Slashdot Mirror
How "Omnipotent" Hackers Tied To NSA Hid For 14 Years and Were Found At Last
Advocatus Diaboli writes The money and time required to develop the Equation Group malware, the technological breakthroughs the operation accomplished, and the interdictions performed against targets leave little doubt that the operation was sponsored by a nation-state with nearly unlimited resources to dedicate to the project. The countries that were and weren't targeted, the ties to Stuxnet and Flame, and the Grok artifact found inside the Equation Group keylogger strongly support the theory the NSA or a related US agency is the responsible party, but so far Kaspersky has declined to name a culprit. NSA officials didn't respond to an e-mail seeking comment for this story. What is safe to say is that the unearthing of the Equation Group is a seminal finding in the fields of computer and national security, as important, or possibly more so, than the revelations about Stuxnet.
We hack Iran to prevent them from releasing a bomb.
NK hacks us to prevent us from also releasing a bomb, IYKWIMAITYD.
True dat. They hate us for our freedom, not because we're using drones to blow up their elementary schools.
they hate us cause they aint us
have you seen my sig? there are many others like it but none that are the same
They anus?
Populus vult decipi, ergo decipiatur...
"Force shits upon Reason's back." - Poor Richard's Almanac
There is a building near Microsoft labeled "Affiliated Associations of America" which sounds shady as fuck.
Mainly for which countries are not listed. Hmmm.
Often, I'm told.
So a smart country would "target" itself since it recieved all the info anyway. This means that these findings aren't really there; just guesses.
Stephen Hawkings computer cannot be infected by a keylogger
There's no such thing as "omnipotent" hackers, it's all a bunch of *#*$&@%$@!$#@!#{}@{}#@}#${[[
NO CARRIER
Would you like to play a game?
Remember that hub-bub about airgap-crossing viruses about 6 months ago? That suddenly got very quiet.
I'm not sure how I see that this is a good thing. I know it's fun to hate on the intelligence community (I've done it too), especially when we feel like our own rights have been infringed, but are we really saying that we are in favor of anything which hampers the West's ability to take clandestine actions against other states? After all the complaining we do about Congress and all the bureaucracy that comes along with anything usually related to government, we are then saying that absolutely every hostile action should be subject to the same oversight that produces exactly that molasses-like barrier to actual results?
It is without question that, at times, the intelligence community must have overstepped its bounds, as any entity with that much power would on occasion. Maybe in their case that happens far more often than it should. But does that really mean they should have no real power at all?
The headlne says different things than the text and the original article.
The headline says that they "were found"... but they weren't.
The headline that they are "tied to NSA"... but TFA says that "researchers stopped short of saying Equation Group was the handiwork of the NSA."
http://www.geoffreylandis.com
I'm just going to mention that all these hacks are aimed at Windows machines. When you have a monoculture, you get the Irish potato famine.
Ya.. another related post from engadget (http://www.engadget.com/2015/02/16/hard-drive-spyware/). "It's been known for a while that the NSA will intercept and bug equipment to spy on its soon-to-be owners, but the intellgency agency's techniques are apparently more clever than first thought. Security researchers at Kaspersky Lab have discovered apparently state-created spyware buried in the firmware of hard drives from big names like Seagate, Toshiba and Western Digital. When present, the code lets snoops collect data and map networks that would otherwise be inaccessible -- all they need to retrieve info is for an unwitting user to insert infected storage (such as a CD or USB drive) into an internet-connected PC. The malware also isn't sitting in regular storage, so you can't easily get rid of it or even detect it."
This is the video that might explain the attitude: it's Spielberg vs. Hitchcock in an epic rap battle: https://www.youtube.com/watch?... Whatever your opinion of the directors, you might find the video hilarious!
I had never seen this acronym before but when I seen it I automatically read it as If You Know What I Mean And I Think You Do. I am shutting down my computer now and taking a break from this internet thing.
going to cut the US off from the Internet for a day (like they did to N. Korea) as punishment for all this?
Now that these "Omnipotent" hackers have been caught will there be a pool party on the roof?
Its like an arms race - the US was obviously winning for a while- but the the Chinese, Russians, North Koreans realized they were being hacked and therefor had to build a suitable counter competency, which also included the ability to hack US agencies - I think what we are seeing now is more of a is more emphasis from other nations being put on cyber "terrorism" (was the US terrorizing these nations?), and ultimately more global balance.
kaspersky is havening a field day with carefully pointing but not naming them. How many press releases and we still don't have all the info?
Read the headline which sounded interesting but the summary sounded like a completely different story.
Only the State obtains its revenue by coercion. - Murray Rothbard
What's scary is they aren't just hiding in the hard drives. They are actually rewriting the firmware of those drives, and carving out invisible partitions that that can't get formatted.
Just the other day they 'broke' the story about the big bank heist---and declined to identify the banks.
Now they have broke the story about the mother of all hacker groups. And guess what. They decline to identify them. We found 'em. But we're not telling you who.
Is this part in the linked article hilarious? "Using a C&C center, The Equation group comprises of over 300 domains and more than 100 servers hosted in countries including the US, UK, Panama and Colombia. Panama and Colombia? Yeah, hotbeds of foreign intrigue. Ha, ha. I think if I had found the servers set up in Panama and Colombia, it wouldn't be the NSA I'd be looking at. Let's see, what are there leading exports again? No, instead I think Kapersky is pulling some of this crap out of the proverbial crap hole. Sorry though. I can't specifically say it's Kapersky. But hey, everything seems to be pointing in one direction/or another, right?
Oh, and then there is this. "Disclaimer: Kaspersky Labs sponsored the trip to the Security Analyst Summit 2015."
I used to like Kapersky. But with names like GReAT(Global Research and Analysis Team) and research like this, I'm having serious doubts about where the PR ends and reality sets in. I guess if you want to believe what they're trying to sell, Kapersky is the greatest ever.
Actually, I should modify my comment. The headline does say a different thing from the summary, but the actual article does in fact go on to give some reasonable evidence that connecting the group to the NSA. So, "tied to NSA" is an accurate summary, although with the caveat "tied to" is words that "stop short" of saying that it actually is the NSA.
http://www.geoffreylandis.com
Remember your groups. There is only one Omni-Potent.
ph3@r m3
I'm Not Anonymous. those fricking wankers.
"infected machines reporting to Equation Group command servers identified themselves as Macs, an indication that the group successfully compromised both iOS and OS X devices."
What vectors did the malware exploit to load-and-excute on the targeted Windows, iOS and OS X devices? Please provide samples of the disassembled code.
Running MD5sum on Unregistered (with no carriage return) produces the hash 84b8026b3f5e6dcfb29e82e0b0b0f386
The article used a lower-case u in unregistered, which produces a different hash.
Still no luck on figuring out e6d290a03b70cfa5d4451da444bdea39
My email address doesn't hash to it, so I guess I'm not being singled out.
is such that certain crimes are so grave that they transcend the realm of due process and require summary execution.
The whole point of due process is to ensure that yes, this is indeed the guilty party to be punished. Historically, the witch hunt was one popular alternative.
It is a miracle that curiosity survives formal education. - Einstein
Why does that mean that it's NSA?
Given that most of the electronic manufacturing is in China or Taiwan, it's fairly reasonable to think that hardware bugging could be a result of Chinese intelligence operations. If you were them, where would you concentrate efforts---where you have a comparative advantage. NSA can make use of the best spy satellites and submarine fiber operations, China would exploit manufacturing in their country of foreign goods.
Of course there are powerful state-sponsored espionage efforts. But too many people think that's only NSA, when the list of suspects should include all big ones, i.e. China, Russia, UK, Germany, France & Israel.
I highly doubt they had the resources to infiltrate all of these systems without key industry support.
You have to be an incredible moron to think these people are brilliant, they are not.
They have a huge checkbook and that is the only brilliance they need to get the cooperation they require from Seagate, Toshiba etc.
They do not need the entire company to conspire, only a handful will do, from the article I would say less than 10.
It is almost as stupid as believing Google protects your privacy because they use HTTPS on search queries.
Brilliant my ass
Got Geometrodynamics? Awe, too hard to figure out? Too bad.
Kaspersky is going down, and that's a very good thing for America!
I think the intelligence community has done more harm than good more often than not.
I think American foreign policy has done more harm than good to America more often than not.
Throughout history, it has been the use of power which has undermined empires, and the threat of the use of power which makes them most effective. Wars are costly and can be unpredictable; they have almost always much more expensive than planned and almost always much less useful, except at certain very defined tasks. (Giving someone a temporary boost to poll numbers, uniting a country against a perceived threat, acting as a salve to respond to demand for war that leaders are afraid to turn down).
There are also other risks inherent in war. You train a large number of soldiers and give them weapons and training, which means that every day, your nation is fundamentally dependent upon their loyalty to survive--sometimes to defend it, but ALWAYS to not change the government or take over the government or turn on the country.
I would have expected Slashdot to have much better commentary regarding this. Hopefully this thread just needs time to ripen.
Love how there's plenty of how it was done, but no real discussion on how to avoid it, detect it, or anything relevant to the millions of users that are wide fucking open to nation-state tampering.
And you call yourselves geeks.
I guess we all roll over and say "meh, guess I'll just recompile my kernel while the world burns".
Stupidity is defined as mere elected officials thinking they have real control of the organs of state security. It wasn't true in the Soviets, it isn't true in the US.
And yeah, NSA is a bunch of communists, too.
..which will work is for China and Russia to develop their indigenous Information Technology.
Everybody else please revert to paper and Daimler+Benz's innovation. Dont forget to clip the GSM txmitter they have infested cars with these days.
Or bend over.
..is also good for the Gander.
Recently an AEGIS Radar in the black see was put out of comission by Russkie electronic attack.
You take out 1MW radar by some 10W signal from 100km distance...
Welcome to the New Insecurity !
Most of the stuff made in China is being developed (both HW and SW) in the U.S. or by U.S. vasalls (like ARM, NXP, SG, Siemens or Checkpoint).
So - nice try to deflect from the JCS/NSA World Domination Complex.
Just imagine what exists now, if we are allowed to learn about these particular exploits...
https://www.linkedin.com/pub/robert-green/26/525/6a6
https://www.linkedin.com/company/professional-solutions-llc?trk=ppro_cprof
--
You can hate the NSA all you want, but I have to tip my cap at their utter genius.
Beyond the technical similarities to the Stuxnet and Flame developers, Equation Group boasted the type of extraordinary engineering skill people have come to expect from a spy organization sponsored by the world's wealthiest nation. One of the Equation Group's malware platforms, for instance, rewrote the hard-drive firmware of infected computersâ"a never-before-seen engineering marvel that worked on 12 drive categories from manufacturers including Western Digital, Maxtor, Samsung, IBM, Micron, Toshiba, and Seagate.
The malicious firmware created a secret storage vault that survived military-grade disk wiping and reformatting, making sensitive data stolen from victims available even after reformatting the drive and reinstalling the operating system. The firmware also provided programming interfaces that other code in Equation Group's sprawling malware library could access. Once a hard drive was compromised, the infection was impossible to detect or remove.
A NYC lawyer blogs. http://www.chuangblog.com/
Thank you, National Security Agency, for doing such a truly brilliant job of damaging future prospects for the American computer hardware industry. Smart move to leave the torture to the CIA, no reason for geeks to get their hands dirty. You, along with the CIA, daily provide the rest of the world with evident of how deeply, incredibly stupid supposedly smart people can be when they don't mix with grown-ups. Congratulations!
The right question is,
How much cash, drugs, African prostitutes did Seagate and Western Digital and their "contractors" squeeze out of the USA for access to their drives while in production ?
It is no matter at all that NSA did it.
The question is MONEY (cash, drugs, prostitute slaves) to Seagate and Western Digital and their Contractor CEO's.
Well done Kaspersky ! Even more so if the KGB or MVD (or RGN or VMG) lent a helping hand in this whole post-hollywoodian scenario of uncovering the malfeasances of the US. Why not ? You anglo-saxons and western europeans are not so naive, I hope, to think that there isn't a CCCP-NSA ?!
This intercepts it before they can http://start64.com/index.php?o... & same with any known virus/spyware/trojan/malware maker, botnet herder, spammer/phisher, tracker, etc. - et al! See, the funniest part is, they HAVE to be exposed to work (only specifically targetted ones aren't) & thus, they are ALL exposed, shortly.
* That's part of what it does for security...
(Rest is more reliability vs. DNS issues, & more speed - only security solution I know of that offers it 2 ways (hardcoded locally resolved favorite sites where you spend most of your time online which also aids reliability, AND, blocking adbanners which steal your money in what you paid out monthly to be online...))
Between hosts & your firewall (both native to your OS & operating in kernelmode)? That's the best defense you already have!
Literally a forcefield or logical diode/safety valve of sorts that really works for better speed, security, reliability (& even anonymity to an extent) just by using what you already have with updating/patching OS + Apps.
You can't get sick if you're unable to be exposed (online @ least, the usual delivery mechanism), after all.
APK
P.S.=> By "yours truly": ACCEPT no substitutes (Porsche... from Risky Business, & Tom Cruise (a fellow syracusan)) - it just works - in both True 64-bit &/or 32-bit native code written with the native NT API, Win32/64 API, + highly optimized by hand & compiler Borland Delphi XE4 Object Pascal code... apk