Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
Get HideMyAss! VPN, PC Mag's Top 10 VPNs of 2016 for 55% off for a Limited Time ×
United States Government Privacy Your Rights Online

Researchers Tie Regin Malware To NSA, Five Eyes Intel Agencies 95

Trailrunner7 writes Researchers at Kaspersky Lab have discovered shared code and functionality between the Regin malware platform and a similar platform described in a newly disclosed set of Edward Snowden documents 10 days ago by Germany's Der Spiegel. The link, found in a keylogger called QWERTY allegedly used by the so-called Five Eyes, leads them to conclude that the developers of each platform are either the same, or work closely together. "Considering the extreme complexity of the Regin platform and little chance that it can be duplicated by somebody without having access to its source codes, we conclude the QWERTY malware developers and the Regin developers are the same or working together," wrote Kaspersky Lab researchers Costin Raiu and Igor Soumenkov today in a published report. (Here is the Spiegel article.)
This discussion has been archived. No new comments can be posted.

Researchers Tie Regin Malware To NSA, Five Eyes Intel Agencies

Comments Filter:
  • by Anonymous Coward

    HTTP URL not working. Use HTTPS URL:

    https://threatpost.com/researchers-link-regin-to-malware-disclosed-in-recent-snowden-documents/110667

    • Re: (Score:3, Funny)

      by Anonymous Coward

      HTTP URL not working. Use HTTPS URL:

      https://threatpost.com/researchers-link-regin-to-malware-disclosed-in-recent-snowden-documents/110667

      That's just the NSA tap getting overloaded, it'll clear up on it's own. ;)

  • by Anonymous Coward on Tuesday January 27, 2015 @10:06AM (#48913491)

    According to this article [sans.edu], Regin has been known for some time.

    Fox IT, which was hired to remove Regin from the Belgian phone company Belgacom's website, didn't say anything about what it discovered because it "didn't want to interfere with NSA/GCHQ operations."

    • by houghi ( 78078 ) on Tuesday January 27, 2015 @11:45AM (#48914327)

      Way more then just the website.
      More info on http://www.net-security.org/se... [net-security.org]
      Not only the website, but "26,000 systems were found to be infected: email and share point servers, as well as the technical staff's workstations."
      Belgacom is the largest telecom operator and is also the largest ISP. I would guess almost all political individuals would at least use their phone system, but most likely also their internet.

    • Fox IT Has close ties with various governments that are known to run cyber spying operations and/or have questionable human rights records. I wouldn't trust those guys anywhere near my systems. Also one of the founders, Prins, is politically well connected and lobbies for far-ranging police powers, like letting the police break into private citizens' computers. These guys are Part Of The Problem.
  • by Virtucon ( 127420 ) on Tuesday January 27, 2015 @10:10AM (#48913513)

    Now our Malware/Virus software engineers are practicing reuse. Excellent development practice out there folks! Keep Reusing that code!

  • Actual Conspiracy (Score:4, Insightful)

    by Strangely Familiar ( 1071648 ) on Tuesday January 27, 2015 @10:11AM (#48913525) Homepage
    It would seem our governments are at minimum committing the crime of conspiracy to break into US (and UK, Aussie, etc) citizens computers, if they are helping out foreign governments. They may have made themeselves immune for their own actions, but I highly doubt that immunity extends to helping foreign governments break into your own citizens computers. I have not researched this though. Just thought some people with more knowledge might chime in. If it is not illegal, it really needs to be illegal.
    • Well the CFAA [wikipedia.org] gets used and abused quite a bit. I'm sure it's applicable here. The problem is proving who the perps are who wrote the stuff and catching them. Since you're implying the US government or some of its allies then let's suppose that you could provide evidence at trial that they actually wrote it and used it to hack your system. The simple response by government lawyers would be "national security" in which case they have a better than 90% chance of getting the judge to agree and your evidenc

    • by dcw3 ( 649211 )

      I was going to respond that while it may be "criminal", it's not a crime, but you got to that at the end.

    • by Anonymous Coward
      People everywhere in the world are trying to avoid buying U.S. products because of many kinds of secret U.S. government actions, not just surveillance.

      NSA = No Sales for Americans
      • by AHuxley ( 892839 )
        Re: "People everywhere in the world are trying to avoid buying"
        Nations will just revert to paper, number stations and one time pads. Couriers, cults, faith, background investigations that interview friends, generations of family, teachers in person.
        Other nations have systems and trusted staff to revert back to. Expecting junk computer networks to just keep producing real global intelligence was a wonderful boondoggle over decades.
        The "most advanced espionage malware platforms ever studied" would then
  • Real shocker (Score:5, Interesting)

    by X.25 ( 255792 ) on Tuesday January 27, 2015 @10:16AM (#48913563)

    And I thought it was IS/Russians/NKoreans/Aliens, because US and allies hold moral highground and would never initiate actions which they themselves consider to be acts of war, right?

    http://www.wsj.com/articles/SB... [wsj.com]

    After all, it's ok if they do it. It's only bad if terrorists, communists and perverts do it.

    Crying wolf and all that.

    • by SeaFox ( 739806 )

      After all, it's ok if they do it. It's only bad if terrorists, communists and perverts do it.

      Crying wolf and all that.

      I think you mean "pot calling kettle and all that".

  • by Anonymous Coward on Tuesday January 27, 2015 @10:20AM (#48913607)

    It's more likely they were spying on the Regin developers, stole their code, and modified it for their own purpose.

  • by gstoddart ( 321705 ) on Tuesday January 27, 2015 @10:21AM (#48913627) Homepage

    If we did it, it's cyberterrorism. If they do it, it's law enforcement.

    Assholes.

    These clowns are entirely willing to undermine the security of every computer on the planet to get their grubby fingers into everything.

    We need products which keep these guys out, and these guys need a serious beat down in the courts to limit what they can do. A few of them probably should be hung for treason.

    Morally, every black hat should be targeting these agencies to cause as much damage to them as possible -- because the damage they're doing to our freedoms is immeasurable.

    Thanks, America, for leading the charge in fucking up the planet.

    • by Anonymous Coward on Tuesday January 27, 2015 @10:44AM (#48913797)

      We won't be around for much longer.

      Politically, economically and socially deterioration is setting in. This must be like what it was in Rome's last days.

      I was hoping we'd go the way of Great Britain. When they stopped being the World power, the average UK citizen's standard of living went up.

      If we the US were to give up the Carter doctrine, pull out of the Middle East and every where else we have US troops guarding oil supplies, we'd have a much more peaceful planet - gas, OTOH, would go through the roof and our "way of life" of cheap gasoline and perpetual war would end. And unfortunately, too many Americans would rather be at perpetual war and terrorized than have more expensive gas for their pickup trucks and SUVs.

      tl;dr: we Americans are a very short sighted and stupid people.

    • Re: (Score:3, Interesting)

      by Anonymous Coward

      You're mad because all the software available to use is security swiss cheese, and there's nothing you can do about it. But your anger is misplaced. It should be directed at Linus and other "white hat" software developers who *could* write secure software but do not. Linux could be designed so that each app only has access to its own files, not complete user-level access. The kernel could be written in a safe language (a Rust-like language), where minor mistakes wouldn't let hackers take over the whole

    • by Anonymous Coward

      A few of them probably should be hung for treason.

      That may (or not) be a bit excessive, but it'd be hard to (legally) accomplish.

      Bring back tar and feathers, I say.

    • Thanks, America, for leading the charge in fucking up the planet.

      Slight misnomer there. England is leading the charge, the US just likes where they are going and stays in close step.

    • The peasants need to standup and say enough is enough.

    • If we did it, it's cyberterrorism. If they do it, it's law enforcement.

      Assholes.

      They are part of the government, you are an individual citizen. Do you somehow not see the difference? Is this a difficult point for you?

      When was the last time that you personally passed a zoning ordinance and fined people for not obeying it?
      When was the last time that you personally arrested and imprisoned someone after their appeal to your personal court failed?
      When was the last time that you imposed and collected taxes?
      Does any of this ring a bell?

      A few of them probably should be hung for treason.

      Until you can reliably discern the difference between t

  • by Anonymous Coward on Tuesday January 27, 2015 @10:28AM (#48913687)

    How long is it going to take before the American people get fed up with this. The NSA is obviously an out of control agency and has been for years. The people in charge need to start spending LONG prison sentences for their crimes against humanity. And before people start screaming "Think about the terrorists" remember that those in charge (both the NSA, FBI and others) have deliberately chosen to ignore gathered intell about actual terrorist threats (such as 911 and the Boston Marathon bombers). This should prove to everyone that the government considers their own citizens as more of a threat than foreign terrorists.

    • by kilfarsnar ( 561956 ) on Tuesday January 27, 2015 @11:01AM (#48913959)

      How long is it going to take before the American people get fed up with this. The NSA is obviously an out of control agency and has been for years. The people in charge need to start spending LONG prison sentences for their crimes against humanity. And before people start screaming "Think about the terrorists" remember that those in charge (both the NSA, FBI and others) have deliberately chosen to ignore gathered intell about actual terrorist threats (such as 911 and the Boston Marathon bombers). This should prove to everyone that the government considers their own citizens as more of a threat than foreign terrorists.

      Yeah, but most people don't see it that way. They may not like what the government is doing, but they still buy the terrorism angle. This type of thing isn't what gets people fed up enough to really do something. That comes with hunger or widespread violence, and we should all hope it doesn't get that bad.

    • by Anonymous Coward on Tuesday January 27, 2015 @12:01PM (#48914467)

      General Alexander lied to Congress, denied NSA was spying on millions of Americans, pretended the NSA didn't have the technical ability. Has he been punished? Has he been found in contempt of Congress?

      No, he retired, set up a private company which banks pay tens of millions of dollars for some vague service, and the CTO of the NSA is involved as a consultant. In other words this is some NSA front company most likely. Yet another way for NSA to escape legal bounds.

      Tempora, the UK's massive full-take surveillance system, that the NSA queries using its UK base to avoid any legal questions in the US. The one they use to spy on British politicians, press and activists with the help of GCHQ (aka traitors to their democracy). Has any GCHQ staff been prosecuted for that? Quite the opposite, their agents in the Lords are busy trying to amend bills to make it legal!

      So who exactly is going to punish the NSA? Because everyone of those politicians is in the database, and politicians who step out of line find their private lives leaked to the press.

      UKIP MPs are the being targetted now, with their phone calls over the years, leaked. Who records phone calls of people just in case they become political MPs, then selectively leaks the most embarrassing ones? GCHQ and NSA, that's who.

      So no good people will make their way up the political ladder and no fix is possible.

    • How long is it going to take before the American people get fed up with this.

      Their elected representatives are to blame. They don't put real pressure on them to clean up their act. And how could they? Considering what it takes to have a career in politics, surely the NSA has too much dirt on each of them. So they occasionally put on a show but that's the extent of it.

    • How long is it going to take before the American people get fed up with this. The NSA is obviously an out of control agency and has been for years. The people in charge need to start spending LONG prison sentences for their crimes against humanity. And before people start screaming "Think about the terrorists" remember that those in charge (both the NSA, FBI and others) have deliberately chosen to ignore gathered intell about actual terrorist threats (such as 911 and the Boston Marathon bombers). This should prove to everyone that the government considers their own citizens as more of a threat than foreign terrorists.

      Is this shown on the news? Have CNN spent a whole 2 days on it like they have a current blizzard of new york? or previously Inflategate? Nope So why whould the unwashed masses be upset if the fucking media is failing to report on it. It's not a blizzard, sports cheating or a plane crash so they are oblivious. We that read slashdot hear about stuff like this all the time. DEA cameras, NSA GCHQ etc. The greater "American people" do not. So they cannot be outraged over something that the media is not r

  • I am starting to smell bullshit here. When a reporter needs to make a scoop, all they seem to have to do is just say they pulled out a "Snowden document", and presto, a story. Especially if they feel they need to stir up some anti-American sentiment, which I'm sure some people or countries would love right about now.

    When I took journalism classes in college, anyone writing something and ascribing it to a document that cannot be proven; merely alleged... that would ensure I got an "F" for the coursework.

    • Exactly what are you angry about? The article under discussion is from Kaperski researchers who are describing a relation they discovered between two different strains of malware. One of the strains of malware happened to be mentioned in a der Spiegel article about a recent Snowden revelation, but that is it.

      So be precise: who is claiming something based on an unproven document? What is it that they are claiming? Where do they do that?

  • by Technician ( 215283 ) on Tuesday January 27, 2015 @10:47AM (#48913819)

    It is time ro return to the Write Protect Switch. Passwords are no longer effective in preventing firmware alterations by hostile organizations.

    For those old enough to remember them, changing a BIOS required an EPROM burner and UV eraser. Changing CMOS settings required setting the write protect jumper.

    Early infections were restricted to Write Enabled floppies, hard drives for machines with them, and everything else was write protected.

    It is time to return to write protected firmware requiring physical access to alter.

    Our complacency with remote management is showing the error of our ways as we are compromised.

    • For those old enough to remember them, changing a BIOS required an EPROM burner and UV eraser. Changing CMOS settings required setting the write protect jumper.

      Well, I had an IBM PC-1, and yes and no respectively.

      Clearing CMOS settings is still done with a jumper. I do wish that all flash BIOS devices had a write protect jumper, though, and it would cost little to add them.

      • Some clones not only has the reset/erase jumper, but also has a CMOS write enable. Without it, the CMOS settings could not be altered. Changing the hard drive was one of the few reasons for enabling a write.

    • Trust as in how do you know jumping through those hoops stops the NSA? Maybe the use the secret courts to require a backdoor, maybe they alter the chips themselves.

      The NSA etc needs a clear directive by the president and congress that this is not ok. As long as they get only a minor slap of do not do that again it will not stop.

      • by houghi ( 78078 )

        Minor slap? When did that happen? All I heard was that they were called a very, very naughty boy. A slap would be going in the right direction.

    • Yup. Changing a bios required physically taking the old one out and popping in a new eprom. At 17, I doubt the NSA cared less about my original IBM PC that came with a cassette tape drive (I couldn't afford single sided floppy drives until a little later..let alone a hard drive until I was 18.

    • by mlts ( 1038732 )

      The problem is that convenience got ahead of security. Until the hit on Sony, the biggest threat to companies was hardware failure. So, companies went with SAN installations that had RAID6, async replication via WAN, snapshots, multiple tiers, and deduplication. More backups needed? Add more drives, maybe a controller.

      Tape (and also optical, although optical has not kept up with the times when it comes to storage) became something considered a dinosaur.

      This model worked perfectly when the bad guys were

  • What a relief! So if I use Dvorak I'm safe, right?
    • I worked with a guy who brought one of those one day to the office. It was very funny couple of days watching him try and use that thing. Of course his retorts of "oh it's better!" "more efficient!" "easier to use!" all went by the wayside when he eventually threw it away.

"I may kid around about drugs, but really, I take them seriously." - Doctor Graper

Working...