Slashdot Mirror
Russians Suspected of Uroburos Spy Malware
judgecorp writes "While Russia's political activity is center stage, its cyber-espionage apparently continues. Russian intelligence is strongly suspected of being behind the Uroburos malware which is targeting Western governments and commercial organizations. There are Russian-language strings in the code, and it searches its victims' systems for Agent BTZ, malware used in previous attacks believed to have been carried out by Russia."
to the NSA?
So any google translating script kiddie can make malware that puts the blame on Russia by just throwing random ruskie strings in and searching for alleged russian virii?
Who came up with this scheme, the same person that talked about WMD in Iraq?
HTTP/1.1 400
Everyone is copying the US now. I wonder where Russia's GITMO will be?
That's kind of cute. I take it that for you history begins in the year 2000 and is limited to the US?
Just as an FYI, Russia (nee Soviet Union) has been involved with espionage via computer for a very long time. One famous case:
The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
"In Soviet Russia, computer attacks you!"
Which says a lot about our current computing environment - even Windows: one has to be a real expert (like PhD level) to find current exploits.
You can find exploits by stumbling upon them when doing something related to the exploitable functionality. Utilizing them requires skill, though.
Goodness, my "fellow" American hawks sure are itching for war with Russia. Unfortunately, I don't think this is the solution to domestic problems and the care and feeding of the media that they believe it will be.
I sincerely, sincerely hope that you're joking. Whatever problems the United States may currently face, it is nothing compared to the Gulag Archipelago of the Soviet System. And I think you will find that the current regime has no problem with "extraordinary rendition" to faraway places, either.
That's what it takes to infiltrate well secured computers and networks. For the most part though infiltrators rely on badly secured stuff these days. The Target invasion was possible due to poor security practices - which Target's own IT/security people warned management about.
Except that GP was not talking about copying the US' computer-based espionage operations, but the US' various illegal wars.
You know, there is a bit of a mess unfolding in Ukraine. There are pro-russian and pro-european factions and the russians are obviously supporting the former -- with a completely illegal show of force.
Less well known is that the pro-european factions supported by the West are largely far-right nationalists. Neonazis, pretty much. See, e.g. this piece by Max Blumenthal.
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
In the last, what?, ten years all of the exploits have been found by professional security researchers, spy organizations (Stuxnet), and other exploits were done by very serious experts who REALLY knew their shit.
Actually, what you are seeing is criminals taking over the exploitation of exploits, before it was hackers having fun and sending "it's my birthday" messages around, now it's serious criminals using exploits to steal serious money. These people don't advertize their finds, they use them to the fullest extent possible. When PHD's find an exploit you can be sure 90% of the time it's already known to criminals who have used it for a while.
If you wonder at the accuracy of that, just look around at how many viruses are out there and start counting the news reports for companies compromised.
DEMETRIUS: Villain, what hast thou done?
AARON: Villain, I have done thy mother.
Shakespeare invents 'your mom'
The problem is that there are -so many- weak links these days. Anything, be it the application, web server, backend server, DB server, Web browser, Web browser add-ons, OS, firmware, NIC firmware, router, switch, can have a weakness that can be easily exploited to cause a lot of issues. Air-gapping will help prevent those attacks, but I'm sure if it is a big organization wanting the data, rich enough to buy 0-day exploits from an auction, they are rich enough to have "boots on the ground" in a target country to perform physical attacks (sticking a USB flash drive into a machine and letting Autorun/Autoplay do the rest, for example.)
In the '90s, the computer industry had two choices, go the secure route, or go the cheap route. It is obvious how the industry went. Even languages that could offer provable security with known states are all but dead [1], so there is no way other than just keep patching holes, to have any semblance of solid security these days.
It would be nice to start from scratch. There are still ways to have provable states and know how a program will function, even with edge/corner cases. Similar with hardware. If we go with known good embedded operating systems, an attack on an IP stack will have limited consequences.
[1]: Ada may be ugly, but it does offer provable security.
The problem is that people have forgotten the atrocities of the Soviets. From "Moscow Fried Chicken" (the result of burning up refugees in Afghanistan) to the fact that leaving a country or a "zone" would mean a swift death for the person and their family, all the many atrocities done by the USSR or their puppets are history virtually forgotten since the Berlin Wall fell.
Instead, the focus is on how evil the US is... but I would recommend someone compare the days of living in the early to mid 1980s in west Germany compared to the DDR... things are relative. The US might get caught spying, but they are not sending troops to attack German citizens because they want to go visit a nightclub in France.
Yup, imagine how time wasting and frustrating it would be to insert Cyrillic lettering in strings in your typical UTF8 programming language. So I don't buy that Rusky argument at all.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
"It has Russian language strings in the code, so it must be Russian intelligence behind it!"
(facepalm) Really? This is an example of investigative prowess?
, .
I must be Russian. There are Russian language strings in my post.
Proverbs 21:19
No, I don't. I point people to it since it is both a good read and informative on many subjects that are discussed here, both directly and indirectly. If you read it you might understand.
I prefer to have informed discussions. Unfortunately that is often difficult here, especially on certain topics. If more people were better informed, and maybe left behind various fringe theories or ideas, the discourse would be more useful.
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
The problem is that people have forgotten the atrocities of the Soviets...all the many atrocities done by the USSR or their puppets are history virtually forgotten since the Berlin Wall fell.
Maybe that's because the Soviets/USSR doesn't exist anymore, and hasn't since 1991. If you think Putin's regime is equivalent to the USSR, then you should probably do a re-fresh of your geo-political perspective.
Instead, the focus is on how evil the US is...
You're right! Instead, let's focus on the past evils of the USSR and ignore the more recent evils of the US. Forget the NSA...KGB! US invasion of Iraq? No no no! Soviet invasion of Afghanistan! Abu Ghraib was nuthin compared to Kolyma, Norilsk, or Vorkuta!!! USA! USA! USA!
Your strategy should really improve the credibility and moral authority of the US in the eyes of the rest of the world going forward. Why didn't someone think of this earlier?!?
The problem is that there are -so many- weak links these days.
True, but so many of the big invasions, like the Target deal, use things that were securable, and that people (like their own security/IT people) said should be secured. Security is an endless software arms race, but the attackers usually take advantage of the defense's sloppiness or cost cutting. Even Stuxnet required some German engineer to unknowingly plant via a thumb drive.
Ada may be ugly, but it does offer provable security.
Ada has some definite advantages, like avoiding buffer overflows, but in and of itself can't guarantee security. I do agree though that using a language like that would be a big improvement.
Please define "illegal wars".
Lacking a mandate from the relevant institutions of international law; in the absence of a credible threat to national security; based entirely on circumstantial evidence, cherry-picked intel and plain fabrication; against the wishes of a large fraction of voters...
Take your pick.
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
Sounds fishy. It SOUNDS like an American columnist came up with it out of his own head and forgot that Ukraine doesn't have southern democrats.
Svoboda and right sector are hardly being coy about it.
But yes, confederate flags sound crazy, I agree. In fact, if I were writing a fishy column I would have discarded that bit as being too obviously fabricated.
But then I don't expect a lot of sanity or even rationality from people who suffer from the kind of ideas these guys have. The local far right and left fringes of the spectrum share this habit of exchanging symbols with remote, but like minded, groups it seems.
Which is bullshit propaganda.
That nazis (or more correctly extremely right wing - though they are more moderate now compared with some years back) are a _small_ part of the group complaining about the corrupt government doesn't have anything to do with this. That a corrupt government goes against the will of the people who peacefully protest until the government forces begins killing people is another.
Trying to paint the protesters as nazis is provably false as the vast majority are liberal and trying to say that they were supported by "west" (whatever that mean*) is also propaganda. But you sure like to swallow that, right?
One have to remember that Russia have had experience in black propaganda and false flag sabotage against themselves (in order to be able to "react" while looking like a victim) since at least the 1800s. Anybody studying history should be able to cite some examples but I'll just name one of the most known: the protocols of sion. Many Russian politicans still believe that it is true BTW.
(* someone recognize that Russia is starting to use cold war terms lately?)
The problem is that American Exceptionalists pretend their shit doesn't stink. You want to talk about Stalin's gulags? Great! But then lets also talk about how the United States was formed by genocide, slavery, and conquering nations that hadn't attacked us. You want to talk current events, start by explaining how Putin is in the same universe as torturing, democracy overthrowing, murdering, invading, droning, innocent-imprisoning universe as George W. Obama?
The USSR was no where near as powerful as the USSR that was presented via propaganda (from both sides). I would argue that Russia has much of Europe in a tighter noose now via natural gas exports than they did during Soviet days. Many of the gas lines also run through Ukraine by necessity, which is probably what this is really about as opposed to any feigned concern for Russian speakers in Crimea. It is true that Russia doesn't have as many satellites in its sway as it once did, but that's also largely to do with the evolution of the EEC to the EU as well as US and British pushes to get former Soviet states into NATO. However, while Russia doesn't have the political sway that it once did, that doesn't mean that regaining as much of that sway as possible isn't a motivator for Putin.
Regaining degraded national prestige and empire has been a motivating factor for both Hard and Soft dictators throughout history. Not to Godwin this, but the precursory actions in WWII involved annexation of German-speaking areas that were lost to the German Empire after WW1. Likewise, Mussolini laid claim to much of the non-European territories formerly held by the Roman Empire (There is a reason why he adopted the fasces and why man hole covers in Italy are stamped SPQR these days). I believe that it is short sighted to say that because Russia does not have the influence that it once did that Putin will not try and gain as much of it back as possible.
The major difference is that the USSR was an Ideology State, much like the United States is. It was meant to be the shining beacon for radical, revolutionary socialism and communism and as such enjoyed the support of left-wing workers' groups, academics and politicians around the world, whom they also supported in turn. The Russian Federation is a nation state based on the historical territory of a specific set of ethnic groups bound together by history, blood and language. It's much more like South Korea in that way, and that lack of ideological status is what will keep them from regaining Soviet-era sphere of influence. Beyond money, it isn't like anyone will be driven to spy for Russia these days who isn't a Russian. There are no Reds lurking in the halls of power looking for juicy secrets to pass to their ideological brothers in arms.
With regards to your initial points, I'll accept my overstatement on Ukrainian deaths. I had that number stuck in my head for a long time. I may have been confusing it with similar Chinese issues (Communism tends to kill large numbers of people via stupidity as well as malice). However, I don't think that Yeltsin stating that he chose Putin to be his successor can necessarily be taken at face value. If a stone-cold killer had one over on you, what would you do? The fishiness comes from the resignation as opposed to a coupe. A coupe can be attributed outright. The fact that Yeltsin resigned, put a former intelligence officer with ties to the legal and illegal oligarchy (many of whom were also former KGB officers who leveraged those positions for economic gain after the fall of the Soviet Union), who then was able to play a shell game of power to where he has been either President or Prime Minister since 1999, smacks of strong-arming to me. However, that is supposition. I'm not in possession of any intelligence on the matter that hasn't already been made public.
However, for the sake of comparison, since Putin assumed control of the Kremlin, the United States has been through 4 Speakers of the House (Gingrich, Hastert, Pelosi, Boehner) and 3 Presidents (Clinton, Bush, Obama). Obama will be out of office in 2016, but I am willing to bet that Putin will be around one way or another for some time to come. As the swap to Prime Minister showed, he is only limited by the conservativeness of his terms, not the number.