Something smells fishy

At DEFCON 15 this year, Paul Sebastian Ziegler presented a"multi-platform" worm that runs in the .NET framework and compatibleimplementations. He called it "Akikaze", which is Japanese for "autumnwind". We call it MSIL.Yakizake,which is Japanese for "grilled fish". We never use the virus author'schoice of name, and since Yakizake sounds similar, it worked out well.

It's unclear why Mr. Ziegler thinks that his worm is multi-platform,because the platform is the environment in which the application runs.It's not the CPU on which it is running, and it's not the operatingsystem, either, if the environment is a virtual machine of some kind.In this case, the environment is the .NET framework or equivalent(which I'll simply call ".NET" from now on, but it's meant to includethem all), which is a virtual machine. While .NET itself ismulti-platform, the virtual machine that it presents is not. Thevirtual machine is just a single platform, regardless of which CPU itis running on.

Consider that a Word 97 macro running in Microsoft Office on theMacintosh or on the PC is still a Word 97 macro. In the same way, anMSIL application running in .NET on a SPARC or on an S/390 is still anMSIL application.

There can be technical exceptions, of course, such as theMSIL.Impanate virus. Impanate is a file infector that understands boththe 32-bit and 64-bit MSIL file formats. It's an MSIL virus, so it'snot multi-platform, but it's multi-platform *aware*. Yakizake isneither of these things.

Yakizake is operating-system aware, but then so is any Word 97 virusthat calls Windows registry functions – nothing special there.

And nothing special here.