4 ms·

It should be noted that it is only suspected that the Equation Group is related to the NSA. I only bring this up not because I don't think it is but rather to e

It should be noted that it is only suspected that the Equation Group is related to the NSA. I only bring this up not because I don't think it is but rather to emphasize that it has not been proven yet.

AnkhMorporkian 10y ago
If this leak is real, it points to one of two things. Either it isn't the NSA and is a company or some quasi-governmental group - owing to the fact that any of this shit the NSA makes would be on JWICS terminals and absolutely not accessible to the internet, or it means there's a leak from the NSA that dumped these files and has decided to sell them. I'd lean more towards the former.
- moyix 10y ago
  The command and control ("listening posts" in intelligence community parlance) for even NSA implants has to be on the public internet so the victims can phone home. This stuff could be from one of those servers.
  - stordoff 10y ago
    Is that necessarily true for NSA et al.? I don't see why the target couldn't just send the data towards an arbitrary destination, and that data be collected by NSA via a passive tap. Commands could be sent using a QUANTUM-style technique (packet injection with spoofed origin)
- jtsylve 10y ago
  Snowden did tweet what looked like an AES key last week.
  - matt_wulfeck 10y ago
    It was a sha2 (or rather, a 64-byte length hex string). I wondered myself if it wasn't the secret key to some encrypted file.
tedmiston 10y ago
For the curious, the Equation Group Wikipedia article has a section dedicated to Possible links to Stuxnet and the NSA: https://en.wikipedia.org/wiki/Equation_Group#Possible_links_to_Stuxnet_and_the_NSA https://en.wikipedia.org/wiki/Equation_Group#Possible_links_.... If nothing else, I found this compelling* > In addition, timestamps in the malware seem to indicate that the programmers worked overwhelmingly Monday–Friday in what would correspond to a 08:00–17:00 workday in an Eastern United States timezone. *assuming you trust the timestamps.

AnkhMorporkian 10y ago

If this leak is real, it points to one of two things. Either it isn't the NSA and is a company or some quasi-governmental group - owing to the fact that any of this shit the NSA makes would be on JWICS terminals and absolutely not accessible to the internet, or it means there's a leak from the NSA that dumped these files and has decided to sell them. I'd lean more towards the former.

moyix 10y ago
The command and control ("listening posts" in intelligence community parlance) for even NSA implants has to be on the public internet so the victims can phone home. This stuff could be from one of those servers.
- stordoff 10y ago
  Is that necessarily true for NSA et al.? I don't see why the target couldn't just send the data towards an arbitrary destination, and that data be collected by NSA via a passive tap. Commands could be sent using a QUANTUM-style technique (packet injection with spoofed origin)
jtsylve 10y ago
Snowden did tweet what looked like an AES key last week.
- matt_wulfeck 10y ago
  It was a sha2 (or rather, a 64-byte length hex string). I wondered myself if it wasn't the secret key to some encrypted file.

tedmiston 10y ago

For the curious, the Equation Group Wikipedia article has a section dedicated to Possible links to Stuxnet and the NSA: https://en.wikipedia.org/wiki/Equation_Group#Possible_links_to_Stuxnet_and_the_NSA https://en.wikipedia.org/wiki/Equation_Group#Possible_links_.... If nothing else, I found this compelling* > In addition, timestamps in the malware seem to indicate that the programmers worked overwhelmingly Monday–Friday in what would correspond to a 08:00–17:00 workday in an Eastern United States timezone. *assuming you trust the timestamps.