4 ms·

I had to look up "Equation Group". A couple of articles mention that various malware tied to Equation Group includes timestamps indicating programmers working 8

I had to look up "Equation Group". A couple of articles mention that various malware tied to Equation Group includes timestamps indicating programmers working 8-5, Mon to Fri, in Eastern US timezones. Anyone know of more info on why this would be left in? A simple oversight? False-flag propaganda? Where would I look for more information on fingerprinting binaries? I.e. perhaps identifying compiler and even build environment. Thanks!

MajesticHobo 10y ago
> Can we trust this information? The answer is: not fully, because the link timestamp can be altered by the developer in a way that’s not always possible to spot. However, certain indicators such as matching the year on the timestamp with the support of technology popular in that year leads us to believe that the timestamps were, at the very least, not wholly replaced. Looking at this from the other side, the easiest option for the developer is to wipe the timestamp completely, replacing it with zeroes. This was not found in the case of EquationDrug. https://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/ https://securelist.com/blog/research/69203/inside-the-equati...
tbihl 10y ago
Equation group is the advanced malware outfit that is suspected to be NSA. The name was given by the group at kaspersky who put the report together. A brief summary is found in the linked PDF [0]. False flag is possible, but it's not unreasonable to think that these were uncaught mistakes, just ones that have no functional effect. The Mandiant APT1 report shows a similar pattern of bread crumbs, though in that case they felt more intentional (ego flourishes) to me. As to your final question, that field is reverse engineering. If you're looking for tools, IDA Pro is a very powerful disassembler. [0] https://www.google.com/url?q=https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf&sa=U&ved=0ahUKEwjJ_fKglMXOAhXKPRQKHTUUCGcQFggLMAA&sig2=nB6eT90w4zN1LrmSDi5Xcg&usg=AFQjCNFLgaydKOFaXK37eYaafr-kMi6cRw https://www.google.com/url?q=https://securelist.com/files/20...

MajesticHobo 10y ago

> Can we trust this information? The answer is: not fully, because the link timestamp can be altered by the developer in a way that’s not always possible to spot. However, certain indicators such as matching the year on the timestamp with the support of technology popular in that year leads us to believe that the timestamps were, at the very least, not wholly replaced. Looking at this from the other side, the easiest option for the developer is to wipe the timestamp completely, replacing it with zeroes. This was not found in the case of EquationDrug. https://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/ https://securelist.com/blog/research/69203/inside-the-equati...

tbihl 10y ago

Equation group is the advanced malware outfit that is suspected to be NSA. The name was given by the group at kaspersky who put the report together. A brief summary is found in the linked PDF [0]. False flag is possible, but it's not unreasonable to think that these were uncaught mistakes, just ones that have no functional effect. The Mandiant APT1 report shows a similar pattern of bread crumbs, though in that case they felt more intentional (ego flourishes) to me. As to your final question, that field is reverse engineering. If you're looking for tools, IDA Pro is a very powerful disassembler. [0] https://www.google.com/url?q=https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf&sa=U&ved=0ahUKEwjJ_fKglMXOAhXKPRQKHTUUCGcQFggLMAA&sig2=nB6eT90w4zN1LrmSDi5Xcg&usg=AFQjCNFLgaydKOFaXK37eYaafr-kMi6cRw https://www.google.com/url?q=https://securelist.com/files/20...