“Equation Group” ran the most advanced hacking operation ever uncovered

http://arstechnica.com/security/2015/02/how-omnipotent-hackers-tied-to-the-nsa-hid-for-14-years-and-were-found-at-last/

by privong • 11 years ago

870 362 11 years ago

ptwiggens• 11 years ago

The update confirms it is the NSA.

It is incredible, even the most generous estimation of the NSA's capabilities before the Snowden disclosures now look conservative. This is the stuff conspiracy theories are made of.

sumitviii4• 11 years ago

How do they even sift through all the information they get? It has to be a LOT.

relaunched• 11 years ago

This particular set of exploits has little to do with collecting information. This seems to be directly related to command and control operations, including over systems that aren't connected to the internet.

There are a pretty scary set of discovered exploits.

rodgerd3• 11 years ago

Given that they appear to have basically perfect ability to gather data, there's got to be some reason we keep having successful terrorist attacks.

danielayoub• 11 years ago

Data mining algorithms. Remember, they're the world's largest employer of mathematicians.

pixl97• 11 years ago

Had a family member that worked for SPEA (test equipment manufacture). Said different government organizations would bring in boards with massively parallel sets of chips and input/output on them, like nothing they ever saw in any other field. They were expressly forbidden to take pictures of them.

Between that and the massive data centers they are building I'm guessing they have rather impressive capabilities.

AlyssaRowan4• 11 years ago

UR = UNITEDRAKE ("Regin", basically?). And that'd probably be rmgree5@nsa.gov: that's the format their addresses are in.

This does seem to be, broadly-speaking, NSA's top-dollar brand-new 0-day-laden (at the time) malware, that they use to launch their less shiny stuff, which is more awkward and a massive overfunded modular boondoggle. This does not seem to be as freely shared around with the "Five Eyes".

By the way, there are innocent machines in the US infected with this thing, at this very moment. Anyone care to explain that?

The hard-drive component should be completely detectable, if you don't boot from it, based on the (small, sadly incomplete) fragment of (Cortex-M0?) stuff I've seen. Power-cycle it, send an ATA reset, read the MBR and following sectors. Look out for the NIC "option rom" persistence module, too - you may be well-advised to do it from something really exotic that doesn't run x86, just in case! (Independent hackers are running (µ)Linux on hard disks now, so it's not surprising a huge agency able to spend billions of dollars of tax money funding contractors on tiny pieces of this project got something of a head start!) Not sure of a good way to detect it in software, but it's not perfect, so it probably can be redpilled somehow.

Watch for "CD-ROM"s that unexpectedly have ATIPs, I guess?

final2• 11 years ago

> By the way, there are innocent machines in the US infected with this thing, at this very moment.

Nobody is innocent. The government has enemies both internal and external.

wongarsu7• 11 years ago

Detecting an infected hard drive in software would be the usual malware arms race: you find some characteristic of it, they improve the firmware.

But if we start to systematically check for it, it should be easy to discover via hardware debugging. Find the JTAG interface on the hard disk controller (or whatever debugging interface the specific processor uses), dump the firmware and compare it to firmware dumps from other hard drives of the same model. I don't see how they could fool that process (given that you have a clean machine to read out the firmware).

Of course to be thorough you would have to check pretty much the firmware of every component of the computer.

kw714• 11 years ago

if you don't boot from it

The malware might remain quiescent unless the examination techniques mimic a computer that is booting.

I might prefer to use an analyzer to monitor the disk channel of a machine that is booting and running.

Building an SATA probe/analyzer is within hobbyist knowledge and skill levels now. If you have money you can simply buy it from LeCroy and many others, or rent it by the month/week.

thejaredhooper• 11 years ago

What's worse is the fact that this would be more terrifying if this weren't an action to the NSA's credit. Chinese, British, and Russian governments also have the capability of developing intrusive malware at such a scale.

I see that this is confirmed as the NSA, but the world has been awfully silent on the intrusiveness of Chinese malware practices. You can not travel safely in China without your domestic devices being breached, yet we don't hear about large-scale projects from their government, which also possesses "near limitless resources" at their disposal.

I just think it's interesting there's so much attention on the NSA.

sumitviii4• 11 years ago

People would be angry even if they didn't know that Equation Group was part of the NSA.

yeahyeah5• 11 years ago

This is exactly what the NSA should be doing. Everyone (rightfully IMO) complains about overly broad data collection happening within the USA, but here (as with stuxnet) you have the exact opposite, a targeted foreign activity conducted with care and targeting. I know it's not for everyone (not least because not everyone is in the states, huh), and it could be considered a bad precedent, but it's not like Iran asked our permission before they launched their nuclear program, or other states are actually waiting on the US's example to have their own intelligence services do their jobs. If you hold that something like 9/11 should be prevented, and that (actual) WMD programs should be stalled, then it follows that this is a fine way to go about it.

Alex39172• 11 years ago

It's not like Iran asked our permission before they launched their nuclear program

You do realize the U.S. helped launch Iran's nuclear program, right?

http://en.wikipedia.org/wiki/Nuclear_program_of_Iran

yeahyeah5• 11 years ago

Well if it's on the US then they should have stopped when we asked nicely, right?

GauntletWizard2• 11 years ago

No, we helped the Pahlavi dynasty launch a nuclear program, whereas the Iranian Republic is now launching a nuclear program using what they've scavenged from that one.

You are conflating two different nations that happen to share a name and borders. The US trades technology with the Fourth Republic of Germany; The US did not with the Third Reich.

javert10• 11 years ago

The US already has the responsibility to end Iran's nuclear program, which threatens the safety of US citizens and the world.

But if the US also helped start the program, I guess it is even "more" responsible, if that is even possible.

jfoutz• 11 years ago

Those atoms were for peace, dammit.

rosenjon2• 11 years ago

The problem is it undermines trust in American technology products in general. If the Snowden revelations were that the United States was bugging Iran, Libya and North Korea and monitoring all their communications, that would be one thing. However, we know now that EVERYONE is under surveillance. Therefore, how do we know they aren't doing this to everyone as well?

yeahyeah5• 11 years ago

Fair enough - although with this set of revelations at least it's been credited at least to mail interdictions. I was responding in a limited matter to this project, this is an example of what I'm personally fine with them doing. Other people may very well have more trouble mentally compartmentalizing the broad range of activities that the NSA (and other digital espionage agencies within the US government) are up to. Many of which are clearly unconstitutional and should be (and appear to, in some cases) now being scaled back.

In any case, to answer the specific question, we can be pretty sure that our we're not infected with official US government 0day malware by the practical considerations - they go to pretty considerable lengths to keep the spread limited (per the reporting) because once Kaspersky or any other researcher gets their hands on it the utility of the toolsets goes away or becomes highly limited.

junto• 11 years ago

Exactly. See this as a case in point: http://www.windpowermonthly.com/article/960011/trans-atlanti...

Estragon3• 11 years ago

Yes, who's going to plug removeable media from the US into their machine after reading this story about the conference CDs?

aw3c2• 11 years ago

Maybe it is what it should be doing for you. But this is exactly what the IT community should work against. We should be able to trust our devices.

yeahyeah5• 11 years ago

I definitely agree with the second part. It's always going to be a back and forth. As for non-US, well, I don't think we can claim a monopoly on espionage.

teraflop5• 11 years ago

According to the report, researchers within the USA were infected with Equation Group malware too.

grrowl• 11 years ago

Of course, it's necessary to achieve a certain critical mass to make infecting your target effective and mask the true source of the attack.

user_00012• 11 years ago

Which countries did ask permission before starting their nuclear programs?

The countries that have nuclear weapons, who do they ask to be allowed to keep them?

lazaroclapp• 11 years ago

Each other and the U.N., sort of... https://en.wikipedia.org/wiki/Treaty_on_the_Non-Proliferatio...

Essentially: "no more countries get nukes, those that have them should get rid of them at an unspecified point in the future but get to keep them for now". It is not an ideal solution, nor a particularly fair one, but much better for human survival than "everybody gets a nuke". Unfortunately, it would work better if powerful countries didn't threaten less powerful ones to the point that violating the NPT and getting nukes seems like the only rational response for preserving their own security. Which brings us to why the U.S. unilaterally launching attacks (cyber- or otherwise) against other countries runs counter to non-proliferation goals, whereas coordinated U.N. sanctions/incentives/inspections/interventions have at much better chance of working.

wongarsu7• 11 years ago

The countries that have nuclear weapons, who do they ask to be allowed to keep them?

Well, the 5 official Nuclear Weapon States (with capital NWS) asked nicely with the Nuclear Non-Proliferation Treaty, which is signed by just about anyone. Not that there ever was a chance of them just giving up their nuclear weapons, but they did ask and the world said yes.

cortesoft• 11 years ago

You make a good point, but the part about Iran asking for our permission before starting the nuclear program doesn't really add much. Of course they didn't ask, just like the US didn't ask before starting our nuclear program. A nation state is an autonomous entity, and doesn't ask permission before making any action within its own borders.

The US, and any other nation state, will of course conduct covert operations, including spying on other nation states. I don't find anything inherently wrong or immoral about this, but I don't think anyone can act surprised or indignant if other nation states don't like being spied on or hacked. You don't gain the moral high ground by pointing out they didn't ask for our permission to build something in their own borders.

Yes, we spy on other nations, and we probably should; but the consequence of that is that other nations will trust you less when you are caught, and that is just the natural consequence of spying.

dannypgh2• 11 years ago

As a signatory to the NPT, which has been ratified by the United States and is therefore law, Iran is legally entitled to have a nuclear energy program.

It's not particularly easy to tell facilities for making enriched uranium (viable as fuel) from facilities making weapons-grade HEU.

mabbo2• 11 years ago

I really appreciate it when someone presents and argument that is from a differing point of view than mine, but is well stated and very convincing. Thank you for that.

That said, I'm not certain I agree. The part where they're intercepting mail of citizens without warrants, without much oversight, that scares me. It's one thing to be talented hackers trying to fight the good fight digitally rather than violently, but when we allow the government organizations to violate privacy to further unstated goals, we set a precedent that can be used as a basis to go further next time.

The NSA can do incredible things like this, but they need better oversight, a publicly stated set of rules that they must follow when they do their work.

plorg2• 11 years ago

I'd have to look back at the article, but I believe the mail interception took place during the Bush-era warrant-less wiretapping. The FISA courts were created to remedy the warrant-less part of that, though they don't really seem to have done much for the oversight concern that you mention.

By this I mean to suggest that such interdiction may not necessarily be truly warrant-less if performed today, even if it is still shady and lacking in accountability.

javert10• 11 years ago

Imagine Superman actually fighting criminals and keeping America safe.

Now imagine Superman sneaking laxative into criminals' sandwiches so they are slightly inconvenienced, but allowing them to continue to kill people in the long run.

The US government is Superman. But it is the second version, while it can and should be the first version.

---

We know who the enemies are. We know who funds and harbors terrorism. We need to take them out, not spy on them.

---

And no, I am not advocating Vietnam III (note: Iraq/Afghanistan was Vietnam II). That was a purely self-sacrificial program to bring "democracy" to people who didn't want it. I am advocating warfare in the classic sense: Destroy the enemy. I am advocating what we did to the Nazis and Japanese.

sfk• 11 years ago

Are you a sockpuppet trying to derail the discussion or is this serious?

krapp8• 11 years ago

I am advocating what we did to the Nazis and Japanese.

That was a world war if I recall, and the US didn't even care about the Nazis, or Japan until they were forced to. "we" didn't stop the Nazis, the world stopped the Nazis, with our help.

Don't be so quick to call for World War III, because i'm not at all certain we would have more allies than enemies if we unilaterally decided to declare open war against the rest of the world, which is what it would amount to. Because the truth is, most of the world 'harbors' and 'funds' terrorism to some degree, including the US. And we've already proven to the rest of the world that we're willing to drag it into a war on false pretenses, so I doubt they would be eager to throw themselves into another one on our behalf. That political capital has already been spent.

Which is, of course, why we don't do what you suggest.

lotsofmangos5• 11 years ago

We know who funds and harbors terrorism.

Well, from the IRA to the Mujahadeen, it's largely been the folk with the most money to spend.

However most of them live in the USA, so perhaps a local criminal investigation would do to start with before breaking out the tanks on a jolly abroad.

higherpurpose• 11 years ago

How is infecting a whole telecom company like Belgacom, which then allows them to get data on everyone, a "targeted" attack?

mb0• 11 years ago

To play devil's advocate, maybe they were only going to adjust the routing behavior of a certain netblock? Still very out-of-bounds if you ask me.

discardorama5• 11 years ago

but it's not like Iran asked our permission before they launched their nuclear program

Why should they? Who died and made us the "World Police" ?

krschultz4• 11 years ago

22% of world GDP, the world's largest & most effective military, the permanent seat on the UN security council, & the Treaty on the Non-Proliferation of Nuclear Weapons.

http://en.wikipedia.org/wiki/Treaty_on_the_Non-Proliferation...

I agree we shouldn't go barging into other countries unilaterally, but are there really people that want to argue it's wrong for the US to use its power to stop other countries from obtaining nuclear weapons?

doczoidberg3• 11 years ago

I am from germany and I hope most of americans don't have this point of view.

1. give up freedom for some stupid terrorist attacks? why should we? We've lost the keystone of freedom when we do this and they have already won.

2. Do you really think these extensive intelligences do stop terror? (maybe they do sometimes, but terrorists will find new ways)

3. IS and others are the result of the Iraq war which was a offensive war from the US justified by a lie (Sadam had no weapon of mass destruction). Do you still think that America is the world police? The reputation of the US has gone rapidly down in the last decade. For the most here in germany the US are not the good ones any more. Other countries have their own way of life. America has to accept that.

krschultz4• 11 years ago

I think if you start with the assumption that it would be unacceptable for the US government to do nothing about protecting the American people from terrorist attack, the kinds of targeted cyber-espionage described in the article sound pretty reasonable.

They're better than launching entire wars that kill hundreds of thousands of people, cost unfathomable amounts of money, and last for over a decade, without really achieving the objective of making the country safer.

They're better than torturing people.

They're better than mass surveillance of the entire population of the country - if not the world.

Of all the things the government could be and should be doing, spying on people that in high likelihood are a threat to the US sounds like the one I'm OK with them continuing. You have to admit, slowing down another country's nuclear weapons program with a computer virus is vastly preferable to pretty much any other option on the table - even including "peaceful" sanctions which end up having a human cost.

ingler6• 11 years ago

Most Americans are apathetic. Of those of us not apathetic, those opposed to the widespread espionage of the three letter agencies are in the minority.

It's been heartbreaking watching the American reputation decline worldwide while also watching the inverse rise of the amoral and unrepentant technocrat here in America. It's a Golden Age for technology and a Dark Age for culture.

happyscrappy3• 11 years ago

Wake me up when Germany starts closing US military bases on German soil. As long as Europe is in America's pocket the status quo will remain.

orbifold• 11 years ago

The difference between the NSA and German Intelligence is that the reach of NSA is larger than that of the BND. Other than that the BND also is not required to afford foreign nationals any privacy protections and is known to regularly intercept metadata in Germany. Unrestricted surveillance of foreign nationals is regulated in the G10-law, named after the article in the Grundgesetz it circumvents, but the BND has simply overreached its power and also collects data on German nationals. The control committees are also secret, just like the US FISA courts.

So before we get all high and mighty, we should probably clean up our own act here in Germany. Of course the G10 laws were dictated by the Military control committee, when they relinquished direct control in the 70s. For that reason it will be somewhat hard to simply change, especially because our interior ministers have had an unblemished record in support of more mass surveillance.

andrewfong3• 11 years ago

"give up freedom for some stupid terrorist attacks?"

What level of freedom is lost here? We're NOT talking about mass surveillance generally but the targeted access described by the OP. It's the difference between the police parking a van outside a suspected gang hideout (hopefully after getting a warrant), and parking a van outside every home in America. Most Americans are OK with the former and NOT OK with the latter. And, IMHO, that's a valid trade-off to make in a democratic society.

You might object to a particular surveillance target (Merkel), which is understandable. But would you object to spying on Putin? I suspect even Germany (especially Germany) would be okay with the NSA conducting targeted surveillance of senior members of the Russian military with ties to Eastern Ukraine.

In an ideal world, there would be no surveillance or any surrender of liberty in any scenario. But the world is not ideal and compromises are made. Germany is not immune to this. Case in point: Hate speech is illegal in Germany, which is understandable given German history, but a violation of free speech rights in the U.S. The challenge is not to reject all infringements of freedom wholesale but to identify where lines can be drawn between what can be tolerated and what must not.

vasilipupkin3• 11 years ago

It's not just terror. We've got Mr. Putin out there, who at best can be described as someone willing to pursue his own interests no matter the cost. So, should we have no capabilities to defend against him. Sorry to say, but since Europe spends so little as a percent of GDP on defense, it effectively outsources defense to us, while simultaneously making fun of us for our low spending on social programs. You cannot pretend there is no tradeoff here.

jashephe• 11 years ago

"Do you really think these extensive intelligences do stop terror?"

I was under the impression that stuxnet had a demonstrably negative impact on the capacity of the Iranian nuclear program to enrich uranium. Of course, there's a whole different argument on whether or not that's in support of "terror".

dsuth5• 11 years ago

1. I don't think the scope of these efforts are based solely around terrorist activity. They are very wide-ranging in scale, and seem to be a natural extension of the USA's foreign policy. In an ideal world it would be nice if neighbours didn't spy on each other, but in the real world, everybody spies.

2. Yes, clearly they do, and also alter the course of some very dangerous activities a la Stuxnet and Iran's nuclear program. Just because it's possible to circumvent these measures, doesn't mean they shouldn't be use either. Firstly, you've made it more difficult for terrorists and other parties to communicate effectively, which is already a win. Secondly, they will of course be updating their methods as well. I doubt very much that what we're seeing here is the be all / end all of NSA's capability. This is implied in the article, where the group hands down certain exploits / technologies for actual implementation, but tends to keep things back. A blow, to be sure, but I doubt we've seen it all yet.

3. ISIS are not the result of the Iraq war. It's very important to understand that ISIS are simply the most recent manifestation of a fundamentalist Islamic sect known as Wahhabism [1]. As convenient as it is to blame them on simple cause and effect, the reality is, as always, far more complex. Essentially this is a group of ultra-fundamentalist muslims, who have for a long time been part of Saudi's political structure. What we are seeing now is a return to their radical roots, backed by disenfranchised and poorly educated muslims across the Middle East. These are people who were left out of the massive oil money influx during Saddam's regime, and are now fighting tooth and nail against any and all transgressors - muslim and Westerners alike.

If anything this makes a case for the NSA's activities, not against it. It's not the US's meddling that caused these issues (although it certainly hasn't helped); these are deeply ingrained philosophies in Middle Eastern culture. I don't know about you, but I'd rather have a very good understanding of their power structure and where they're putting out feelers, than not.

[1] http://www.huffingtonpost.com/alastair-crooke/isis-wahhabism...

dskhatri• 11 years ago

Germany has a sophisticated spy program of its own: http://www.theguardian.com/commentisfree/2013/oct/04/german-...

rbehrends• 11 years ago

Two problems I'm having with this argument:

(1) This does not actually look particularly targeted to me, but more like a shotgun approach. While Russia and China are the primary targets, there are also plenty of allied nations on that map. Unless, of course, you're trying to say that all non-US targets are fair game.

(2) The NSA targeting medical institutions (presumably hospitals) makes me particularly queasy, because what they are doing is not exactly passive listening, and when they screw something up there (like the router in Syria that they crashed), that could endanger human lives.

FeeTinesAMady10• 11 years ago

This statement is the most upvoted piece of propaganda I've ever seen on Hacker News. I think the shills that Greenwald told us all about are all over HN too.

There's no point in praising anything the NSA does unless you are perfectly happy with them destroying security for the entire world and spying on everybody at all. The NSA has the power to blackmail politicians and run the country. They lied to congress. They are a completely rogue agency. And you praise them!

walod• 11 years ago

It's not propaganda, it's a reasonable observation about the NSA's duties, and it's not meant to tell the whole story. The conspiracy types need to tone down a bit so that a thought-out and nuanced discussion can take place. You're just ranting and throwing Alex Jones and Greenwald buzzwords around, disabling any real insight.

qnr• 11 years ago

Yep, it is exactly the same rhetoric, word for word as used in other NSA-praising comments on HN. Posted by a 1-year old account that had exactly 1 comment in their history until today.

ForHackernews3• 11 years ago

You need to pick your battles. Nobody is going to listen to your serious concerns about NSA overreach if you're freaking out any time the NSA does anything at all. If you hope to rein in the NSA, impose real oversight, and limit its power, you're going to have to start by acknowledging that "shut down all US intelligence agencies" is not a real policy proposal and not everyone who thinks the NSA has some legitimate role to play in US security is a paid government shill.

dsuth5• 11 years ago

There's no point in praising anything the NSA does unless you are perfectly happy with them destroying security for the entire world and spying on everybody at all.

That is a ridiculously absolutist statement. Do you really stand by this? It's not possible that some things the NSA does are good and beneficial, because other aspects of that organisation are questionable?

I'm sorry, but your entire post comes off as very partisan - and quoting Greenwald plays into this as well. Hell, I am left-leaning by nature, but I've had to unfollow him on twitter recently, as he portrays everything in the worst, most dramatic light possible. Don't get caught up on the hate train.

sehugg• 11 years ago

I'm not sure I'd hold up Stuxnet as an example -- it did little to impact the Iranian nuclear program and only invited retaliation: http://www.techtimes.com/articles/32209/20150211/edward-snow...

zmanian• 11 years ago

1. The NSA uses all of these offensive information security technologies in mass surveillance as well as targeted attacks. See Belgacom.

2. The more concerning thing is their appropriation of civilian infrastructure and targeting of civilians using offensive attacks.

3. The vast offensive capabilities of the US government undermine their ability to be trusted in the development of improved defensive capabilities. Defensive research and product development funded by the US govt will produce systems that undermine offensive capabilities that are a key form of US hegemony.

diego_moita• 11 years ago

From an American perspective you might be right. But, as a Brazilian, I'd say this is the perfect reason why the rest of the world should stop buying technology from the U.S. You are not trustworthy.

Yes, I know that "everyone does it, get over" but it doesn't make you better or even acceptable.

SEJeff4• 11 years ago

As an American eho actually agrees with your comment wholeheartedly, I'd love to see a Brazilian Cisco, a German Microsoft, an Icelandic Bell Labs, and a Swiss Apple. Sadly it seems like the US does come up with a lot of tech that is worldwide dominant. Perhaps it has to do with the way the U.S. culture + government can, in some scenarios be conducive to startups, or perhaps it is luck over and over and over again. I highly doubt luck has anything whatsoever to do with it.

All of this being said, capitalism is a game played by multiple parties. If other countries were able to make things like mentioned above as good or preferably better and sell to. Global audience the whole world would be better off. I just wonder why so much tech used everywhere is made in America originally. DARPA has a huge part of what makes this happen I think and like it or not they are part of the security establishment who made things like the Internet.

jrochkind13• 11 years ago

If the U.S. can do it, other entities can do it too.

I'd rather that the NSA were disclosing the vulnerabilities they discover to vendors, so they can be fixed.

Failing that, we rely on white hat researchers like those here (not to mention Snowden). They're doing really important, socially valuable, work. I wonder where they get their funding, we need a lot more of them. It's our job as software/hardware engineers to create secure software.

blazespin• 11 years ago

this is horrible and devastates the American information technology industry because there is no chance that any foreign government is going to buy anything from the US that could be infiltrated by the NSA.

timrs2998• 11 years ago

"... indicate that the NSA used Regin to infect the partly state-owned Belgian firm Belgacom." Do you like their targets? The FBI and CIA frequently target dissent as terrorism while the NSA frequently targets economic forums and large companies. And do you not care about the effects of hoarding (and purchasing) 0-days?

moe2• 11 years ago

If you hold that something like 9/11 should be prevented, and that (actual) WMD programs should be stalled

Except nothing like 9/11 was ever prevented by broad data collection.

And: There is no "terrorist threat" to begin with, unless you also believe in Santa Claus and the Easter Bunny.

You are still more likely to be killed by a lightning strike than by a terrorist. There's still plenty more and plenty more violent killing going on in Africa than in Middle East. But there's no oil and no convenient media narrative to be had from the former.

then it follows that this is a fine way to go about it

Non sequitur.

guelo• 11 years ago

So China should be reading Obama's emails, right?

LLWM10• 11 years ago

If they can, they would be stupid not to. And the NSA should be doing everything in their power to stop them from doing so.

elchief• 11 years ago

Ya, except the other Four Eyes are doing the same and trading your info back to the NSA

chez17• 11 years ago

If you hold that something like 9/11 should be prevented

Nice strawman.

shit_parade5• 11 years ago

This comment reads very much like astroturfing. I hope the admins of HN take a look at who registered this account and who up-voted this comment to make it the current top comment in this thread. As mentioned by others, this account is nearly a year old with one silly comment before that.

JoachimS• 11 years ago

Millions of harddrives, millions of infected machines all over the world. Sound very targeted to me.

nikster• 11 years ago

Your argument sounds semi-reasonable.

It's not though. Everyone hates the USA by now, and that's because they're spying on everyone (even allies), they think they can tell everyone what to do, else they use their military to intervene.

The USA is currently the world bully. For the military aggression, hopefully Americans will at some point realize that fighting the world can only end in tears - the USA is drained financially and simultaneously breeding new terrorists through the drone war which should be classified a war crime as there is no telling how many innocents have been killed.

Karma's a bitch, friends. This is how empires fall.

Really, the USA needs to re-evaluate its foreign policy. Spend half the military budget for 2015, that's $300Bn, on education and hospitals and bingo, you're once again the #1 nation in the world.

Then, instead of making war everywhere, make friends and trade partners and watch the money pour in, the soldiers stay home and stay alive. Fight terrorists with gestures of goodwill and they will go away all on their own - as opposed to killing random children in Pakistan, so their fathers, uncles, and other relatives may justifiably become new terrorists with a life-long grudge against the USA.

And tell the NSA to focus on defense - keep out the baddies, keep out the Chinese and Russian hackers, keep American businesses and business interests safe, stop others from hacking in the USA. But don't go out and listen to everyone's phone calls and hack allies, and enemies alike, and have secret laws like the Nazis did - because honestly, all that shit will get back to you eventually. Do something bad - somebody will find out. That's the new reality we live in, all facts will be discovered.

That Kaspersky was able to uncover the most sophisticated hacker group in the world is a case in point. The internet is the perfect paper trail, no matter how good you are.

The ostensibly noble, good goals that secret laws and secret operations supposedly lead up to never materialize. The ends that the means supposedly justify never arrive. So keep the means good, keep it clean. This whole idea that you must deceive, cheat, and betray in order to survive is a wrong idea, and it's proven again and again until the lesson is learned. Your choice when to learn it.

Karma is a bitch, friends.

rosenjon2• 11 years ago

Based on the article, are we to presume that this only affects tech in hostile countries? Or are they doing this to US-based equipment as well?

Seems like this will backfire spectacularly when foreign countries and companies stop buying American made tech for fear of these hardware backdoors. Spectacularly irresponsible.

teraflop5• 11 years ago

According to the report, the malware was delivered to researchers in dozens of countries, including the UK, India, Mexico, Switzerland, France, and the US itself.

netman21• 11 years ago

Check out bannanaglee. Backdoors in Juniper and Cisco gear. Yes, already having an impact.

Buge• 11 years ago

Would this really be considered a hardware backdoor?

jrochkind13• 11 years ago

Wait, is Mexico a "hostile country"?

leroy_masochist4• 11 years ago

Their central government is not hostile to the United States; cartels and certain cartel-influenced local governments certainly are.

gnu8• 11 years ago

We should all be aware of the fact that these people are the enemy. They don't do these things to "protect freedom", they do them to destroy freedom.

Most of the people on Hackernews are uniquely placed to resist. Secure your software. Refuse to cooperate unless legally compelled. Analyze and publish any evidence of government attacks.

If you work for the NSA, understand this: you aren't American. You are the Internet Daesh. You will lose.

rifung• 11 years ago

In what way are people who work for the NSA not American? They are literally working to protect American citizens from violence. While you may not agree with their methods, saying you are somehow "more" American than they are, let alone that they aren't American at all is a huge stretch.

I think I'm too young and naive to really form a good opinion on what they are doing, but I do know that I definitely haven't done anything I can remember for the sake of this country. Maybe they're being harmful, maybe not, I don't know, but at the very least I like to think they are trying to be helpful.

rodgerd3• 11 years ago

In what way are people who work for the NSA not American?

Gee, I missed when HN became a US-only site.

They are literally working to protect American citizens from violence.

Really?

javert10• 11 years ago

Anyone whose work actively undermines the principles of the US Declaration of Independence and the US Constitution has no moral right to the title "American," though they may be Americans in a legal sense.

Ignorance is no excuse, but it is an explanation. I have no doubt that most people at the NSA can accurately claim ignorance.

As they say, "The road to Hell is paved with good intentions."

brainpan• 11 years ago

Outside of the rhetorical zone, outside of the we-can-believe-any-feel-good-idealistic-high-minded-righteous-principles-we-want-as-long-as-we're-just-talking-comfortably zone, this is not true.

You know how politicians have a certain style of rhetoric they use when addressing the public? How when they go on talk shows or try to speak about some platform/policy they are tendering to the public, there's this whole pretense of them actually believing in not only that the policy being tendered could work after you elect them and people like them, but also they have these "American" ethics/values, or even sometimes universal ethics, which form their motivation for wanting to be in politics, and wanting to enact policy?

I'm asking if you notice the gulf between how politicians speak, and what motives they give you the impression they have, versus how they really feel on the inside. One can say I don't knows how they feel on the inside, yet we've been lied to so many times, and we have seen contradictions between their public rhetoric and their private motivations in the past, that we should actually be considered gullible / abused-victim battered-wives if we take the rhetoric and policy prescriptions for, say, the 2016 elections at face value. I can safely predict that these candidates are pushing policies with a pretense of justice and ethics, yet they are for all literal definitions lying about what they say they believe.

I used the sort of politicians you vote for as an example that you should already understand. It shouldn't be controversial that Hillary Clinton and Jeb Bush are actually speaking words from behind a more-electable "persona" that is actually a lie. They effectively "pander" to us by talking about doing things "for America" and "for Americans". We've seen their lies in the past contradicted by their actual actions.

Anyway, military and civilian contractors in positions of power in the government need to be understood in this light.

"In what way are people who work for the NSA not American?"

Simple. No one who is not self-deceived, or deceived by others, works in that way. They are self-interested for the most part. They don't want to help everyone in America; there are millions of people in America they despise. The higher the stakes, the less altruistic they are. Give up your "hard-earned" money in taxes? In private charity? Too high of stakes. They be more likely to help other Americans if the others were "the sort of Americans" they prefer, and they prefer to leave the sort of individuals they don't like, or don't know and don't trust, to fend for themselves.

That applies to low-level workers, and it applies also applies to individuals at high levels of power. The fact that individuals at high levels have to use political-style fake rhetoric and personas to be appointed to their contracts and their stations does not mean they actually believe it. What truly motivates them is usually selfish things: attaining more wealth, ownership, control, more agency to mold their personal worlds to their will (cars, country clubs, whatever), and more agency to mold their greater civilization to their will (forcing other people to exist in ways that are more pleasing, or convenient to the powerful).

You see, there is no America, in reality. The reality that people fundamentally care about, will care about over the deceptive rhetoric when the chips are down, and that the military serves to exist, is wealth, power, and control.

We exist in a planetary civilizaion, but we presently pretend that old national civilizations are what motivate us, even as we take action year-in-and-year-out to further along the globalness of our order: we try to globalize/standardize our finance and governance system over every single individual person in every old nation.

So it's global power that motivates the ones in power, and building and preserving their own individual status in the global order that is what they are really beholden to.

That is why things like "Homeland Security" and NSA domestic information gathering exist: though the people with their hands on the levers of power here say it's to "protect America," they actually don't love all of America. "When the chips are down, these civilized people will eat each other, you'll see." They can't possibly save all of Americans, and they're building a lockdown-safe domestic order that will treat non-conforming Americans just as poorly as they treat non-conforming non-nationals.

They are working to protect themselves from violence, not the "Americans" they pander to. You will be protected precisely to the degree that you endorse and support the global regime, and you will be oppressed precisely to the degree that you resist and combat it.

Their professed "to protect America" motive is just a fork-tongued, or sugar-coated, rhetorical device that does not comport to the reality in their own heads when they put their heads down on their silk pillows at night. They are protecting their global economic and political order: corporate power, corporate governance, financialization, ueber alles.

tomelders• 11 years ago

So it's a good thing they're spying on that poster child of terrorist anarchy; Angela Merkel?

tomp• 11 years ago

Secure your software.

How exactly? Even "safe" languages like Rust are still completely unsafe for very common things like integer overflow.

ars3• 11 years ago

We should all be aware of the fact that these people are the enemy.

By "these people" do you mean the NSA or the other countries? Because your ending making it sound like you might be talking about NSA, but your content makes very little sense if that's what you mean.

They don't do these things to "protect freedom", they do them to destroy freedom.

The hell are you talking about?

Analyze and publish any evidence of government attacks.

A government attack on another government? What's the problem? That's what the NSA is supposed to do.

If you work for the NSA, understand this: you aren't American. You are the Internet Daesh. You will lose.

I think we might need an amendment to Goodwins law. Seriously? You think spying on another country is the same as enslaving and raping children?

You need to sit down about think about your mental status that allows you to say (and think) things like this. There is something really twisted in your thinking, and you should try to find out what.

This is what the NSA should be doing. It's what I expect them to do.

Spy on your own country? Not cool. Spy on another country? Yes - keep it up and do more.

Cthulhu_3• 11 years ago

Spy on another country? Yes - keep it up and do more.

As someone from another country, I'd rather they didn't.

wongarsu7• 11 years ago

It's just about impossible for an outsider to reverse engineer a hard drive, read the existing firmware, and create malicious versions.

It's hard, but it isn't like this hasn't been done before: http://spritesmods.com/?art=hddhack&page=3

And to be honest, I think what they call "about impossible" is just a question of investing enough time and having a somewhat decent understanding of microprocessors and reverse-engineering. I'm not trying to downplay Equation Group's achievement, but it feels like arstechnica is starting to exaggerate here.

damurdock• 11 years ago

The whole "embedded programming is scary and impossible" sentiment seems to be pretty common these days. I mean, it's impressive, but well within the reach of an interested nation-state or even a skilled hobbyist like Sprite_tm.

It seems like the prevalence of modified router firmwares (and botnets based on them) should make it clear that firmware modification is A Thing That Happens(TM).

tptacek3• 11 years ago

Anyone who thinks this kind of work requires nation-state backing should look at the (hobbyist!) projects to jailbreak the Xbox, X360 and PS3. Low-level kernel- and hypervisor- programming in which obstacles are casually overcome by dropping zero-day memory corruption bugs in core libraries that would be worth tens of thousands of dollars today just from bounty programs, deploying crypto bugs that make "custom RC5" and "thousands of iterations of SHA1" look like the shoplifted- from- Schneier technique that it appears to actually be (TEA hash collision, ECDSA nonce repeats, &c).

And these were, more or less, student side projects.

lawnchair_larry3• 11 years ago

It's worth noting that those cases used open source firmware.

zaroth• 11 years ago

I remember reading this on HN a while back and came here to post it as well. Techniques like this show funding and/or determination but not really brilliance.

If someone asked you to permanently infect hardware, the hard drive controller might be the first place you look, and certainly not the last. The interdiction seems to be the strongest indicator of funding level.

The so-called Equation Group doesn't sound like much more than a group of average engineers doing their job. Breaking into systems is mostly childs play. Securing them is the more interesting challenge.

comboy• 11 years ago

In light of this thread, there's an interesting line from the article you've linked:

The Cortex-M3 handles... nothing? I could stop it and still have all hard disk functions.

I mean, hacking is fun, but being a government I guess you can also convince some manufacturers to make things easier.

MichaelGG• 11 years ago

It's idiocy to think "outsiders" are needed in the first place. The CIA ACD FBI had multi decade breaches that cost the Soviets/Russia less than a couple million dollars.

If FBI agents can be flipped for so little, it's silly to think the NSA cannot get detailed engineering plans and source code for every electronics product they desire.

Not to mention they can always recruit people to work totally undercover in industry. Hire top performers, give them coaching or even sabotage rival colleagues. It certainly cannot cost more than a few million per agent to deeply infiltrate target companies. Hell, in their place, I'd be trying to get multiple people into MS, Intel, etc. to be in position to use root keys if needed.

lawnchair_larry3• 11 years ago

That statement isn't from ars, it's from experts, and it's correct.

Reverse engineer 12+ firmwares, make extensive modifications to their functionality, recompile them, properly QA them, and use them as just one element of a complex malware chain is not a student project.

The link you provided shows how much investment it takes to identify a small bit of firmware functionality and not even do anything useful with it.

mabbo2• 11 years ago

I'm pretty sure intercepting and screwing with mail is a felony... isn't that a felony? How exactly can the US Government have it's employees committing felonies with no warrants or oversight?

ForHackernews3• 11 years ago

There are likely secret warrants in FISA court.

morcheeba• 11 years ago

I used that line to explain to the police officer why I had been sticking raw fish in my neighbors mail. Luckily, he did not have the necessary security clearance to dispute my claim.

AlyssaRowan4• 11 years ago

That doesn't really explain the US researchers infected with this.

Cthulhu_3• 11 years ago

It is, in general, but for everything there's an exception if you're some kind of law enforcement. Killing people is a felony too , unless you're a police officer acting in self-defense, or if you're a judge that passed the death sentence.

ForHackernews3• 11 years ago

This is pretty intense malware, but at some level it's reassuring how narrowly-targeted these attacks seem to be. Arguably, this is what the NSA is supposed to be doing: targeted attacks against key systems in hostile nations, not mass dragnet-surveillance of everyone on the Internet.

sparaker• 11 years ago

The general rule is infect everyone, monitor you want to. They want to have options lol.

letstryagain• 11 years ago

Hostile nations now include Belgium and the UK apparently

aselzer2• 11 years ago

While this is undoubtedly scary, it looks very Windows-specific and would seem unlikely to affect a somewhat security-conscious Linux user.

Java and IE exploits, autorun files, NTFS...

The malicious firmware created a secret storage vault that survive
military-grade disk wiping and reformatting, making sensitive data
stolen from victims available even after reformatting the drive and
reinstalling the operating system.

And that's why it's possibly not the greatest idea to replace simple firmware and drivers with small operating systems (Intel AMT, microcode, SSDs, Smart TVs etc.).

fragsworth• 11 years ago

The attacks were highly specific to the targets they were going after. It's a large team with massive resources - if you become a target, being a Linux user will not protect you from their attacks.

wongarsu7• 11 years ago

I suspect that most of their targets use Windows, so we have more malware samples from Windows hosts. The article specifically mentions that they heavily suspect that a Mac malware exists, yet they haven't found it yet. Consequently we don't know which exploits they use to get on Macs. They also talk about a wide range of servers being infected, only attacking Windows servers would be very limiting.

My best guess is that if you are a target, using Linux makes their work harder but not impossible. They had over a decade to figure this out and vulnerabilities in Linux software are found all the time.

AlyssaRowan4• 11 years ago

Actually, I think they quite like high-uptime Linux peers for their C&Cs.

aselzer2• 11 years ago

The site shows a PHP script targeting vbulletin. Obviously there are lots of ways of attacking servers, especially if they run PHP applications and such.

There was once a PDF exploit for iOS that made it possible to jailbreak the phone (or run any code) if the user opened a PDF, so the PHP program could have been redirecting to something like this.

Linux malware would probably have a much lower effectiveness / $, so it doesn't pay off for them.

cnvogel• 11 years ago

unlikely to affect a somewhat security-conscious Linux user

Obviously the reported malware is Windows specific, but there's no fundamental roadblock to implement something similar in Linux.

- malware injected in the boot process: Have a patched grub/syslinux/gummiboot that, after loading the Linux kernel, patches in the first stages of a rootkit. Common syscall tables and important system functions (kalloc, ...) are easy to identify, as long as the API doesn't radically change.

- secret, encrypted, storage vault in the registry is surely harder to hide, because there's typically not ONE huge monolithic binary configuration database. So, probably one would have to find a feature of ext4/btrfs/xfs/... to hide things in some internally used filesystem object that's not visible to userspace (you can, after all, patch the fs kernel module if necessary)

- patching the SSD or harddrive is surely doable, just have a look at the hdparm manpage for inspiration. (--fwdownload is the official undocumented API :-)).

[just thinking about the parallels, a sophisticated attacker will surely spend some time tailoring his rootkit/malware better]

But obviously it would be much harder to persist on a machine, given that internal APIs are much more unstable and bootloader frequently overwritten on OS updates (the Win Bootloader/boot partition, afaik, never...). On the other hand, the targeted users (industrial/military corporations) will probably stick with yesteryear's RedHat Enterprise, rather than "bleeding edge" Arch/gentoo.

ChuckMcM• 11 years ago

Interesting to compare the sophistication of this malware and physical weapon systems such as the Tomahawk cruise missile. One video of cluster munitions shows how the munitions try to attack armor, then vehicles, then groups of people, and then land to become pop up landmines. [1]

One has to assume that the capabilities of the other actors is similar. Makes for a pretty scary picture when you think about it.

[1] https://www.youtube.com/watch?v=CY9gojFu-_U

harkyns_castle5• 11 years ago

Admittedly I've had a few beers, but what was going on there? It looked like a chaff device or something. I didn't see the massive destruction I was hoping for.

grandalf3• 11 years ago

I think the lesson here is not so much that governments can do this, but that entities with extremely large budgets are implementing broad, interconnected initiatives like this.

I think realistically any entity with over $20M could participate meaningfully in these kinds of exploits. The key is that in order to be useful many overlapping initiatives need to exist.

It seems like exploiting things like firmware would be pretty easy: You just get a member of your team who is a bit overqualified to apply for a job at the target company. A relatively small team could accomplish this in a few years, aided by the scarcity of top tier engineering talent.

The hard part is the social aspect of the attacks, but a single clever individual can come up with many.

RockyMcNuts• 11 years ago

well, in TFA it's a little easier for the NSA than embedding a mole, NSA just tells WD they want to buy drives, but need to audit all the source code including firmware for security issues, then modifies firmware, then intercepts hardware orders from targets and replaces them with ones with compromised firmware.

grandalf3• 11 years ago

True, but I think it makes more sense to look at these tactics in the most general way possible. Firms could be doing them, as could much smaller governments.

Most press about itesec is focused on individual vulnerabilities and the tactics used in specific exploits. What we're seeing is tremendous "long game" strategic sophistication. Stuxnet was one example of using many attack vectors to eventually achieve a goal and these revelations suggest that was just the beginning.

Sure, intercepting the mail could be difficult, but all it takes is a few compromised UPS drivers and warrants are no longer needed.

peterwwillis• 11 years ago

I feel bad for the people that work for groups like this. Sure, you get to hack every developed nation in the world and are privy to the most sensitive information in the world. You're also therefore the world's largest liability, and your life is probably very expendable compared to the data you're retrieving. They might have a unique identity just for picking up milk.

ingler6• 11 years ago

I don't know what's more disturbing: the fact that US government does this with impunity or the fact that a sizable group of technically competent citizens defends it.

azinman2• 11 years ago

I'm for it when it doesn't target only US tech like we see here... that harms trade. I'm an American and thus I benefit... plus I think the skills are awesome (to me the tapping optical fiber without cutting it off is more impressive, however).

The attack is just like any other malware attack at that point, which everyone will always need to defend better against. If anything this creates a better challenge for SV & tech in general to react to. Apple already has responded and is making it harder to intercept which is good for everyone in the long-run.

The US might just be the first ones discovered with it, but to think that no one else will also figure it out (nation-state or not) is very unlikely. Internet + digitized everything makes our current paradigm vulnerable unless everything starts getting more secure.

pgwhalen• 11 years ago

I think the "sizable group of technically competent citizens" realizes that espionage between nation-states is as old as nation-states themselves, and that because of the nature of humanity, it's not going away anytime soon.

ingler6• 11 years ago

It's also where the money is. Getting paid to do the wrong thing is also an old trait of humankind.

Remember Google's original motto? Whatever happened to that?

sheensleeves• 11 years ago

Harder to count HN support for a political side, than to count people at a rally. (Sock puppets.)

LLWM10• 11 years ago

It disturbs you that other people have different political views than you do?

ingler6• 11 years ago

No, I like a good debate. What disturbs me is the misuse of government power and those people who should know better that defend it.

balls1872• 11 years ago

Anyone get the feeling that at this point, the NSA et al, have moved onto even more sophisticated attacks?

leroy_masochist4• 11 years ago

Given that the unearthed program is a decade and a half old, I definitely get that feeling.

laurent123456• 11 years ago

I'm picturing the NSA engineers laughing at the "advanced hacking" Kaspersky just unearthed, meanwhile working on stuff that would blow our mind and that we'll only discover 20 years from now.

shiven• 11 years ago

Takeaway lesson #1: re-flash all HDDs/SSDs with verified vanilla firmware from original manufacturer.

Lesson #2: Beware any and all data media, CDs, DVDs (Netflix? Blockbuster? Hollywood screeners? ...?), USB drives.

rasz_pl4• 11 years ago

#1 using Jtag, nothing else will matter, and even then it will only work until your drive is reflashed again in another attack. Best way to secure HDD would be modifying firmware to DISABLE firmware upgrades and external access to service area permanently. Afaik HDDs keep some executable modules stored on HDD platters, that means 'simply' cutting WR leg on eprom chip is not enough. We are talking quite significant firmware rewrite here.

mhomde• 11 years ago

Couldn't you secure yourself by say running an OS image with a truecrypt partition?

flurpitude• 11 years ago

Lesson #3: Don't order computer hardware or software isntallation disks by mail. Walk into a shop without warning them you're coming.

logicallee• 11 years ago

do we really need to encourage people to go into this line of work with language like this:

A long list of almost superhuman technical feats illustrate Equation Group's extraordinary skill, painstaking work, and unlimited resources.

with the effort these people spend contributing next to zero value in the world (strongly negative value if you add up all the energy wasted on all sides including their 'enemies'; if all these sides spent the same resources on positive constructive research instead, we would be ahead). This genius could be applied to making a compiler/interpreter that just does what you're trying to do, regardless of whether you're a programmer.

it's a binary choice: have these people perform 'superhuman' feats of self-destruction and obfuscated encryption and finding zero-days....

... or give humanity the tools that every one of the seven billion people on it can instantiate any idea in seconds and have it actually be correctly interpreted and done.

Resources are spent tricking people so they don't notice something. Where are the resources being spent helping people do what they're trying to?

The example I always go to is: since the creation of the United States, how much inter-state (Iowa and Massachusetts) spying, warmaking, border control, etc, is wasted?

Could this have something to do with its performance over the last couple of centuries?

I think of these types of programs as 'welfare for geniuses'. give them an office and something to do.

but for God's sake, spit them out again. The optimal amount of state spying is, let's face it, much closer to zero than its current levels.

Spend on enough universal education that everyone shares values and nobody is destructive; put the rest into fundamental research and development.

I don't mind that the government exists to do research, employ people, and keep the world safe. But put some limits on it, and please don't encourage this with language like I quoted at the top.

humanity has better things to do with its time. nobody wants to live in a prison.

gloriousduke• 11 years ago

Just think, a member of the group is probably reading this thread right now...

robertmgreen5• 11 years ago

hahahaha...

dhimes• 11 years ago

This made me LOL

rasz_pl4• 11 years ago

Looking at the timeline Im guessing they were recruited under cover of Darpa from regular Defcon attendees. L0pht is a good example, Mudge probably was involved at one point, he lured a lot of geeks and hackers to the dark side.

packetized• 11 years ago

Scalpel, not a sledgehammer.

adambatkin• 11 years ago

We definitely throw our weight around and interfere with Iran's domestic affairs. But this is definitely a case of "we think our morals are better than yours" (and we have bigger guns so we're gonna enforce those morals).

The Iranian government funds terrorist groups around the world, and has called for the destruction of certain other countries. So yeah, if we have the ability to stifle them (particularly their nuclear ambitions) I say we go for it.

I do feel bad for many of the Iranian people. Many of them do not like their government and are therefore held hostage by the events around them, which they have no control over, and may disagree with.

Ar-Curunir4• 11 years ago

Hmm, and what about the Saudi government that actually does fund terrorist activities and opposes almost everything that America claims to stand for?

America is fine with propping up that regime, so why is Iran an issue, when from everything that I've read and experienced (12 years in the Middle East) there have been no implications of Iran in modern terrorist activities?

What moral have high ground can you take then?

somebehemoth3• 11 years ago

"when from everything that I've read and experienced (12 years in the Middle East) there have been no implications of Iran in modern terrorist activities?"

- Iran does not recognize Israel.

- Iran supplies political support and weapons to Hamas,[14] an organization classified by Israel, the United States, Canada, the European Union and Japan as a terrorist organization. Mahmoud Abbas, President of the Palestinian National Authority, has said "Hamas is funded by Iran. It claims it is financed by donations, but the donations are nothing like what it receives from Iran".[15] From 2000 to 2004, Hamas was responsible for killing nearly 400 Israelis and wounding more than 2,000 in 425 attacks, according to the Israeli Ministry of Foreign Affairs. From 2001 through May 2008, Hamas launched more than 3,000 Qassam rockets and 2,500 mortar attacks into Israel.[16]

- Iranian proxies killed an estimated 1,100 US troops in Iraq.[35] In addition, insurgents supported by Iran reportedly committed acts of terrorism.[34][36][37]

Lots more here: http://en.wikipedia.org/wiki/Iran_and_state-sponsored_terror...

I am not claiming these are all fact, but I think there is little doubt that they are at least "implications" as you put it.

(edited for formatting.)

Tloewald• 11 years ago

The US flies drones over foreign countries and kills people with them, topples governments that it doesn't like (or that US companies don't like), invades countries on false or trivial pretexts, yada yada. Ob yeah, and funds terroriets and death squads. So claiming moral superiority over other countries is pretty difficult.

mercurial• 11 years ago

We definitely throw our weight around and interfere with Iran's domestic affairs. But this is definitely a case of "we think our morals are better than yours" (and we have bigger guns so we're gonna enforce those morals).

While I'm not privy to US policy-making, it seems that if morality is involved, it's only by accident. US policy is about protecting US interests, and as such, is primarily motivated by greed, fear and often expansionism. The well-being of non-Americans is completely irrelevant.

This is no different in essence from many other countries, who similarly brandish morality as a shield when it's convenient. The difference is that the US is more interventionist than most, and has the biggest stick.

rl32• 11 years ago

I'm surprised the CPU microcode angle isn't mentioned.

teraflop5• 11 years ago

Has there ever been a non-theoretical use of microcode in malware? I would expect it to be difficult for a lot of reasons (the maximum microcode size is probably quite limited; the format is extremely proprietary; and there's only so much overhead you can add at the instruction level before you start causing a noticeable slowdown).

Also, microcode updates aren't retained when the system is powered, so you still need to have a persistent backdoor installed at the OS level. Given that, it's not clear what additional benefit a microcode backdoor would provide.

kw714• 11 years ago

If you are going to modify a BIOS, then the BIOS can apply the microcode update. No need to tamper with OS then.

rl32• 11 years ago

Has there ever been a non-theoretical use of microcode in malware?

Not to my knowledge. Indeed, the difficulty involved as well as proprietary nature of the format seems to indicate such an attack vector would be restricted to only the most sophisticated actors. So, it's no wonder that there are no real-world examples, assuming that they even exist in the first place.

Also, microcode updates aren't retained when the system is powered, ...

While true, I don't necessarily see this as a fatal blow to the attack vector's utility. Without delving into raw speculation, I'm sure there's plenty of clever ways to craft attacks unique to what microcode affords.

That said, it seems likely that microcode attacks would be treated more as a specialized capability augmenting something like what the article outlines, rather than a method of attack unto itself.

rasz_pl4• 11 years ago

You 'only' need one instruction compromised/customized to be able to breach ring barrier/take over mmu.

Iknowitall2• 11 years ago

What is the NSA is doing here is more subtle and I do not think they fully realize it. They are heavily financing and accelerating the speed of damages that people on the dark side can do. They are "inspiring" a bunch of curious teenagers (in the best case) or a bunch of cyber criminals (in the worst case) to create another malware like that. They are putting out there first of all the ideas, second the conviction that it is possible to do so, and third sample code to study, improve and deploy. This race to being the "smarter" spy is unfortunately leading us in a very risky world to live in. A lose-lose preposition. The press and the antivirus researchers are also not being too smart here to make this public available.

Iknowitall2• 11 years ago

By the way, would you put a bunch of secret technology (maybe a new bomb) partially hidden in a manhole in the middle of the street, just in case a spy passing by needs to use it? That is pretty much what they are doing here... code is easy to move around and to copy. Today (or in relatively short amount of time) who wants that code bad enough will be able to find it. That technology that took yeas and million of dollars to develop is now available to the bad guys. Face palm!

nadaviv• 11 years ago

One of the images [0] in the article identifies a C&C server used by the attackers, technology-revealed.com. The script appears to embed an invisible iframe pointing to a page on that domain, which probably infects the machine using some zero-day exploit on the browser or one of its plugins. The domain is still registered, but appears not to be running an HTTP server anymore. Might be interesting to investigate if someone wants to look into that.

[0] http://cdn.arstechnica.net/wp-content/uploads/2015/02/malici...

compbio• 11 years ago

The article also mentions fanny.bmp as an NSA exploit. Here a post from 2010 [1] from someone who encountered this virus on an USB stick and saved the virus: https://forum.lowyat.net/topic/1488855/all

grandalf3• 11 years ago

The point isn't whether we should be surprised this is the NSA, the interesting thing is that this layered strategy is what you do if you have access to lots of money and talent.

datashovel2• 11 years ago

I would like to ask anyone reading this to hypothesize with me. What if the US government was broadly and knowingly corrupt? How comfortable would you feel knowing that they had such broad and powerful technical capabilities? How would you fight against such a machine, to uproot the corruption?

I'm in awe of these technical feats, but also cautious about the implications of an all-knowing, all-powerful government presence who can infringe on your basic rights at-will.

Cthulhu_3• 11 years ago

It's not a what-if actually, the US government - or at least the higher-ups, like the senate - are bought by those with money. And buying votes / power / votes is the core principle of corruption.

datashovel2• 11 years ago

I didn't want to sound too presumptuous when I wrote the comment, but I would agree the current state of things is far from ideal.

rey12rey• 11 years ago

Equation Group: Questions and Answers by Kaspersky [pdf] --> https://cdn1.vox-cdn.com/uploads/chorus_asset/file/3415904/E...

harkyns_castle5• 11 years ago

Might as well tattoo a UUID on our foreheads and be done with it at this rate. God I hate hearing the apologists for the NSA in these threads. Are you so devoid of empathy?

harkyns_castle5• 11 years ago

Downvote all you like. I'm over this, and I'm getting out of the IT game. If everything I do can be taken at will by a far more powerful, and greedy, team than I can do anything about, what is the point. Time for a change of career. I've always wanted to protect our dying forests and species in any case.

Renouncing my US citizenship too. This is all too disgusting.

iak8god• 11 years ago

Renouncing my US citizenship too.

Statements like this make it hard to take your comment seriously, but I'm going to try.

Time for a change of career. I've always wanted to protect our dying forests and species in any case.

What makes you think you can do anything about this? If you're in tech, it's likely that's where your training, experience, and interests lie and so that's where you're likely to be most effective for now. Why not spread awareness of issues that concern you and work with like-minded people to do what you can. Do you think your fancy new career protecting the environment won't involve working against powerful and greedy opponents?

nhstanley• 11 years ago

Empathy for whom? I know pacifists want to believe we live in a post-war world, and if only we would not make guns or do the kind of things the NSA is doing here we'll suddenly live in a perfect world—but by what fantastical mechanism do you actually think that will happen?

harkyns_castle5• 11 years ago

The old pacifist keyword, its a bit like the communist keyword.

The only war we have at the moment is the one you (assuming you're a shill) created and want to sustain. Because if you don't, it all falls down. Its about the US dollar, and oil.

harkyns_castle5• 11 years ago

Don't get me wrong, I'd gladly strangle the greedy bastards that are doing this to the world. How's that for pacifism?

LLWM10• 11 years ago

Assigning people unchangeable and public UUIDs is worth doing regardless and has nothing to do with espionage. Please don't damage such proposals by associating them with controversial topics like this one.

ilitirit• 11 years ago

How can one detect infection?

anton000• 11 years ago

Wasn't there a demonstration of a similar HDD exploit posted on HN earlier?

edit: found it https://news.ycombinator.com/item?id=8665865

oglees• 11 years ago

Absolutely! I live in Bulgaria, Eastern Europe, a poor, small country, which has been accepted in NATO and the European Union, but still is hosted by the past-Soviet`s secret intelligence services of Moscow, which are now illegal, but has agents and the absolute power over the legal secret services in Bulgaria. The surveillance is much larger, than in the USA, but all the info goes to Moscow.

So, what are you troubling about, when NSA is pure American, and has the purpose to protect you from the legions of Russian, Chinese hackers - officially military, or just playing and stilling criminals, and all the Islamic recruiters, who are trying to recruit American citizens for their Jihad against The Civilization...

I don`t understand, are you stupid, people, or what? NSA has the duty to protect you, and you are acting as children, whom parents has been installed a security program on your PC, to protect you from pedophiles... It`s the same case with the NSA surveillance!

n1x0n997• 11 years ago

So there is this new shodan-like database that takes data from massive scans of the Internet (I think?) etc... Might be worth running all C&Cs through it to discover more domains , for example https://rateip.com/ipv4/190.60.202.4

“Equation Group” ran the most advanced hacking operation ever uncovered

Related Stories