Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Compare cell phone plans using Wirefly's innovative plan comparison tool ×
Government Security

How "Omnipotent" Hackers Tied To NSA Hid For 14 Years and Were Found At Last 115

Advocatus Diaboli writes The money and time required to develop the Equation Group malware, the technological breakthroughs the operation accomplished, and the interdictions performed against targets leave little doubt that the operation was sponsored by a nation-state with nearly unlimited resources to dedicate to the project. The countries that were and weren't targeted, the ties to Stuxnet and Flame, and the Grok artifact found inside the Equation Group keylogger strongly support the theory the NSA or a related US agency is the responsible party, but so far Kaspersky has declined to name a culprit. NSA officials didn't respond to an e-mail seeking comment for this story. What is safe to say is that the unearthing of the Equation Group is a seminal finding in the fields of computer and national security, as important, or possibly more so, than the revelations about Stuxnet.
This discussion has been archived. No new comments can be posted.

How "Omnipotent" Hackers Tied To NSA Hid For 14 Years and Were Found At Last

Comments Filter:
  • Us vs them (Score:5, Funny)

    by halivar ( 535827 ) <bfelgerNO@SPAMgmail.com> on Monday February 16, 2015 @05:23PM (#49069267)

    We hack Iran to prevent them from releasing a bomb.

    NK hacks us to prevent us from also releasing a bomb, IYKWIMAITYD.

  • Cover locations. (Score:5, Interesting)

    by Kaenneth ( 82978 ) on Monday February 16, 2015 @05:43PM (#49069391) Homepage Journal

    There is a building near Microsoft labeled "Affiliated Associations of America" which sounds shady as fuck.

    • by Anonymous Coward

      There is a building near Microsoft labeled "Affiliated Associations of America" which sounds shady as fuck.

      Yeah, they do employee health benefits which means, honestly they make NSA look like the young pioneers.

    • Re:Cover locations. (Score:5, Interesting)

      by irrational_design ( 1895848 ) on Monday February 16, 2015 @06:00PM (#49069489)
      Wow, I found an Affiliated Associations of America. If the following isn't the biggest piece of business jargon that doesn't say anything, I don't know what is.

      Welcome to the AAOA benefits website. Through a cooperative platform, we developed a benefit program to enhance the value of membership for your Membership Organization or Association. AAOA provides a turnkey member benefit solution that offers companies and their employees an opportunity to reduce the costs of doing business. Take advantage of our group purchasing power and receive full access to exclusive member discounts and pricing. Look around the site and let us know if you have any questions or would like to discuss membership. With AAOA, membership doesn't cost, it pays!
      • by Anonymous Coward

        It's just super meta. It sounds like they're a group that helps people start associations, and then connects them to each other, associating their associations and maybe letting them group-purchase tools to manage their memberships or something?

        • by St.Creed ( 853824 ) on Monday February 16, 2015 @07:56PM (#49070115)

          It's probably more a service for running associations.

          Suppose you're a grocery and you would like to implement a membership card. Now you have to deal with lost cards, signups, people wanting to know how many loyality points they have, decide how many points to give for which purchase, what to give as a reward for points spent, etc. etc.

          This type of company takes it all out of your hands, provides a pre-packaged membership club with set rewards, tiers, perks, whatever, and puts your brandname on top of the website, the loyalty card, and the brochures. The grocery probably pays a price per customer that's lower than when they would run it themselves, and the affiliate organisation has scale, so can run things cheaper while providing better service than a single company can do.

      • by Neo-Rio-101 ( 700494 ) on Tuesday February 17, 2015 @12:48AM (#49071509)

        The syndicated accumulated affiliated aggregated associated conglomerated corporated assembly union group organization society company of the United States of America

        *Pause for fanfare*

    • by Anonymous Coward

      And if you work with SQL, you can work in that building!

      http://www.glassdoor.com/Job/Affiliated-Associations-of-America-Kirkland-Jobs-EI_IE478643.0,34_IL.35,43_IC1150472.htm

      Apply now!

    • by ixidor ( 996844 )
      here in Charlotte, the large collection of building in the same plaza as Microsoft is the CIA building, but with no external markings as such.
    • Also, the 8 story, black glass building with the barbed wire fences and security guards labeled "Flower Shop."

  • by Anonymous Coward

    Mainly for which countries are not listed. Hmmm.

  • So a smart country would "target" itself since it recieved all the info anyway. This means that these findings aren't really there; just guesses.
    • The whole thing is just hype. Enormous time and money? Deployment aside, I could DEVELOP something like this BY MYSELF. Virtual file systems? I wrote one on Fuse on a whim, to intercept disk access calls and check against policy. Exploiting a kernel driver? Same as exploiting anything else; it's a zero-day malware. Hundreds of CNC servers? Vanilla botnet--a deployment issue. Detecting iPhones and doing weird shit? Yeah, I work in DevOps; I have a server that detects mobile phones and redirects th

      • You are under arrest. Please keep your hands off the keyboard. Do not move quickly.

        We will be at your door presently.

        Sincerely,

        Your Government

      • by rtb61 ( 674572 )

        However government agencies using inside knowledge of source code to create these attack tools and then being stupid enough to use them ie release them into the wild where organised crime can get hold of them, is not so new. It fact it is totally and utterly mind bogglingly stupid thing to do, how fucking myopically short sighted can those fuckwits be. Government need to bloody wake up to what is going on and create a huge level of separation between attack and defence elements of cyber security. In fact t

      • by raind ( 174356 )

        They are hiring in the desert, probably could use someone like you.

  • by invictusvoyd ( 3546069 ) on Monday February 16, 2015 @05:52PM (#49069453)
    Stephen Hawkings computer cannot be infected by a keylogger
  • by Anonymous Coward

    There's no such thing as "omnipotent" hackers, it's all a bunch of *#*$&@%$@!$#@!#{}@{}#@}#${[[

    NO CARRIER


    Would you like to play a game?

  • by stevedog ( 1867864 ) on Monday February 16, 2015 @06:03PM (#49069501)
    I'm not sure how I see that this is a good thing. I know it's fun to hate on the intelligence community (I've done it too), especially when we feel like our own rights have been infringed, but are we really saying that we are in favor of anything which hampers the West's ability to take clandestine actions against other states? After all the complaining we do about Congress and all the bureaucracy that comes along with anything usually related to government, we are then saying that absolutely every hostile action should be subject to the same oversight that produces exactly that molasses-like barrier to actual results?

    It is without question that, at times, the intelligence community must have overstepped its bounds, as any entity with that much power would on occasion. Maybe in their case that happens far more often than it should. But does that really mean they should have no real power at all?
    • by Kazoo the Clown ( 644526 ) on Monday February 16, 2015 @06:21PM (#49069637)
      So everyone should just leave their doors wide open so the cops never have to break a door down to nab a crook? Yeah, right. If the NSA can hack into our computers, the bad guys can too. The best way to improve cybersecurity is to fix all the exploitable holes they've been using. But instead of helping us to secure our systems they've left them vulnerable because they're too lazy to pound the pavement, get individual warrants and plant bugs. Having every computer system in the world remain vulnerable made their job easier, so they chose that route, which also made the bad guys efforts easier too. But hey, it's job security, eh?
      • Re: (Score:2, Insightful)

        by Anonymous Coward

        How do you know they don't have a warrant? It seems like using md5 and sha1 hashes to ensure they are only targeting specific individuals smells like somebody with very specific instructions and stiff repercussions. Otherwise it would be easier to grab a pile of people and sort them out later.

      • No, quite the opposite. At the same time, though, what would happen if every soldier's gun had a chip that required "command approval" before any member of a squad could start firing? Sure, individual soldiers kill the wrong people, and for the wrong reasons, all the time. Hopefully, though, most of the time it is for the right reasons. And regardless, to place such restrictions on them limits their ability to safely carry out their intended purpose to such a degree that it is a problem.

        The idea is that,
        • by Kazoo the Clown ( 644526 ) on Monday February 16, 2015 @07:01PM (#49069851)

          They are the intelligence community, not our national cybersecurity consulting firm, and they only ought to be notifying the public if the risk to national security involved in leaving the vulnerability open is greater than the risk to national security involved in losing the intelligence that could be gained from it.

          What you're saying is we HAVE NO national cybersecurity entity whose purpose is to protect our infrastructure from bad actors using exactly the kinds of methods and exploits we're seeing here. And given that, we have to rely on Kaspersky to do it for us. Not only is it then a good thing, it's long overdue.

        • by Anonymous Coward

          ... losing the intelligence that could be gained ...

          Essentially an argument that back-doors do more good than harm: 'Cold fjord', is that you?

          Like a politician, you're saying your policy solves the problems we cause. What about the harm caused by a back-door? You haven't answered the basic question about back-doors: Can China use all those back-doors too? Because back-doors are good, then China gaining intelligence must be good too. By the way, your answer doesn't count, only China's.

          Most intelligence is about intellectual property. That is, the stuff

          • I wasn't arguing that everyone should be happy about this. I would imagine that, if China found out about something like this, they would be quite upset. Similarly to how upset they would be when they found a spy in their government. That doesn't mean that our intelligence community shouldn't be trying to do exactly that and, presumably, vice versa (and, I would imagine, each is both trying and succeeding).

            To address your other point: I think that, if there is evidence that industrial espionage against t
        • "what would happen if every soldier's gun had a chip that required "command approval" before any member of a squad could start firing? Sure, individual soldiers kill the wrong people, and for the wrong reasons, all the time. Hopefully, though, most of the time it is for the right reasons. "

          What would happen if every computerized autonomous weapon system had a chip that required "command approval" before firing?

          There's no such a chip on soldiers' weapons for a twofold reason:
          * There's not enough man/computer

    • by nbauman ( 624611 ) on Monday February 16, 2015 @07:16PM (#49069943) Homepage Journal

      I think the intelligence community has done more harm than good more often than not.

      I think American foreign policy has done more harm than good to America more often than not.

      For example, look at the Iraq war. We destabilized that entire region of the middle east, and left it wide open for ISIS and other militant groups.

      We supported the other "color" revolutions which also deposed effective dictators who were finally out of power after we supported them for so long. In every case the hippie revolutionaries were quickly brushed aside and replaced by really tough guys.

      Same with Assad in Syria. When he loses control of a region, ISIS moves in. You notice that the U.S. has stopped calling for Assad to leave.

      • I think you make an argument worth making, but your argument is about the application of tools, not the tools themselves. If the military and/or intelligence communities are being told to achieve objectives (or are even internally setting objectives) that do more harm than good, then they should be redirected. Even so, just like the military shouldn't lose their guns or cops shouldn't lose the ability to arrest people if they are arresting the wrong people, the intelligence community should not lose the too
      • I think the intelligence community has done more harm than good more often than not.

        I think American foreign policy has done more harm than good to America more often than not.

        Throughout history, it has been the use of power which has undermined empires, and the threat of the use of power which makes them most effective. Wars are costly and can be unpredictable; they have almost always much more expensive than planned and almost always much less useful, except at certain very defined tasks. (Giving someone a temporary boost to poll numbers, uniting a country against a perceived threat, acting as a salve to respond to demand for war that leaders are afraid to turn down).

        There ar

        • by nbauman ( 624611 )

          What our intelligence services are doing is overthrowing brutal, efficient dictators who kept their country together and replacing them with brutal, inefficient armed gangs who are tearing their country apart.

          Saddam Hussain had one of the best education systems, and one of the best health care systems, in the mideast. They had a higher ratio of female college professors than we do in the US.

      • Confirmation bias. When intelligence succeeds, you never hear about it. ULTRA, probably the most successful intelligence operation ever, was kept secret for decades. Nobody knew what it was or how it had helped.

        You need to watch it talking about the color revolutions that way. Sounds like dog whistle racism to me. Just because Obama did it doesn't mean it was wrong. Nobody could have predicted this outcome.

        • by nbauman ( 624611 )

          The term "color revolution" has nothing to do with race. It refers to movements like the Orange Revolution in the Ukraine, the Rose Revolution in Georgia, the Purple Revolution in Iraq, the Cedar Revolution in Lebanon (not a color but it fits in the category), and the other revolutions of the Arab Spring.

          What they have in common is that most of them, like the Orange Revolution, got money, strategic advice, and other support from the U.S., through the International Republican Institute and the National Democ

    • It's a good thing because I appreciate knowing what kind of country I really live in. For most of my life I thought I lived in a country that wouldn't torture people. Later I learned that the CIA not only tortures people, they ship people to other countries so they can be tortured harder. That's one of many examples of the things they don't teach you in school that should nonetheless influence how you think and vote. I want to know the ugly truth about what's going on. It probably won't make me happy,

  • The headlne says different things than the text and the original article.

    The headline says that they "were found"... but they weren't.

    The headline that they are "tied to NSA"... but TFA says that "researchers stopped short of saying Equation Group was the handiwork of the NSA."

    • Read the headline which sounded interesting but the summary sounded like a completely different story.

    • Actually, I should modify my comment. The headline does say a different thing from the summary, but the actual article does in fact go on to give some reasonable evidence that connecting the group to the NSA. So, "tied to NSA" is an accurate summary, although with the caveat "tied to" is words that "stop short" of saying that it actually is the NSA.

    • by grcumb ( 781340 )

      The headline that they are "tied to NSA"... but TFA says that "researchers stopped short of saying Equation Group was the handiwork of the NSA."

      In fairness, by 'stopped short' they mean that the Kaspersky guys essentially said, 'We're not saying it's the NSA - we just can't imagine anyone else on the face of the earth who has the resources necessary to do this kind of thing.' So yes, the report was released with a nod in the direction of the NSA.

    • by blueg3 ( 192743 )

      The headline that they are "tied to NSA"... but TFA says that "researchers stopped short of saying Equation Group was the handiwork of the NSA."

      That's a clever turn of phrase. Kaspersky pointedly calls them out as NSA, but doesn't explicitly say "this is a group at NSA".

    • The headlne says different things than the text and the original article.

      The headline says that they "were found"... but they weren't.

      The headline that they are "tied to NSA"... but TFA says that "researchers stopped short of saying Equation Group was the handiwork of the NSA."

      Tell me something, when you find a hack of this magnitude, how quickly are you going to be willing to jump up and down screaming "they did it! they did it!"?

      "stopped short" is politically correct speak for we-know-who-not-to-fuck-with.

  • by Anonymous Coward
    I'm just going to mention that all these hacks are aimed at Windows machines. When you have a monoculture, you get the Irish potato famine.
    • Re: (Score:2, Informative)

      by Anonymous Coward

      RTFA. They point out that they don't have an example of actual Mac infections (they only have two for Windows over the last 15 years), but that they get regular communication from infected machines identifying as Mac OS. Kaspersky makes it clear that they believe Macs are also compromised as a result. Nothing is mentioned about Linux, but I'd be surprised if they don't have access there as well.

  • by Advocatus Diaboli ( 1627651 ) on Monday February 16, 2015 @06:14PM (#49069579)
    Ya.. another related post from engadget (http://www.engadget.com/2015/02/16/hard-drive-spyware/). "It's been known for a while that the NSA will intercept and bug equipment to spy on its soon-to-be owners, but the intellgency agency's techniques are apparently more clever than first thought. Security researchers at Kaspersky Lab have discovered apparently state-created spyware buried in the firmware of hard drives from big names like Seagate, Toshiba and Western Digital. When present, the code lets snoops collect data and map networks that would otherwise be inaccessible -- all they need to retrieve info is for an unwitting user to insert infected storage (such as a CD or USB drive) into an internet-connected PC. The malware also isn't sitting in regular storage, so you can't easily get rid of it or even detect it."
    • by Anonymous Coward

      What's scary is they aren't just hiding in the hard drives. They are actually rewriting the firmware of those drives, and carving out invisible partitions that that can't get formatted.

  • going to cut the US off from the Internet for a day (like they did to N. Korea) as punishment for all this?
    • by Tablizer ( 95088 )

      going to cut the US off from the Internet for a day (like they did to N. Korea) as punishment for all this [revelation]?

      Yes, they'll make us all use Comcast. Explains the merger.

  • "infected machines reporting to Equation Group command servers identified themselves as Macs, an indication that the group successfully compromised both iOS and OS X devices."

    What vectors did the malware exploit to load-and-excute on the targeted Windows, iOS and OS X devices? Please provide samples of the disassembled code.
  • Running MD5sum on Unregistered (with no carriage return) produces the hash 84b8026b3f5e6dcfb29e82e0b0b0f386

    The article used a lower-case u in unregistered, which produces a different hash.

    Still no luck on figuring out e6d290a03b70cfa5d4451da444bdea39
    My email address doesn't hash to it, so I guess I'm not being singled out.

  • Stupidity is defined as mere elected officials thinking they have real control of the organs of state security. It wasn't true in the Soviets, it isn't true in the US.
  • You can hate the NSA all you want, but I have to tip my cap at their utter genius.

    Beyond the technical similarities to the Stuxnet and Flame developers, Equation Group boasted the type of extraordinary engineering skill people have come to expect from a spy organization sponsored by the world's wealthiest nation. One of the Equation Group's malware platforms, for instance, rewrote the hard-drive firmware of infected computersâ"a never-before-seen engineering marvel that worked on 12 drive categories from manufacturers including Western Digital, Maxtor, Samsung, IBM, Micron, Toshiba, and Seagate.

    The malicious firmware created a secret storage vault that survived military-grade disk wiping and reformatting, making sensitive data stolen from victims available even after reformatting the drive and reinstalling the operating system. The firmware also provided programming interfaces that other code in Equation Group's sprawling malware library could access. Once a hard drive was compromised, the infection was impossible to detect or remove.

  • Thank you, National Security Agency, for doing such a truly brilliant job of damaging future prospects for the American computer hardware industry. Smart move to leave the torture to the CIA, no reason for geeks to get their hands dirty. You, along with the CIA, daily provide the rest of the world with evident of how deeply, incredibly stupid supposedly smart people can be when they don't mix with grown-ups. Congratulations!

Natural laws have no pity.

Working...