Regin Malware In EU Attack Linked To US and British Intelligence Agencies

Advocatus Diaboli writes The Regin malware, whose existence was first reported by the security firm Symantec on Sunday, is among the most sophisticated ever discovered by researchers. Symantec compared Regin to Stuxnet, a state-sponsored malware program developed by the U.S. and Israel to sabotage computers at an Iranian nuclear facility. Sources familiar with internal investigations at Belgacom and the European Union have confirmed to The Intercept that the Regin malware was found on their systems after they were compromised, linking the spy tool to the secret GCHQ and NSA operations.

Comments

How will I explain this to my children

[Trachman]

On NSA website, NSA states about their values: " We will protect national security interests by adhering to the highest standards of behavior".

So how NSA would be able to explain to a child that computer virus and malware represent the highest standard of behavior.

It is probably the same as stealing money on the street from slightly overweight person and telling him/her, that you need to lose weight anyway and that the robber cares about you. If questioned, street robber will counter stating that the victim should be thankful, because in other streets (countries) you could be shot for even questioning.

Is vulnerable and weakened by NSA encryption is also "highest standard of behavior", dear beavers from NSA?

Re:How will I explain this to my children

[Zocalo]

Do you really have to ask? "Do as I say, not as I do"; the mantra of far too many governments (and parents) for quite some time now.

Re:How will I explain this to my children

[ISoldat53]

That is the highest standard. That's what's so sad.

Re:How will I explain this to my children

[rtb61]

The other question is what is the NSA really doing with all this information especially as they have been known to target 'ALL' foreign politicians and of course have a publicly stated penchant for extortion. How many countries democracies have been derailed of late by naughty foreign politicians being caught and yet to have been exposed, as long as of course they continue to comply. With the inclusion of major US corporations as contractor and such espionage partners, how much leverage will they be able to gain in many countries.

Re:How surprising

[Advocatus Diaboli]

That "land of free" sham was maintained for only as long as the USSR existed. Once it became Russia and a dozen other smaller countries, the "civilized" west just stopped pretending.

Re:How surprising

[davydagger]

we're only "free" as long as we are explaining to a conquered people why we are bombing them.

Most sophisticated malware?

[lippydude]

Will this sophisticated malware work on anything other than Microsoft Windows:

"Symantec Security Response has not obtained the Regin dropper at the time of writing. Symantec believes that once the dropper is executed on the target’s computer, it will install and execute Stage 1. It’s likely that Stage 0 is responsible for setting up various extended attributes and/or registry keys and values that hold encoded versions of stages 2, 3, and potentially stages 4 and onwards". link

Re:Most sophisticated malware?

[daniel23]

Will this sophisticated malware work on anything other than Microsoft Windows

While I do not think you expected sincere answers to this question there is a reason to support the obligatory "of course not" answer. From the Kaspersky analysis ( https://securelist.com/blog/re... )

"The name Regin is apparently a reversed "In Reg", short for "In Registry", as the malware can store its modules in the registry. "

And since Linux has no registry...

- then again I would not ne surprised to learn that there is a variant of this tool runing on linux which just swaps in a different module to store its VFS at a place hard to detect on linux. Unused space behind the partitions or something...

So, no - no reason to feel safe. Your choice of OS may only protect you until they decide to actually aim at you.

Re:How surprising

[techno-vampire]

Kind of makes me wonder what happened to that "land of the free" part of the national charactor.

Well, at least we can still claim to be the "home of the brave." Of course, that just leaves us on a par with Freedonia.

Advanced malware controlling industrial systems

[Kevin Fishburne]

This thought began as a joke, but this actually does sound how something like Skynet could be born. Malware is infamous for aggressively trying to preserve itself. We all joke about how stupid the idea of programming an AI with a strong sense of self-preservation is because of the obvious dangers, but that is exactly how malware is programmed. Programming it to control industrial systems as well (giving it a "body") seems like a really bad idea, particularly if the aim is not to sabotage the infected industrial system, but to cause as much damage to the target nation as possible (a reasonable wartime goal).

Re:Advanced malware controlling industrial systems

[Kevin Fishburne]

You are wanting to be commenting here.

Heh, thanks. While self-commanding killer robots are the obvious focus of our fear, it's not always the most obvious expectation that bites one in the ass. Killer robots would either never get used or have so many safeguards they'd be half useless amidst the chaos of war and the treachery and adaptability of humans. Though they'd have some degree of self-preservation, they would have no desire or ability to reproduce. Malware on the other hand is designed to do anything to avoid removal and replicate through any means possible. What better way to avoid being deleted than to make the infected facility uninhabitable or exceedingly dangerous to those who could remove it? This logic could be extrapolated to "protecting" surrounding areas, or distant areas connected by network infrastructure that could be used as access points. It's the seeming innocence and perceived weakness of something intangible like software that could reduce the consideration and implementation of safeguards when crafting malware. Right now malware's just an expensive pain in the ass, but a day may come when during your coffee break all the doors lock, the ventilation system halts and the facility begins flooding with CO2.

Re:Advanced malware controlling industrial systems

[drinkypoo]

Killer robots would either never get used or have so many safeguards they'd be half useless amidst the chaos of war and the treachery and adaptability of humans.

Governments already have automated weapons, including sentry guns. And they work fine. High school kids (who are good programmers) can make them.

Right now malware's just an expensive pain in the ass, but a day may come when during your coffee break all the doors lock, the ventilation system halts and the facility begins flooding with CO2.

That's why we design systems with failsafes like manual overrides and the like. It should always take a human to do something that dangerous. The path to release CO2 into the breakroom should be mechanically impossible to activate via software; if you try to open all the applicable valves at once, some of them won't open.

Re:Anti-virus/malware?

[AHuxley]

The code is of a quality set per user depending on OS, installed AV and all other understood networking conditions.
A consumer OS with standard trusted consumer AV and trustred normal OS updates?
A well understood open source install that a user looks over deeper OS level logs everyday?
The presence of unique new code a user "installed" and "allowed" is not going to report on huge anti-virus and anti-malware lists.
Will well understood behavior analysis on consumer grade AV be looking in the correct place?
Gov and mil know all about what AV can do and how unique code for one computer has to be installed so it is not really going to be found by consumer AV products.

Re:I wonder who was targeted?

[AHuxley]

Re "I wonder who was targeted?"
When different network where still needed experts did find a few interesting past projects:
Greek wiretapping case 2004–05 https://en.wikipedia.org/wiki/...–05
The SISMI-Telecom scandal in Italy found in 2006 https://en.wikipedia.org/wiki/...

How many bozos are screaming that Windows is safe?

[WindBourne]

So many ppl come here and post that Windows is not only safe, but that it is targeted because of numbers. Yet, it is obvious that NSA and GCHQ targeted Windows. Why? I doubt that it was numbers, but ease of cracking.

So, in the meantime, how many companies will start switching to *nix?

Re:How many bozos are screaming that Windows is sa

[benjymouse]

So many ppl come here and post that Windows is not only safe, but that it is targeted because of numbers. Yet, it is obvious that NSA and GCHQ targeted Windows. Why? I doubt that it was numbers, but ease of cracking.

If your targets use Windows it would be a real stroke of genius to distribute attacks against Linux, don't you think?

Duh.

So, in the meantime, how many companies will start switching to *nix?

What is the *nix equivalent to secure boot? Signed kernel modules? What is the *nix equivalent to Measured Boot and Network Access Protection? How does an organization automatically and immediately detect and isolate potentially infected hosts?

Every operating system out there will experience exploitable vulnerabilities. Applications running on top of the operating systems will experience exploitable vulnerabilities. The most recent severe vulnerabilities that have been mass exploited are *nix vulnerabilities like Heartbleed and Shellshock. No operating system is immune.

That's why defense in depth is important. Windows starts it's defenses before boot, by using Secure Boot. This ensures that only approved bootloaders run. It prevents bootkits. Some Linux distros support a weak form of secure boot (it doesn't protect all types of resources, notably scripts and config files are not digitally signed). Windows loads all kernel components from signed "cabinet" files - protecting all assets used during boot. If a rootkit tampers with any of the files, the system will refuse to boot.

During boot, before loading *any* kernel module, Windows will compute a hash of the module and record it in the TPM hardware module along with name, size, dates and other metadata. Upon successful boot (but before other hosts will accept traffic from the system) the OS asks the TPM for a signed "health" record. The TPM will issue a signed document with all the recorded info that the host can present to a health certificate server. The health cert server can investigate the list of loaded modules and compare against known whitelists and/or blacklists. If everything checks out, the health cert server issues a certificate the booting host must use when communicating with other hosts. Unless it can present such cert, the other hosts will refuse to communicate with the host.

Does 'Nix support such security in depth?

Such targeted attacks will target whatever operating system is being used by the target. Targets must consider the possibility that any host can be breached through an application or OS vulnerability. With that recognition, they must ensure expedient diagnosis and isolation. In that area, a Windows server infrastructure can be set up to become extremely strong.

You are a bit over a decade out of date

[dbIII]

What is the *nix equivalent to secure boot? Signed kernel modules?

Not loading modules at all. It's just one kernel compile away. That's been done for security reasons by some people since about when this site started or before. Some people even had their stuff boot from read-only optical media to avoid such threats back when the possibility of tainted kernel modules was first discussed.