Slashdot Mirror
Researchers Tie Regin Malware To NSA, Five Eyes Intel Agencies
Trailrunner7 writes Researchers at Kaspersky Lab have discovered shared code and functionality between the Regin malware platform and a similar platform described in a newly disclosed set of Edward Snowden documents 10 days ago by Germany's Der Spiegel. The link, found in a keylogger called QWERTY allegedly used by the so-called Five Eyes, leads them to conclude that the developers of each platform are either the same, or work closely together. "Considering the extreme complexity of the Regin platform and little chance that it can be duplicated by somebody without having access to its source codes, we conclude the QWERTY malware developers and the Regin developers are the same or working together," wrote Kaspersky Lab researchers Costin Raiu and Igor Soumenkov today in a published report. (Here is the Spiegel article.)
According to this article, Regin has been known for some time.
Fox IT, which was hired to remove Regin from the Belgian phone company Belgacom's website, didn't say anything about what it discovered because it "didn't want to interfere with NSA/GCHQ operations."
Now our Malware/Virus software engineers are practicing reuse. Excellent development practice out there folks! Keep Reusing that code!
Harrison's Postulate - "For every action there is an equal and opposite criticism"
It would seem our governments are at minimum committing the crime of conspiracy to break into US (and UK, Aussie, etc) citizens computers, if they are helping out foreign governments. They may have made themeselves immune for their own actions, but I highly doubt that immunity extends to helping foreign governments break into your own citizens computers. I have not researched this though. Just thought some people with more knowledge might chime in. If it is not illegal, it really needs to be illegal.
Join the IParty!
And I thought it was IS/Russians/NKoreans/Aliens, because US and allies hold moral highground and would never initiate actions which they themselves consider to be acts of war, right?
http://www.wsj.com/articles/SB...
After all, it's ok if they do it. It's only bad if terrorists, communists and perverts do it.
Crying wolf and all that.
It's more likely they were spying on the Regin developers, stole their code, and modified it for their own purpose.
If we did it, it's cyberterrorism. If they do it, it's law enforcement.
Assholes.
These clowns are entirely willing to undermine the security of every computer on the planet to get their grubby fingers into everything.
We need products which keep these guys out, and these guys need a serious beat down in the courts to limit what they can do. A few of them probably should be hung for treason.
Morally, every black hat should be targeting these agencies to cause as much damage to them as possible -- because the damage they're doing to our freedoms is immeasurable.
Thanks, America, for leading the charge in fucking up the planet.
Lost at C:>. Found at C.
How long is it going to take before the American people get fed up with this. The NSA is obviously an out of control agency and has been for years. The people in charge need to start spending LONG prison sentences for their crimes against humanity. And before people start screaming "Think about the terrorists" remember that those in charge (both the NSA, FBI and others) have deliberately chosen to ignore gathered intell about actual terrorist threats (such as 911 and the Boston Marathon bombers). This should prove to everyone that the government considers their own citizens as more of a threat than foreign terrorists.
HTTP URL not working. Use HTTPS URL:
https://threatpost.com/researchers-link-regin-to-malware-disclosed-in-recent-snowden-documents/110667
That's just the NSA tap getting overloaded, it'll clear up on it's own. ;)
It is time ro return to the Write Protect Switch. Passwords are no longer effective in preventing firmware alterations by hostile organizations.
For those old enough to remember them, changing a BIOS required an EPROM burner and UV eraser. Changing CMOS settings required setting the write protect jumper.
Early infections were restricted to Write Enabled floppies, hard drives for machines with them, and everything else was write protected.
It is time to return to write protected firmware requiring physical access to alter.
Our complacency with remote management is showing the error of our ways as we are compromised.
The truth shall set you free!
Revenge wouldn't be the point - the point would be to send a clear message to future patriots that might try a similar stunt. Revenge would just make it more satisfying to do so.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
Sure this horse is out of the barn, but there's lots of horses - that's why you want to make sure the others all hear the first one screaming as it's being eaten by cougars.
I can think of only a few reasons why it hasn't been done:
- To be truly effective it must be obvious that the US/NSA was behind it, and there may well be a fear that employing extra-legal methods to send that message would generate the public backlash that has thus far failed to manifest. A martyr can be far more powerful than a man.
- Given that he is under Russian protection, any such action could be taken as a direct assault on Russia, and in the current international political climate that might be regarded as too great a risk to take. They seem to be positioning themselves as the spokesman of a new global power structure - no sense in ceding them any more moral high ground than they've already got.
- The guilty parties still have some scruples (hey, nobody values their scruples like the man who doesn't have many)
--- Most topics have many sides worth arguing, allow me to take one opposite you.