Highly Advanced Backdoor Trojan Cased High-Profile Targets For Years

An anonymous reader points out this story at Ars about a new trojan on the scene. Researchers have unearthed highly advanced malware they believe was developed by a wealthy nation-state to spy on a wide range of international targets in diverse industries, including hospitality, energy, airline, and research. Backdoor Regin, as researchers at security firm Symantec are referring to the trojan, bears some resemblance to previously discovered state-sponsored malware, including the espionage trojans known as Flame and Duqu, as well as Stuxnet, the computer worm and trojan that was programmed to disrupt Iran's nuclear program. Regin likely required months or years to be completed and contains dozens of individual modules that allowed its operators to tailor the malware to individual targets.

Comments

Microsoft Windows only

[innocent_white_lamb]

This apparently only runs on Windows.

I really don't understand why people run sensitive and critical stuff on Microsoft Windows. (I'm not trying to be a troll.) It's the world's biggest target for malware, it's a monoculture, and it has a security model that tends toward convenience over security, and was actually bolted on after-the-fact.

Unix (Linux) is about as far from a monoculture as you can get while still remaining reasonably compatible between distributions, and it was built with security in mind.

Re:Microsoft Windows only

[Anonymous Coward]

I don't understand people that think only windows is susceptible to this type of targeted attack. Are you new to IT or just naive?

Re:Microsoft Windows only

[Anonymous Coward]

targeted attacks like this are OS agnostic, if the organisations they wanted to hack were running Linux or OSX then these would have been designed for that target instead.

Re:Microsoft Windows only

[Anonymous Coward]

Shell shock ... lol

Re:Microsoft Windows only

[93 Escort Wagon]

I really don't understand why people run sensitive and critical stuff on Microsoft Windows.

Because doing so saves them both time and money - and those two factors trump everything else in their decision-making tree.

Re:Microsoft Windows only

[Anonymous Coward]

Not having monoculture is only security thru obscurity. Basically instead of putting the key in the lock and turning clockwise to unlock it is turn it counter clockwise. It does not take long to figure it out...

In a targeted attack it is even worse.

Re:Microsoft Windows only

[Anonymous Coward]

> saves them both time and money

Heh. I wouldn't say [citation needed], but you'd have to quote Microsoft propaganda for said citation, right?

Re:Microsoft Windows only

[Anonymous Coward]

I don't understand people that think only windows is susceptible to this type of targeted attack. Are you new to IT or just naive?

I don't understand people who can't think logically, but still think their SlashDot posts are relevant.

NOwhere did innocent_white_lamb say that _ONLY_ Windows is vulnerable. NOR did innocent_white_lamb say that Linux is _NOT_ vulnerable.

I'm in complete agreement with innocent_white_lamb. It's not black-or-white. Windows is generally more vulnerable than most Linux distros. I admin both and I find that I can much more easily and transparently lock down a Linux server. I know, and _control_, what processes run, what modules load, what libraries are on the system, etc. Windows is full of too many processes, too many that take too much time to figure out what they do, why they run, can they be removed without causing problems, etc. Yes, some of the GUI tools, panels, etc., are easier to run and configure some things, but I hate how confusing some things are, and how you have to drill down in some obscure .msc to get to a checkbox that's causing a problem for some other process. One Windows server I inherited runs tons of custom processes, ASP.net stuff, etc., and uses dozens of mysterious logins with even more mysterious file and directory permissions. The coders are long gone and there was never any documentation. I guess it all made sense to them and the hell with everyone else. Try tracking down the problems you'll have if you disable one of those mystery users. I've certainly turned off all remote access for them- something the previous admins did not do. Give me Linux. Transparent and created out of passion for doing things right. /rant

Re:Microsoft Windows only

[Anonymous Coward]

What you are describing is simply a lack of knowledge of the tools and processes on windows, true this is a problem for many. But it is a lack of education on your part on how to correctly lock it down. Similiarly poorly trained Linux admins make the same horrible mistakes on Linux.

Re:Microsoft Windows only

[93 Escort Wagon]

No, because the same would be true if they developed on top of stock OS X or Red Hat Linux.

Using someone else's platform as your base saves development time and money. It doesn't mean it's a smart move, but time and cost considerations seem to be all anyone cares about these days.

Re:Microsoft Windows only

[exomondo]

This apparently only runs on Windows.

A targeted attack is going to run on whatever the target uses.

Re:Microsoft Windows only

[Anonymous Coward]

I appreciate what you're saying, but I did not ask to become a Windows admin. I'm in the US and you may not be aware of our society, who controls the workplace, and ultimately the flow of $ that we need to live. In the US, you either do what you're told or you're out in the cold. (Ugh, sorry.)

I've run Microsoft's security analysis tool and I think it's great and I was very happy to find that I had figured out most of it. Remember- I did _not_ create the Windows servers- I _inherited_ them, with _NO_ documentation.

Full disclosure: years ago I saw a fork in the road: Linux or Windows. At that time I happened to know a super-genius Windows programmer who told me about a book "Undocumented Windows Secrets" (I think that's the name). She told me she had worked for weeks to develop a function (method, procedure, whatever cool buzzword of the day is) that she later found out was completely done for us in Windows, but not advertised. Take a look at how thick that book is and how much is undocumented. And that was programming functions and libraries! You could spend the rest of your life in classes and you'll never know as much about Windows as you can so easily find out about Linux.

Re:Microsoft Windows only

[sphealey]

There's now an entire generation of IS/IT managers, directors, and CIOs who not only prefer Microsoft technology but have an active dislike of anything related to Unix(tm) - including but not limited to Linux(tm). And along with dislike comes distrust and contempt. They firmly believe that Microsoft provides superior technology, tools, and usability, and that to choose other technology is not only to make a mistake but to expose themselves to professional risk.

You can disagree with them if you prefer (I tend to, myself). But people holding this set of technical preferences now makes up a substantial fraction - possibly a substantial majority - of technical decisionmakers in the US at least.

sPh

Re:Microsoft Windows only

[alen]

microsoft is one price and you get a server and tools and all the features

a lot of other products they nickel and dime you for features, the tools to manage them, etc

Re:Microsoft Windows only

[Threni]

You've massively missed his point. Windows has long been a joke. Pop a CD in and it just runs an exe. Pop a USB key in and it just runs an exe. Other OSes are a little more discerning.

Re:Microsoft Windows only

[mspohr]

Linux is one price (free) and you get a server and tools and all the features.... bonus, you are not a target for malware!

Re:Microsoft Windows only

[Anonymous Coward]

Why people think one OS is more secure than another is ignorance. The bottom line is they all have bugs and all have flaws. This attack scenario has everything to do with prevalence of Windows and it's wide use of their intended attack base. If the targets ran Unix they would attack that. Acting like if everyone ran Unix that they wouldn't get attacked just as hard is as Windows is your typical Slashdot M$FT flaming and not based on reality.

Re:Microsoft Windows only

[sumdumass]

You are correct, poorly trained admins will net poorly secured systems with the same or similar horrible mistakes.

However, you are glossing over what was actually said in order to make those statements as if it was some overriding truth. The problem is that windows exposes to much of the underlying systems to programs running so exploits in power point or outlook can infect the entire machine kernel and spread to the servers via internal network support infrastructure (domain controller functions). Now much has been done in more recent versions to limit this but it still remains true for the most part.

Part of this is because programmers write bad code to sell cheap software to people who are familiar with the ease of use of windows. In fact, this is likely why it is the most common OS out there- because it is so easy to write software and do things in that people see it as just working. Its that layer of ease which makes it easy to be exploited. Almost every anti-virus company out there worth a salt, will have complex (and sometimes simple) methods of virus removal you can look up and follow for when a virus gets past their products. It is simply impossible to completely secure windows or linux and still have a usable machine but it is easier to limit vulnerabilities on a linux or Mac system currently. This could change if they get more popular or do something stupid in the future or if malware writers decide to focus more and more on these smaller platforms. This is also why Adobe and Java was such a target for the longest of times. Cross platform and complete access.

Re:Microsoft Windows only

[HiThere]

Despite the "only security through obscurity" meme, you need to understand it, not just say it.

There are only two types of security:
1) security through obscurity,
and,
2) security through inaccessibility.
They can, however, be intelligently combined.

Please note that private key encryption is security through obscurity. Cutting the phone line is security through inaccessibility. Saying that "it's secure because they can't get the prime factors of that key" is security through obscurity.

Despite the meme, security through obscurity is widely and properly used. What's wrong if false obscurity, which is common. If you don't properly assess just how obscure your secret is, then you have a security failure.

So having a monoculture is reduced security, because that means that there are a much larger number of entities seeking to discover the secret...and any breach in security cannot be easily contained. If you don't have a monoculture, then a single breach cannot be as widely damaging, and is thus also less valuable to find. This is a sort of network effect.

OTOH, a diverse community means that more effort needs to be devoted to security, because each branch is a separate thing to be maintained. So it's not all benefit or all loss, it's a mixture.

FWIW, I choose not to have flash installed on my system, despite the fact that it would have some utility, because I consider that the weakness that it presents is not worth the benefit. The ability of refuse to have such a service installed allows increased security...at a cost. For some people the cost is higher than they are willing to pay. This reduction of the attack surface is a form of security through obscurity mixed with security through inaccessibility, i.e., I have become inaccessible to some forms of attact, and I have reduced my visibility to many attackers.

Re:Microsoft Windows only

[Anonymous Coward]

Autoruns has been disabled on Windows for years. Try flaming with something accurate. https://support.microsoft.com/kb/967715

Re:Microsoft Windows only

[savuporo]

>>Unix (Linux) is about as far from a monoculture as you can get

What, like Android that has linux underneath ?

Re:Microsoft Windows only

[Demonoid-Penguin]

targeted attacks like this are OS agnostic,

Correct, provisionally - targeted attacks are OS agnostic - if designed to be OS agnostic.

In the case of Regin (did you even read the lead before shooting your idiot mouth?) it is not OS agnostic. It affects Windows only. So does Stuxnet

Disclaimer - I have no problem with Steve Balmer throwing chairs - as long as they're heavy, and hit idiots like you. Thanks for lowering the standard.

Re:Microsoft Windows only

[Anonymous Coward]

And you could try to disable autorun on windows for longer than that, but the autorun-disable was bugged, so you weren't protected at all. And MS makes design choices like this a lot.

Re:Microsoft Windows only

[Charliemopps]

This apparently only runs on Windows.

I really don't understand why people run sensitive and critical stuff on Microsoft Windows. (I'm not trying to be a troll.) It's the world's biggest target for malware, it's a monoculture, and it has a security model that tends toward convenience over security, and was actually bolted on after-the-fact.

Unix (Linux) is about as far from a monoculture as you can get while still remaining reasonably compatible between distributions, and it was built with security in mind.

It runs on the system the target had. How many world leaders are running linux? If it were a significant portion you can rest assured we'd start seeing these for linux as well. The fact of the matter is, if your opponent is the NSA, your OS is rather irrelevant.

Re:Microsoft Windows only

[Rich0]

targeted attacks like this are OS agnostic,

Correct, provisionally - targeted attacks are OS agnostic - if designed to be OS agnostic.

In the case of Regin (did you even read the lead before shooting your idiot mouth?) it is not OS agnostic. It affects Windows only. So does Stuxnet

His point was that Regin attacks Windows because the people that the authors of Regin were trying to attack run Windows.

If the targets of Regin ran Linux, then Regin would attack Linux. Instead of using one of the dozens of Windows zero-days out there, they'd use one of the dozens of Linux zero-days out there. No, I can't cite them - they wouldn't be zero-days if I could.

Re:Microsoft Windows only

[Anonymous Coward]

Commercial software is almost all as you describe it - "bad code to sell cheap software"

Includes AV (seemingly especially)
Your examples of Adobe and Java.
Just about every single Windows program is designed as if it's not going to be attacked.
Windows itself is a great example (though it's certainly gotten infinitely better than when you could simply ping a machine and lock it up.)

Ironically, games may be one of the more hardened software targets on Windows... and look how they fare.

That's not to say you can't use defense in depth, and make it exceedingly difficult. I've had a Cisco pen team try to get into my portion of a network before. (Didn't learn about it until after, as there were only a few who knew they were doing it, and were on the LAN.) Two things help that: First, an admin who knows what they are doing and says NO, to certain requests. Second, understanding how things work and minimizing the attack surface. As one of the most obvious examples: If you've got windows machines, and they are firewalled off, so no SMB attacks will get to them, then you've eliminated a class of vulnerabilities. That's why even the horrid home routers are a good thing normally. But again, that's getting back to cheap software to sell things. (And never ever update)

Re:Microsoft Windows only

[Kjella]

Unix (Linux) is about as far from a monoculture as you can get while still remaining reasonably compatible between distributions, and it was built with security in mind.

It was designed from scratch to be a multi-user system, which is neat and took Microsoft at least until UAC in 2006 to really implement. On the other hand Microsoft is the one who had a fleet of PCs that needed managing and created AD, which is the bread and butter of most corporate networks. That you can ssh in and run scripts isn't even close, I know there are third party tools to mimic some of it but there it's Microsoft that has the native advantage. And you can lock it way more down than the defaults.

In the end, even when you work with sensitive or critical information it's about getting the job done. And here's the real deal with how it works most place. Say 100 admins choose Windows, 99 do fine and one is hit by lightning. And 100 admins choose Linux, 99 get the evil eye and one is a hero for dodging lightning. Who wins? Usually the Windows admins where shit didn't hit the fan, because the happy Windows users outnumber the miserable Linux users. Those who got pwned aren't enough to swing the overall mood.

Re:Microsoft Windows only

[bouldin]

Maybe you missed all the critical remote code execution vulns Microsoft announced just this month.

https://technet.microsoft.com/en-us/library/security/ms14-nov.aspx

Four of the bulletins above are listed as critical remote execution. Two of them (schannel and OLE vulns) are very bad. The IE bulletin says it resolves 17 privately identified bugs.

As the previous poster said, Microsoft has placed convenience over security for many years now. They have improved dev processes a lot, but as you can see, many security folks still view MS as a liability.

Not to stray too far from the point, but I hope Linux distros arent repeating Microsoft's mistakes with feature-laden packages like systemd and its ilk. Tons of new features in an inchoate software package with no security audits? That is how Microsoft got its reputation for insecurity.

Re:Microsoft Windows only

[Crazy Taco]

There's now an entire generation of IS/IT managers, directors, and CIOs who not only prefer Microsoft technology but have an active dislike of anything related to Unix(tm)

I don't know how much the "actively dislike Unix" part is true, but yes, there are a lot of IT people that prefer Windows. And there are very good reasons for that. Microsoft makes some exceptionally good products in a number of areas. Here are some examples:

• Visual Studio, probably the best IDE known to exist. I've used it and competitors like Eclipse, and it is MUCH BETTER than Eclipse. This alone makes a lot of devs prefer Microsoft. And as of the announcement last week, is now going Open Source.
• .Net and ASP .Net, which are better than PHP (which is like classic ASP) and WAY better than Java, which needs a security patch daily and performs like a turtle. And as of the announcement last week, .Net and ASP .Net are going fully open source and multi-platform.
• Powershell, which for management is really, really good. It's gotten to the point now where it is better than competitors like Bash. Objects in the pipeline, rather than just text, is just so much better than any other shell.
• SQL Server, which is finally reaching performance/feature parity with Oracle, but has better management tools and is generally preferred by a lot of devs.
• IIS, which in it's latest incarnation has better performance than Apache, is easier to manage and is easier to get security isolation of websites out of (I do web hosting for a living, and I can easily stack 350 sites onto IIS and have them all be completely isolated in different processes with different security accounts as well, and it's REALLY easy.
• Windows Server, which admittedly is a tossup but depending on what you want may cause IT people to prefer it. It admittedly doesn't run on as much variety of hardware as Linux or scale up to supercomputers like Linux, but really is a very competent OS that is simple to manage and has probably the largest ecosystem of software written for it.

In summary, I don't get the bashing of Windows or all the "My Linux is teh best!" kind of comments. Linux has it's strong points as an OS, but Microsoft does too, and they have some fantastic products out there that can handily beat some open source equivalents. Depending on your workload, it can be very appropriate to prefer Microsoft products. (Of course, I'll be the first to say Microsoft has it's terrible products too... Network Load Balancer anyone? Linux based load balancers like F5 beat the pants off that thing.)

Re:Microsoft Windows only

[cavreader]

Competent system administration, service pack management, e-mail security measures, effective firewall administration, and strictly enforced limitations on what an employee can access via the internet can substantially reduce the impact of even the most serious application related exploits. The majority of malware today uses social engineering as it's attack vector but there are ways to prevent this in any company willing to invest in employee training and creating specific guidelines that even the most computer illiterate employee can understand. Most employees do not need unrestricted access to the Internet to do their jobs. Even companies using outgoing/incoming keyword blocking, black lists, white lists, and domain blocking at the firewall level are often to liberal and never updated fast enough to keep up with the fast paced and ever changing threat environment. If a particular internet site or service is needed by the employees those sites can be evaluated by a knowledgeable IT security professional to determine the risk of allowing employee access.

Stuxnext actually required someone to infiltrate (most likely an Iranian asset being paid by the US or Israel) the physical plant to insert a thumb drive to infect the Iranian nuclear centrifuge laboratory network. Not to mention physically breaking in to 2 companies in adjacent office parks located in Japan to steal the security certificates that were used in in conjunction with a Windows 0-day exploit to unleash Stuxnext. That is an extreme example but allowing employees to plug in their own USB or other external devices into corporate network is stupidity of the highest order since that would allow any malware or viruses to completely bypass any of the border security measures. And a big part of proper system administration is putting any internally developed applications under a microscope before pushing them into a production environment geared for public use. Developers are notorious for thinking the application standards and security practices do not apply to them since they think know what they are doing. Application development managers are notorious for cutting corners after incorrectly planning and managing internal development projects. Most of the operating systems today are about as secure as they can be and still be able to actually run applications. Especially legacy applications that would not work under a new security paradigm because even the most aggressive sand boxing schemes have exploitable weaknesses. If a company does require the use of the internet communication infrastructure they should require, without exception, that only VPN connections be used. Network access and activity logs should be scrutinized by configurable automated utilities to raise warning flags as soon as possible if suspicious traffic or activities are detected. But even all these common sense precautions will not stop a determined and well funded organization from attempting to exploit your systems. However it does make it harder and a lot more expensive to attempt. It also makes the exploit attempts more noticeable. The various international security agencies can place human assets inside any company they want to facilitate their activities and that tactic is almost impossible to counter since all national security services of note can manufacture identification documents and employee backgrounds that will hold up under any scrutiny a company or government may employ during the hiring process. You can bet that every major internet company such as Google, Facebook, Twitter, MS, Yahoo, Cisco, Intel, Mozilla, Apple, Nokia, Verizon, AT&T, Sprint, Samsung, and all the other similar companies have intelligence agents from various nations embedded in their staffs. It's the easiest and cheapest way to guarantee access to whatever they want. Outside of real time signal intelligence monitoring operations in areas of immediate interest around the world placing human assets on the inside of these companies is the easiest, cheapest, and most effective means of bypassing security precautions and gathering all the information they want.

Re:Microsoft Windows only

[Anonymous Coward]

But autoplay is still on by default. It loads and plays whatever is on the media. Fortunately, that has no security holes whatsover.

Re:Microsoft Windows only

[WuphonsReach]

That meme "security through obscurity" only really applies in cases of improper reliance on "security via obscurity", once the secret is known - the system is insecure and anyone can access it.

Examples of this would be "hand rolled encryption algorithm that we hide in a black box", "secret handshakes", "back doors which are left unlocked".

Re:Microsoft Windows only

[WuphonsReach]

microsoft is one price and you get a server and tools and all the features

That's a good one, go ahead and pull my other leg while you're trying to spin that for Microsoft.

Microsoft licensing is a nightmare. Just look at the segments for the desktop operating system. Or try to figure out which version of MS Office you need and whether a volume license will save you money (and whether you'll be in compliance). The server-side is no different with the different restrictions on the different variants of Windows Server, SQL Server, etc.

(They're still a babe in the woods compared to some other vendors like Oracle, but they're trying to catch up.)

Re:Microsoft Windows only

[Anonymous Coward]

NO IT ISN'T, autorun is off by default on all devices except for CD ROM's for media playback.

Re:Microsoft Windows only

[Anonymous Coward]

You're an idiot. these sort of Attacks ARE OS AGNOSTIC. In the sense that if you know your target it is easy to design your exploit as OSX, Windows, Linux all have a constant stream of exploits available and with this sort of thing most likely they would have Zero Days as well so it would not matter what they were running they would have been done over. When you target someone specifically, exploiting the platform is the trivial part of compromising the host. usually combined with some social engineering such as was done with stuxnet.

Re:Microsoft Windows only

[Anonymous Coward]

Before going down the path of who has the most vulnerabilities you probably should have looked up how many a distribution Linux Ubuntu has, HINT even in November it was a lot more local and more importantly remote vulnerabilities.

Re:Microsoft Windows only

[neonsignal]

The term "security through obscurity" is usually defined to refer to obscuring the design of a system, not to key secrecy. The difference is that the secrecy of keys provide a measurable barrier to brute force attacks. This is fundamental to the design of encryption systems, since we want to formally distinguish what must be kept secret from what is revealed.

I agree with your point about minimizing attack surfaces.

Re:Microsoft Windows only

[benjymouse]

It's the world's biggest target for malware, it's a monoculture, and it has a security model that tends toward convenience over security

Yes - the "dragnet" attacks tends to go after the most victims. If your attack has a certain chance of succeeding (like a social engineering attack), you'd be stupid to go after the 1% instead of the 90%. Now, in a *targeted* attack where the attacker singled out a specific victim or group of victims - the attacker will go after whatever those targets use.

and was actually bolted on after-the-fact.

Nope. The current strain of Windows was created from scratch with the present security model from the get-go. The security model is based on tokens and it was designed to be extensible from the start. Also from the start, the designers envisioned that a process or even a thread could have a token *different* from the user token - i.e. a process could run with permissions/privileges different from the user.

The Windows security model also goes beyond the naive file system-focused model where only file system-like objects were seen as important to secure. In Windows - from the start - all system objects (files, directories, windows, processes, threads, shared memory regions, mutexes, users, groups etc) are accessed through object-oriented handles. When you open a handle you specify the access you request, where each object type has it's own access types. The security check is performed right there when opening the object - instead of on each syscall. If the access you request is granted, a system object is created with a jump table (think virtual method table) where the functions you requested access are mapped to the actual system functions, and the other functions mapped to "denied". The upshot of this is that even though Windows has a much more advanced security model which could make security checks more involved, it will usually perform better because it does *not* have to check security permissions on each syscall.

Contrast that with Unix/Linux where the security model initially only considered file system objects. There were only 2 levels: regular users and root, and a large number of functions could only be performed by root. When it was realized that other system types might also need security descriptors, the existing file system was "adapted" by "mapping" non-file system objects to become file system-like. Talk about bolted on!

The Unix/Linux security model is also the only one with a deliberate drilled hole: The SUID/setuid. Here you have a too limited model where regular users are unable to perform perfectly reasonable functions, like changing their own passwords. So what do you do? You let them run as the only user that *can* perform the function, and pray that the process somehow prevents them from performing any of the other functions root can do while running they are running as root. This is a blatant violation of the least privilege principle, but it is now deeply engraved in all Unix systems. Needless to say that this is the most common path for pwning Unix/Linux systems, going all the way back.

The Unix/Linux model was so bad that NSA had to create SELinux (talk about bolted-on!) which creates it's own competing security "context" (a token). When you want to audit the security of a Unix/Linux system you have to consider 3 competing models: 1) The "original" file-system oriented discretionary model with the SUID hole, 2) the sudoers and 3) SELinux/apparmor or whatever has been bolted on the top.

Especially 1) and 2) are worrying, because it is neigh impossible to audit those sufficiently as long as just a single SUID/sudo command is allowed: How do you (as an auditor) know *what* the SUID/sudo command can actually do? Did *you* install the executable, did *you* monitor the compilation from source? What *other* things can ps or even ping do that you don't know about? If I hold up a file or point to a process on your system as

Re:Microsoft Windows only

[Anonymous Coward]

I really don't understand why people run sensitive and critical stuff on Microsoft Windows.

To avoid malware like Shell Shock.

Re:Microsoft Windows only

[Anonymous Coward]

Dude, are you retarded? The OP wasn't saying these trojans were multiplatform, he's saying they would have been designed for whichever OS the target was using. I hope you don't administer any system that has any meaning.

Re:Microsoft Windows only

[thegarbz]

I really don't understand why people run sensitive and critical stuff on Microsoft Windows.

What's my other option?

You're under the mistaken assumption that people get a choice on what OS they run, as opposed to go out to major vendors with a request for proposal for, uber critical database, control system PCs, hospital records machine etc. and the vendors come back with a proposed package. You don't get a choice what package this runs on. In many cases you are given an entire PC / server setup with the package ready to go because the vendors often control the complete solution from licensing modules, to the software, all the way down to the hardware.

Where I work we're currently switching our control system from Sun Solaris to Windows XP. No we don't have a choice in the matter. We get what we're given. Solaris is linked with an old product which is unsupported by the vendor.

Re:Microsoft Windows only

[deckard026354]

Hmm. I think it's highly delusional to think CyberEspionage organisations aren't targetting - Windows, Linux, MacOS and FreeBSD concurrently. Probably OpenBSD too.. While I agree that Windows appears to be a gaping wide attack surface, I equally believe that the large number of people running Linux sans Virus checkers patting themselves on the back for feeling secure - are living in la la land. The same fundamental architecture underlies Linux. Stack frame over-runs, heap exploits, SMM exploits, lack of digitally signed and restricted binaries + TPM.

When you get right down to it - the entire architecture of computer systems is not designed for verified operation or security - so - while some systems are more vulnerable - all are going to be vulnerable.

Linux users are living in I think a false sense of security. If as much interest were taken in finding exploits on Linux as is taken in finding expoilts on Windows - you'd find a whole bunch of "OMFG - my webserver has been serving up my p0rn mail to the CIA for the last 10 years due to a trojan" type /. posts.

Have you written *all* the software on your computer system - including keyboard, hardisk, WiFi and webcam firmware? No... OK then - your guarantee of security is exactly nil !

Re:Microsoft Windows only

[Anonymous Coward]

Yet OSX, BSD,and Linux still has no Remote execution vulns....

Windows fanbois are loq-1 IQ types.

Re:Microsoft Windows only

[Lumpy]

Dude, Windows admins are 1/5th the price of a good Unix admin. It is a lot cheaper. you can just hire anyone with a MSFT cert and be done with it at a bargain basement price.

No they will not be competent, not even have a clue about stability and security, but that does not matter.

Re: Microsoft Windows only

[KJSwartz]

Current strain of Microsoft Windows? Which ones? There are presently 7 variants (after losing count) of Windows 8. Are they all equally secure?

Windows 7? Vista? XPSP3 and 2003 Server?

Are the Home versions every bit as secure as the Professional versions?

Notice my glaring omission of NT.

Re:Microsoft Windows only

[Anonymous Coward]

Not true, some still buy based on whichever salesman puts out the best lunch.

Re:Microsoft Windows only

[bouldin]

You're implying you've read the Ubuntu vuln announcements for November. Why don't you explain to the class which of these are remote code execution vulns?

http://www.ubuntu.com/usn/

Maybe you can pick the worst one and explain why it's worse than Microsoft's schannel vuln.

Re: Microsoft Windows only

[benjymouse]

Current strain of Microsoft Windows? Which ones?

All of the current Windows versions are derived from Windows NT. The security model was developed for Windows NT. It is the very same extensible (through SIDs) model that has later been extended for AD and later for UAC (mandatory Integrity Control) in Windows Vista.

Re:Microsoft Windows only

[Anonymous Coward]

Shell shock is not malware, it's a bug in Bash that can possibly be exploited if you have exposed Bash to the outside world through some poorly implemented service.

Re:Microsoft Windows only

[OutOnARock]

You could also throw in that the combination of Powershell and Windows Server allows the machine to run "headless"

....just saying....

Re: Microsoft Windows only

[Anonymous Coward]

taco stfu and stop trying to play peace maker. fuck you and your team for selling slash to dice.

Re: Microsoft Windows only

[Anonymous Coward]

The nasty rhetoric of MSFT $hills like you means you folks and your products will continue to be hated. You are sleazy bizpeople and you would be happy to do business with Al Capone ANY TIME.

Re:Microsoft Windows only

[uninformedLuddite]

I hope you aren't holding your breath.

Re:Microsoft Windows only

[uninformedLuddite]

No, I can't cite them - they wouldn't be zero-days if I could.

Can't or wont?

Re: Microsoft Windows only

[uninformedLuddite]

You are the reason he sold it

Re:Microsoft Windows only

[Demonoid-Penguin]

targeted attacks like this are OS agnostic,

Correct, provisionally. Targeted attacks are OS agnostic - if designed to be OS agnostic.

In the case of Regin (did you even read the lead before shooting your idiot mouth?) it is not OS agnostic. It affects Windows only. So does Stuxnet

His point was...

... not what you believe it was. I quoted the specific point I was replying to.
...not what the thread is about
...not what the main article is about.

Again - try reading before shooting your idiot mouth. It's not like you are incapable of focus or intelligent output. Perhaps you're having a bad day or it's just confirmation bias from some sort of emotional over-investment.

It could have been part of a suite of tools that include ones for other OS. But it is not, hence it's not relevant, and like the OP in this thread - the opposite of "informative".
Nowhere have I made any statement about any OS being more or less secure than another.

Re:Microsoft Windows only

[bouldin]

Thanks for the supportive comment, but you've missed the point.

Re:Microsoft Windows only

[amber_of_luxor]

The first rule of security is:
_Do not do anything on a computer that has network capability_.

I've been told that Windows2000 was the last version of Windows that did not require calling home at least once a year, in order to function correctly.

I know that Windows7 point blank refuses to run if it hasn't called home in the last 180 days.

Re:Microsoft Windows only

[uninformedLuddite]

I don't think I did.

Re:Microsoft Windows only

[bouldin]

You sure seem to have missed the point. The AC poster (you?) already lost the argument, whether he responds or not.

I made my point with questions, and the point was that none of the Ubuntu security notices were anywhere near as serious as Microsoft's schannel or OLE vulns.

Unless I missed something in the Ubuntu bulletins, none of those vulns were even suspected of being remote code execution vulns. The AC poster was flat-out wrong in his assessment that the Ubuntu notice had more vulns, and especially wrong that it had more remotely exploitable vulns. I called him out on his bullshit, but at the same time threw him a softball so he could respond if he cared to actually read up and have a reasonable reply.

Sometimes there are people on Slashdot who do seek out intelligent discourse. I was leaving that possibility open, but certainly not holding my breath for it.

Re:Microsoft Windows only

[uninformedLuddite]

I am not the AC. I know that he was full of shit. I actually agreed with you and was trying to inject some humour into the fact you would most likely never hear from him again which seems to be the new way of /.

Re:Microsoft Windows only

[uninformedLuddite]

s/agreed/agree

Re:Microsoft Windows only

[bouldin]

Well then, sounds like I missed the point. Cheers

Re:Microsoft Windows only

[benjymouse]

Shell shock is not malware, it's a bug in Bash that can possibly be exploited if you have exposed Bash to the outside world through some poorly implemented service.

Yeah. Like Apache.

Re:Microsoft Windows only

[exomondo]

You've massively missed his point. Windows has long been a joke. Pop a CD in and it just runs an exe. Pop a USB key in and it just runs an exe. Other OSes are a little more discerning.

Windows hasn't done what you say for years.

Re:Microsoft Windows only

[Rich0]

I'm not saying that Reign is OS-agnostic.

I'm saying that the people who wrote Reign are probably OS-agnostic. If their targets weren't running Windows, then Reign wouldn't target Windows.

You're focusing on a specific piece of software, and missing the reason the software was written in the first place.

I'm not suggesting that Reign is part of a bigger suite of hacking tools. I'm saying that Reign was written by people with brains who could target any OS they wanted to target.

The personal attacks are not helpful to the discussion.

Re:Microsoft Windows only

[Demonoid-Penguin]

You're focusing on a specific piece of software, and missing the reason the software was written in the first place.

I'm focusing on what I quoted in my response. You're just being a goal-shifting egotistical dick - which is not "helpful" in any context.

Re:Microsoft Windows only

[Rich0]

You're focusing on a specific piece of software, and missing the reason the software was written in the first place.

I'm focusing on what I quoted in my response.

You quoted, "targeted attacks like this are OS agnostic."

Then you said "In the case of Regin (did you even read the lead before shooting your idiot mouth?) it is not OS agnostic."

He didn't say that Regin was OS agnostic. He said that targeted attacks are OS agnostic. Heck, you can perform a targeted attack without the use of a computer at all.

The people who wrote Regin weren't out to break Windows. They were out to obtain information. If it was easier to obtain that information by sending in ninjas at night, they would have done that.

If the sole point of your whole argument is that Regin only targets Windows, well, congratulations, I guess you can win the internet tonight. :)

Backdoor Trojans?

[glenebob]

I try not to let Trojans anywhere near my backdoor.

Re:Backdoor Trojans?

[Anonymous Coward]

I try not to let Trojans anywhere near my backdoor.

;)

Re:Backdoor Trojans?

[Anonymous Coward]

I try not to let Trojans anywhere near my backdoor.

Bareback rider, eh?

Re:Backdoor Trojans?

[Greyfox]

It's targetted! If we wanted to target your backdoor with a trojan, we'd give you about six beers first!

Nation uses malware to spy on ISP Customers...

[Etherwalk]

Among other things, they were infecting ISP machines to monitor specific customers.

Anyway, guesses on the responsible party? China, Israel, Russia?

Re:Nation uses malware to spy on ISP Customers...

[lostmongoose]

Among other things, they were infecting ISP machines to monitor specific customers.

Anyway, guesses on the responsible party? China, Israel, Russia?

...or USA, Britain, France, Germany...

Re:Nation uses malware to spy on ISP Customers...

[Anonymous Coward]

Germany

Don't be ridiculous. We have the Hackerparagraph. That shit is illegal in Germany.

Re:Nation uses malware to spy on ISP Customers...

[AHuxley]

Lots of nations can try. Italy had its SISMI-Telecom scandal https://en.wikipedia.org/wiki/...
Greece had the wiretapping case 2004–05 https://en.wikipedia.org/wiki/...–05
Now the world is seeing more software efforts beyond the expected gov tapping hardware and software.
So many staff around the world have done legitimate tapping for their govs and mil for generations.
Tame computer systems, networks have crypto that is well understood and of a weak international standard. Signals intelligence is great to sell to govs and mil. Ex staff, former staff and govs are all happy to see what they can get.

Re:Nation uses malware to spy on ISP Customers...

[HiThere]

Why limit it to nations? Major corporations are as capable as most countries, and only a little bit more endangered if caught.

Re:Nation uses malware to spy on ISP Customers...

[mars-nl]

Not sure how security firms conclude nation states must be behind some complex malware. It could also be a corporation. It could also be a criminal gang. It could also be some lone programmer or group of programmers doing this in their own time in order to sell the software or their services to criminals or governments. Most software is not made by governments (actually, can't think of any software) and whenever they try, they usually fail.

Re:Nation uses malware to spy on ISP Customers...

[Etherwalk]

Stuxnet.

Re: Nation uses malware to spy on ISP Customers...

[Anonymous Coward]

Just because you can't think of any doesn't mean governments don't write software. Nor does it mean their failure rate is any higher than the private sector. Selection bias: the private sector does not have their failed projects blasted all over the media.

Here's an obvious one: the team that did the space shuttle software produced absolutely flawless code all the time. It was difficult and very expensive because doing bug free anything is difficult and expensive. You never heard about them. Media don't do stories on stuff that works.

A VA hospital in Florida a few years back had a well done locally developed medical software system. Other facilities wanted to use it. Congress forced them to abandon it and use a privately written expensive solution and the results, well, you know.

I work on government software. Nothing nasty, or secret, or especially sexy. It's very successful, has a small team and a reasonable budget--and you've never heard of it, guaranteed. Aftet all, it does what it was intended to do (allow more work with the same or fewer staff) and there's no story there.

Re:Nation uses malware to spy on ISP Customers...

[Anonymous Coward]

criminal gangs don't tend to go to such detailed engineering, there is more profit and easier ways for organizations that are willing to bypass laws. It is also way to complex and hard to hide for a corporation/firm, keeping something of that development scale quiet takes the ability to threaten with death/long imprisonment terms and some devotion to a cause as much as people hate corporations their are very few that are willing to go to that extent. That really leaves governments, they have the motivation, resources and means to keep it quiet. Really governments are the only realistic producers and users of something of this complexity and effort.

Re:Nation uses malware to spy on ISP Customers...

[Anonymous Coward]

According to the report from Symantec the top 2 targets accounting for > 50% of infections came from Russia and Saudi Arabia.
Other targets include Iran, Mexico, and about a dozen others. None of the 5 Eyes countries are on the list.
Seems our tax dollars were hard at work again.

Re:Nation uses malware to spy on ISP Customers...

[Vlad_the_Inhaler]

Start from the countries on the list: Russia, Saudi Arabia, Mexico, Ireland, India, Afghanistan, Iran, Belgium, Austria, Pakistan. The percentages added up to 100, a surprise because I would expect at least one or two percent to be "other". That makes me mistrust the figures a bit.

"Significant" countries not on the list include: the US, Canada, Britain, Germany, Israel, Japan, Australia, France, Turkey, Yemen, Iraq, Syria or any of the smaller Gulf States such as Qatar, Bahrain, Dubai. What is also interesting is that Snowden has said nothing about it.

That makes it look a bit like a co-production to me, one state organisation produced it but they shared it with at least one other country.
Russia being top back around 2008-2011 implicates some of the main western countries.
Saudi Arabia being so high on the list implicates Israel, Gulf States, or possibly the U.S.
Austria could possibly point towards Israel.
Afghanistan, Iran and Pakistan point towards the U.S.
Mexico being up there implicates the U.S.
Ireland? The only reason I can see for them being on the list is Transatlantic Cables. The GCHQ would maybe care that much.

I would expect the country which produced this to have infected some servers in their own country, to deflect suspicion.
Finally, one significant political event in 2011 was the fall of Mubarak in Egypt. If they were behind it then the dates when it was inactive would make sense, so would the subsequent reappearance. Do they have the ability?

Hello Israel, hello USA

[Anonymous Coward]

Making more friends?

Linux is a monoculture.

[Anonymous Coward]

Linux may not have been a monoculture back in the 1990s, but it's not the 1990s any longer!

All of the major distros are basically the same these days. The kernel is the same. The file system layout is the same. The package managers are either RPM or APT. Now that Debian and Ubuntu will switch or have switched, all of the major distros but Slackware (if it's even a "major" distro these days!) use or support systemd. They use pretty much the same userland software.

If Linux really wasn't a monoculture, then security incidents like the ones involving bash and OpenSSL earlier this year wouldn't have been as widespread as they were.

Not using systemd was the one thing that differentiated Debian and Ubuntu from Fedora, CentOS, RHEL, openSUSE, and the other distros. Now Debian and Ubuntu are basically clones of those other systems. The main different now is whether you type "apt-get" or "yum" to install packages! That's no difference at all, really.

The BSDs are the only family of OSes where there's some diversity left. But even they are still very similar in many ways.

Re:Linux is a monoculture.

[Anonymous Coward]

^This.

I just found out that the Xfce/Mint 15 I installed late last year is no longer supported because Ubuntu no longer supports its base.

When I tried to upgrade, I find out that there is no longer a driver for my WiFi - at least one that would work with a new kernel. As it is, Mint 15.0 is using iwlegacy for my wireless.

So much for getting the latest security features.

To keep using this laptop, I have to stick to small fast distros and it's getting harder to find them - at least ones that use the latest and most secure kernel.

I'll probably have to ditch this laptop and just get a Mac something.

Re: Linux is a monoculture.

[r_a_trip]

www.manjaro.org

Re: Linux is a monoculture.

[Anonymous Coward]

"Manjaro"? Really? All of us sysadmins are supposed to go to our bosses and say, "Let's switch our Ubuntu systems to Manjaro Linux."

They'd probably just look at us weird and say, "Manseed Linux? What the fuck is that?"

Come on!

Re: Linux is a monoculture.

[mysidia]

This is what their reaction used to be when we talked about switching Windows servers' operating system to Linux. "Linux? No! Wtf is Linux?"

Re: Linux is a monoculture.

[Anonymous Coward]

Why the fuck did you use Ubuntu for the servers anyways? I could name ten better server distros easily.

Re: Linux is a monoculture.

[Anonymous Coward]

No you can't. I dare you!

Re: Linux is a monoculture.

[Anonymous Coward]

People stupid when it comes to Linux. For some bizarre reason WAY too many people seem tot think that Linux IS Ubuntu, and there is nothing else. Then they make the brain dead stupid call to use Ubuntu as a server OS. Ubuntu is an ungodly pile of crap. There are so many considerably better Linux distros.

Re: Linux is a monoculture.

[greenfruitsalad]

Do your 10 other choices come with vendor support (canonical) and predictable release cycles?

Re:Linux is a monoculture.

[Anonymous Coward]

Try Arch.

Re: Linux is a monoculture.

[Anonymous Coward]

yea, and yea. u r a complete idiot if you think Ubuntu is the bees knees for Linux servers

Three Letter Agencies?

[Frosty Piss]

...they believe was developed by a wealthy nation-state to spy on a wide range of international targets in diverse industries, including hospitality, energy, airline, and research...

Hello, China...

Re:Three Letter Agencies?

[Anonymous Coward]

Hello USA , Hello UK, Hello any of the usual suspects. Why are Americans so blind to the fact their nation does this shit to?

Re: Three Letter Agencies?

[Anonymous Coward]

Wow, and the subject line even says "Three Letter Agencies," a typical euphemism for American intelligence. Nice knee-jerk anti-Americanism there, Captain Euro.

Re:Three Letter Agencies?

[mysidia]

Hello USA , Hello UK, Hello any of the usual suspects.

Hello any country with resources that wants to make one of the above countries look bad by framing them and then "discovering" new malware in the wild.

Re:Three Letter Agencies?

[Etherwalk]

Hello USA , Hello UK, Hello any of the usual suspects. Why are Americans so blind to the fact their nation does this shit to?

USA has not yet been caught using its intelligence apparatus with a major aim of industrial espionage, as opposed to its state interests. It should be doing that as a matter of game theory, to incentivize a phased and negotiated reduction in attacks, but I haven't seen evidence that it does. But there is a great deal of evidence of state-sponsored attacks coming out of China against many, many American institutions.

It doesn't mean the USA doesn't do it--but it does make China a more likely suspect.

Re: Three Letter Agencies?

[Anonymous Coward]

DO'H Typical American arrogance American Fucktard lots of nations have 3 letter Agencies MI5, MI6 , BND, DSD , KGB, GPU.
Some of them now defunct and some of them around longer than your CIA!

Re: Three Letter Agencies?

[Anonymous Coward]

How about the Stuxnet and the Opration Olympic Games ?

Re:Three Letter Agencies?

[jandersen]

Hello, China...

OTOH, when this kind of news come out, people are usually not shy about mentioning China by name. In fact, a number of 'wealthy nation-states' in Europe as well as Israel have been mentioned on occasion when it comes to spy-ware. I don't remember the US coming up very often, so by exclusion, America does seem like a likely candidate here. And why not? it isn't as if Americans, American companies or the American state departments are particularly prudish compared to others, when it comes to this sort of thing.

Re:Three Letter Agencies?

[Anonymous Coward]

Hello USA , Hello UK, Hello any of the usual suspects. Why are Americans so blind to the fact their nation does this shit to?

USA has not yet been caught using its intelligence apparatus with a major aim of industrial espionage, as opposed to its state interests. It should be doing that as a matter of game theory, to incentivize a phased and negotiated reduction in attacks, but I haven't seen evidence that it does.

Well, guess what ...

Conspicuously absent ...

[CaptainDork]

... as a geographic target is ...

Re:Conspicuously absent ...

[Anonymous Coward]

... as a geographic target is ...

Ok, I'll say it: Israel and the USA

Re:Conspicuously absent ...

[Anonymous Coward]

But also UK, France, China. If it were China, the US would likely be among the targets. Possibly also true if it were France, but not certainly. If it's the US, then they really have egg on their face for engaging in industrial espionage. Other big countries are missing (Germany, Spain, Italy, Brazil....) but they're not so aggressive. My best guess is the UK, but US, France, and Israel all seem like reasonable hypotheses.

Re:Backdoor Trojans

[Anonymous Coward]

Huh huh. Heh heh.

How far do you have to read?

[david.emery]

To discover this is a Windows-only virus? That was the first thing that crossed my mind, what platform(s) are vulnerable? It sure as hell isn't clearly stated in any of the articles I read, you have to dive into the details of the Symantec white paper to notice that all the attack vectors were specific to Windows.

And how much does the tech journalism community and the security products & services industry, from Ars to The Verge, to Symantec, get paid to hide the fact this is Yet Another Windows (only) vulnerability?

Highly advanced computer worm?

[lippydude]

This 'highly advanced' computer worm will only work on Microsoft Windows:

"Symantec Security Response has not obtained the Regin dropper at the time of writing. Symantec believes that once the dropper is executed on the target’s computer, it will install and execute Stage 1. It’s likely that Stage 0 is responsible for setting up various extended attributes and/or registry keys and values that hold encoded versions of stages 2, 3, and potentially stages 4 and onwards". ref

Re:Highly advanced computer worm?

[mspohr]

If it only works on Windows, it can't be that "highly advanced"... probably just some teens in their basement. Windows is not that hard to compromise.

Re:Highly advanced computer worm?

[benjymouse]

This 'highly advanced' computer worm will only work on Microsoft Windows:

It is not a worm. It is a trojan, i.e. the user has to invite the trojan (the "dropper") inside for it to work.

A worm is an automated infection which propagates automatically from system to system. Like the Shellshock worms, Code Red, Nimda.

Any particular reason you chose to call it a worm, despite that it was described as a trojan in the summary as well as in TFA?

Re:Highly advanced computer worm?

[lippydude]

@benjymouse: "Any particular reason you chose to call it a worm, despite that it was described as a trojan in the summary as well as in TFA?"

"Backdoor Regin .. bears some resemblance to .. the computer worm and trojan that was programmed to disrupt Iran's nuclear program"

Palindrome Name ?

[Anonymous Coward]

Symantec sense of humor for us to read it backward?

Re:Palindrome Name ?

[Anonymous Coward]

That's not a palindrome. niger is a Latin adjective meaning black. Please note the single 'g'.

Re:Palindrome Name ?

[Bob_Who]

That's not a palindrome. niger is a Latin adjective meaning black. Please note the single 'g'.

Niger (or anagram) is spelled with only one "g"....

Oh, I see what you did there, honky!

*nix Version Not Yet Discovered.

[Anonymous Coward]

As if a "wealthy nation-state" has no clue about *nix. Furthermore, it "likely required months or years to be completed and contains dozens of individual modules that allowed its operators to tailor the malware to individual targets." Are you really going to bet that they don't have a *nix version???

Re:*nix Version Not Yet Discovered.

[david.emery]

It's possible there are other versions. But that's not my point. The version that has been discovered and documented runs on Windows, a fact that is probably deliberately not made clear in the articles.

Re:*nix Version Not Yet Discovered.

[Anonymous Coward]

probably because it is such a highly targeted piece of malware that it is a farely irrelevant point. this isn't some virus floating around the interwebs, if you are a victim of it you would have been individually selected. It could easily be made for any OS and most likely has been, it doesn't seem to do anything that would make the architecture windows specific.

Re:*nix Version Not Yet Discovered.

[Anonymous Coward]

The Turla APT was believed to be Windows only, but now is discovered to have a Linux variant.
http://arstechnica.com/security/2014/12/powerful-highly-stealthy-linux-trojan-may-have-infected-victims-for-years/

Re:Created by our hyperspace toad overlords

[Anonymous Coward]

Goddammit, mod this up.

This [man|woman|dolphin|AI|cool, dispassionate intelligence from Sirius] is our last, best hope against the unholy scourge of that Jon Katz spawn known as Bennett Haselton.

Yo Mama!

Symantec only?

[eegeerg]

Yes, I RTFA (again). Any independent confirmation outside of Symantec?

You "can't think of" software used by govt to spy?

[Rujiel]

When stuxnet (engineered by israel and the US) is mentioned in TFA? Are you playing dumb? That's aside from the hefty lists of internal hacking tools leakes by snowden, be it from the NSA or their british buddies.

I don't NEEED no stickin' source code....

[grep -v '.*' *]

Researchers have unearthed highly advanced malware ... spy on a wide range of international targets in diverse industries

Oh my! Evil people are actively breaking into computers! Just imagine what they could do if they actually had the source code to what the targets run.

It's only by using proprietary software are we able to keep ourselves safe like this.

Backdoors are always dangerous

[jennatalia]

At least they're using protection.

Re: Hello FVEY

[Anonymous Coward]

The former NSA contractor Edward Snowden described the Five Eyes (FVEY) as a "supra-national intelligence organisation that doesn't answer to the laws of its own countries"

1 Cox, James (December 2012). "Canada and the Five Eyes Intelligence Community". Canadian Defence and Foreign Affairs Institute.

2 "Five Eyes". United States Army Combined Arms Center. Archived from the original on 18 January 2014. Retrieved 18 January 2014.

3 "PKI Interoperability with FVEY Partner Nations on the NIPRNet". United States Department of the Navy. Archived from the original on 18 January 2014. Retrieved 18 January 2014.

4 Asser, Martin (6 July 2000). "Echelon: Big brother without a cause?". BBC. Retrieved 28 January 2014.

5 "Q&A: What you need to know about Echelon". BBC. 29 May 2001. Retrieved 28 January 2014.

6 "Snowden-Interview: Transcript". Norddeutscher Rundfunk. 26 January 2014. Retrieved 28 January 2014.

7 Ball, James (20 November 2013). "US and UK struck secret deal to allow NSA to 'unmask' Britons' personal data". The Guardian. Retrieved 18 January 2014.

8 MacAskill, Ewen (2 December 2013). "Revealed: Australian spy agency offered to share data about ordinary citizens". The Guardian. Retrieved 18 January 2014.

9 Watt, Nicholas (10 June 2013). "NSA 'offers intelligence to British counterparts to skirt UK law'". The Guardian. Retrieved 19 January 2014.

10 British spy agency taps cables, shares with U.S. NSA â" Guardian, Reuters, 21 June 2013. Retrieved 18 January 2014.

11 McGregor, Richard (13 December 2013). "Intelligence: The all-seeing eyes". Financial Times. Retrieved 27 January 2014.

12 Perry, Nick (16 July 2013). "5-nation spy alliance too vital for leaks to harm". Associated Press. Retrieved 27 January 2014.

13 Farrell, Paul (2 December 2013). "History of 5-Eyes â" explainer". The Guardian. Retrieved 27 January 2014.

14 Norton-Taylor, Richard (25 June 2010). "Not so secret: deal at the heart of UK-US intelligence". The Guardian. Retrieved 27 January 2014.

15 Aldrich, Richard (24 June 2010). "Allied code-breakers co-operate â" but not always". The Guardian. Retrieved 25 June 2010.

16 "Q&A: What you need to know about Echelon". BBC. 29 May 2001.

17 Norton-Taylor, Richard (19 June 2010). "GCHQ by Richard Aldrich, Securing the State by David Omand". The Guardian. Retrieved 30 January 2014. "The US was especially keen on GCHQ's station in Hong Kong, particularly during the Vietnam war"

18 Campbell, Duncan (25 July 2000). "Inside Echelon". Heise Online. Retrieved 19 December 2013.

19 Jones, George (13 Mar 2002). "How France helped us win Falklands war". The Daily Telegraph.

20 Milliken, Robert (23 February 1994). "Canberra spy link to MI6 alleged". The Independent.
21 "Norsk lyttestasjon viktig brikke i Falklandskrigen" (in Norwegian). Norwegian Broadcasting Corporation. 21 May 2002.

22 Sanchez, Raf (19 August 2013). "British diplomats tried to suppress details of SIS role in Iran coup". The Daily Telegraph. Retrieved 27 January 2014.

23 Risen, James (16 April 2000). "Secrets Of History: The C.I.A. in Iranâ"A special report. How a Plot Convulsed Iran in '53 (and in '79)". The New York Times. Retrieved 22 August 2013.

24 "Declassified Documents Reveal CIA Role In 1953 Iranian Coup". NPR. 1 September 2013. Retrieved 27 January 2014.

25 Merica, Dan (20 August 2013). "In declassified document, CIA acknowledges role in '53 Iran coup". CNN. Retrieved 27 January 2014.

26 Corera, Gordon (2 April 2013). "MI6 and the death of Patrice Lumumba". BBC. Retrieved 2 February 2014.

27 DeYoung, Karen; Walter Pincus (27 June 2007). "CIA Releases Files On Past Misdeeds". The Washington Post. Retrieved 2 February 2014. "A one-paragraph memo recounts planning for a "project involving the assassination of Patrice Lumumba, then premier of the Republic of Congo."

28 "CIA details Cold War skulduggery". BBC. 26 June 2007. Retrieved 2 February 2014.

29 McDo

Scrambled Like Chickens with Their Eggs in a Bunch

[crywalt]

Holy mixed metaphors! "Executing the first stage triggers a domino chain...." Does it trigger a domino chain which cascades along the peaks of the shield holding the noses of the elephants in the room?

Misspelling in Summary

[Anonymous Coward]

This was the work of Reggin Toggaf.

If its 5 eyes then Symatecs notification worthless

[Anonymous Coward]

NSA will have had access to the notification before the announcement and will have simply changed the salting details, filenames etc..

It's become a joke, my Android devices run more spyware than their target apps, my Windows machines are just malware heaven and I'm reduced to even double checking my Linux system.

Analysis White Paper

[Fnord666]

Here is a link to the analysis white paper about Regin published by Symantec. An interesting read and it does look very similar to Duqu in structure.

Re:Analysis White Paper

[Anonymous Coward]

Hey look - "government" is a category which is missing from the target-pie

How odd...

Re: Hello FVEY

[KJSwartz]

Perpetual decay \snicker \ha \haw

Remember ANYTHING about the 50s, 60s and 70s, son? You have things SO MUCH BETTER NOW than way back in the day. Computerized checkbooks, reliable transportation, telephone,... ..., Electricity, Internet. Need I go on? Polio and Smallpox Vaccines,... ..., imaging technology that puts X-ray Films from Polaroid to shame.

The decay you believe in is a figment of your imagination. Visit a third world county sometime and see what value your "wealth of knowledge" has in the real world. \Pity.

Marketing

[Going_Digital]

Highly Sophisticated; by who's standards, Symantec? What do they know about sophisticated software? Symantecs marketing department thought they would make it sound exciting by suggesting it was created by a government agency. Pathetic effort to try and boost sales of Symantec software.

Useless to me... apk

[Anonymous Coward]

"Also, Symantec has not revealed key information about the command and control infrastructure (CnC) used by the attackers to manage infected computers. Its technical paper highlights that the C&C used four transport protocols to communicate between infected computers and its command servers but, unlike similar recent reports from rivals FireEye and Kaspersky, Symantec has not revealed the IP addresses and web domains used by the attackers, which if known could suggest the origin of the attackers." FROM -> http://www.cso.com.au/article/...

See that quote & WHY I said what I did due to it (ran into it yesterday in fact): Article's of that nature, or the .pdf, MINUS lists of the C&C Servers used (by IP address for firewalls, or by host-domain name for custom hosts files) are USELESS to myself - why?

* THEY'RE NOT PROVIDING THE TRULY "CRUCIAL INFORMATION" NEEDED TO BLOCK THESE THREATS IS WHY, OMITTING THE C&C SERVERS THIS THING USES...!

(Pretty self-explanatary right there, as to my subject-line above...)

APK

P.S.=> Complaint on MY part? Absolutely - not directed YOUR way though (more to Symantec really for omitting that information for afaik NO good reason)... apk

Re: Hello FVEY

[Anonymous Coward]

So what now? Thank you, master, for painting our cage golden?

Detection?

[jrq]

Why is it that these major news outlets (Forbes, CNET, CNN, etc) all have articles about this new trojan/virus. They quote statistics from Symantec about the number of infect machines, and yet, not one describes how you can detect an infection. They must know. One previous post identifies a Symantec white paper describing the trojan's behavior (Here). Why don't these articles describe the steps required to detect it? It's not like they're under any obligation to encourage readers to buy into Symantec's bloated anti-virus products.

This one's a piece of cake to remove...apk

[Anonymous Coward]

2 tools can do this as it uses "pciclass.sys" (driver), boot up to Recovery Console, remove it using listsvc (to see if it's in fact there 1st, of course) & then use the DISABLE command on it - done.

(That'd be for 2000/XP/Server 2003 - Win7 & beyond have similar bootup console mode tools also, & doing so booting up from the install media (CD/DVD) assures a non-corruptable read-only environs to do it from as well...)

* That cripples the kernelmode portion (the "effective ingredient"...)

The usermode portion(s), if any? Ok: Now, *IF* there's usermode componentry too (& there will be most likely)? Those you can "take out" using ProcessExplorer altering its default view of NO lower pane visible (you'd make it so via its options), making it visible, & switching to DLL View there - & it'll show those even when they're "hidden"...

APK

P.S.=> ProcessExplorer's your pal too - & it's superior to taskmgr.exe in 1 respect: It can reveal those parts hiding or rather, "riding" along attached beneath, say, explorer.exe as a .DLL extension, for instance (which *many* malware do to evade detection))... apk

Gareth Williams

[whysea]

The dates of the end of Regin 1 correspond roughly to the astonishing demise this GHCQ analyst..I would put my money on the brits.

Sadly

[Anonymous Coward]

The world is getting back to the point where sensitive corporate communications may need to be done in person, with records of what was said (if any) kept on non-networked computers or in a locked file cabinet.

You already see this happening in businesses, but it's because people and companies don't want to create a paper trail that can be subpoenaed, not because they are afraid of a hacker or government-backed spy snooping at their records.

Microsoft Windows only

[Anonymous Coward]

It's quite simple, if your company and clients use Windows/Office then you are often forced to use it, or you run the risk of losing "contact" with them.