How "Omnipotent" Hackers Tied To NSA Hid For 14 Years and Were Found At Last

Advocatus Diaboli writes The money and time required to develop the Equation Group malware, the technological breakthroughs the operation accomplished, and the interdictions performed against targets leave little doubt that the operation was sponsored by a nation-state with nearly unlimited resources to dedicate to the project. The countries that were and weren't targeted, the ties to Stuxnet and Flame, and the Grok artifact found inside the Equation Group keylogger strongly support the theory the NSA or a related US agency is the responsible party, but so far Kaspersky has declined to name a culprit. NSA officials didn't respond to an e-mail seeking comment for this story. What is safe to say is that the unearthing of the Equation Group is a seminal finding in the fields of computer and national security, as important, or possibly more so, than the revelations about Stuxnet.

Comments

Cover locations.

[Kaenneth]

There is a building near Microsoft labeled "Affiliated Associations of America" which sounds shady as fuck.

Re:Cover locations.

[irrational_design]

Wow, I found an Affiliated Associations of America. If the following isn't the biggest piece of business jargon that doesn't say anything, I don't know what is.

Welcome to the AAOA benefits website. Through a cooperative platform, we developed a benefit program to enhance the value of membership for your Membership Organization or Association. AAOA provides a turnkey member benefit solution that offers companies and their employees an opportunity to reduce the costs of doing business. Take advantage of our group purchasing power and receive full access to exclusive member discounts and pricing. Look around the site and let us know if you have any questions or would like to discuss membership. With AAOA, membership doesn't cost, it pays!

Re:How is this a good thing?

[Kazoo the Clown]

They are the intelligence community, not our national cybersecurity consulting firm, and they only ought to be notifying the public if the risk to national security involved in leaving the vulnerability open is greater than the risk to national security involved in losing the intelligence that could be gained from it.

What you're saying is we HAVE NO national cybersecurity entity whose purpose is to protect our infrastructure from bad actors using exactly the kinds of methods and exploits we're seeing here. And given that, we have to rely on Kaspersky to do it for us. Not only is it then a good thing, it's long overdue.

Re:Thinking of keyloggers,

[Qzukk]

Now I wonder if tabs work in passwords on *nix, if I set my username to be pwd and my password to be cd ../../<TAB><TAB>f<TAB> how would anyone figure that out from a keylog dump?

These Guys Are Fucking Geniuses

[darkmeridian]

You can hate the NSA all you want, but I have to tip my cap at their utter genius.

Beyond the technical similarities to the Stuxnet and Flame developers, Equation Group boasted the type of extraordinary engineering skill people have come to expect from a spy organization sponsored by the world's wealthiest nation. One of the Equation Group's malware platforms, for instance, rewrote the hard-drive firmware of infected computersâ"a never-before-seen engineering marvel that worked on 12 drive categories from manufacturers including Western Digital, Maxtor, Samsung, IBM, Micron, Toshiba, and Seagate.

The malicious firmware created a secret storage vault that survived military-grade disk wiping and reformatting, making sensitive data stolen from victims available even after reformatting the drive and reinstalling the operating system. The firmware also provided programming interfaces that other code in Equation Group's sprawling malware library could access. Once a hard drive was compromised, the infection was impossible to detect or remove.