base language.

    Let's drop Turkish for a while, and switch to Swedish, where I feel things
    are clearer. ccTLD for Sweden is ".SE" (which is the value engraved in the
    virus); language code is "sv" on Unix, 0x01D on Windows, or 5 on MacOS. My
    claim is the virus does not have knowledge, at any point, of the latter
    codes. Nor it needs it.
    As you describe, it uses the former, deduce that the language of the elected
    victim is likely to be Swedish, and compose the body of the mail in Swedish.
    No need to use "sv" here.

    Sorry if it was unclear first hand.

    Antoine



    This archive was generated by hypermail 2.1.5 : Fri Apr 23 2004 - 13:38:32 EDT