23 ms·

Kaspersky believes it found new CIA malware

578 points by arkadiyt 6y ago

efnx 6y ago
So this was deployed in 2014 and we’re just connecting all the dots now? It really makes you wonder what’s being deployed at the moment. The fact that they can determine all this from some binary is amazing. Security researchers really are techno-archaeologists.
- mc32 6y ago
  I recall how when we had North Korean hacking activities and official attributions people would say, but how do we know it was them and how do we know the government isn’t making things up? But when someone accuses the US we never add any salt. Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting.
  - vbezhenar 6y ago
    One reason would be the capability. There's no doubt that there are US citizens able to produce complex software including malware. Same could be said about China or Russia. But when it comes to North Korea, I really have doubts about their IT competence. Sure, they probably have some good programmers able to create ordinary IT systems. But working on edge of current technologies - that's what I have my doubts about.
    - throwaway210222 6y ago
      Why exactly do you think no North Korean can make malware? Hell, I've seen malware from countries in Africa that lack food. These societies have a lot of kurtosis.
    - kevin_thibedeau 6y ago
      Their biggest trading partner uses them as an attack dog to do the things they don't want to be directly associated with. It isn't unreasonable that it was given to them.
      - kube-system 6y ago
        If they can get fighter jets, tanks, and missiles from China and Russia, certainly they can get some malware.
    - daniel-cussen 6y ago
      Well, by comparison, Iran is very competent at cyber but they keep getting their uranium centrifuges hacked. North Korea, on the other hand, already didn't get hacked, and built the bomb. They have a lot less money than South Korea, and their political system is...what it is...but I don't see any reason a North Korean can't study just as hard as a South Korean and achieve similar results. I think people confuse North Korea's suffering with weakness. I'll grant that there is a lot of hunger, but the mission from the beginning, of the guerrilla fighters who now run the country, was sovereignty at all costs. And I'd say purely in terms of sovereignty North Korea is doing remarkably well.
      - tgragnato 6y ago
        Iranian getting their centrifuges hacked probably has to do more with geography than cyber. Israel is a powerful ally. I would compare South Korea more to a US protected country than to an ally. Given the dynamics with China, the Asian region is "less controllable" than Persia.
    - tclancy 6y ago
      This may be helpful then: https://www.newyorker.com/magazine/2021/04/26/the-incredible-rise-of-north-koreas-hacking-army https://www.newyorker.com/magazine/2021/04/26/the-incredible...
  - pc86 6y ago
    It's human nature to give things that fit your preconceived notions and biases the benefit of the doubt over those that don't, even when you're aware of this effect. The best we can do is try to be cognizant of it and be really self-critical about our knee-jerk reactions.
    - measuring_tape 6y ago
      Assuming it was said by someone fin the USA, there's also utility in this framing. Remaining critical of your own government is pretty healthy for a democracy.
  - willcipriano 6y ago
    If I had to wager I'd always bet on the CIA lying, I don't see how anyone could come to another conclusion given their history.
    - Koshkin 6y ago
      I've come to a conclusion that, from the evolutionary standpoint, lying (and stealing) is one of the most important forms of the intelligent behavior. We see it in the animal world, so this unavoidably should be seen as such in the world of humans...
      - andy_ppp 6y ago
        Humans have the option of trying to be ethical as well and a lot of people would question if the CIA always behaves ethically.
        ectopod 6y ago
        Surely no-one believes the CIA always behaves ethically. Especially after the post-9/11 kidnap, torture and murder rampage. Perhaps you meant a lot of people question if the CIA ever behaves ethically.
        andy_ppp 6y ago
        I’m sure the people that work there think they are a thin line against the harm others would like to do to America. “The ends justify the means”.
        mandmandam 6y ago
        I would hope they're smarter than that, but apparently not many are.
      - kungito 6y ago
        Trying to take the optimal route in prisoners dilemma would make smart animals stop this behaviour
  - djbebs 6y ago
    I mean, given the amount of malware made by the CIA and NSA, is it really a stretch that this is just one more?
  - RedComet 6y ago
    Its probably because the US government is the single greatest force for evil in the world right now.
    - dcsommer 6y ago
      This kind of hyperbole is neither instructive nor accurate. What is the intended purpose of this comment?
      - RedComet 6y ago
        It is accurate and not hyperbole. But the point is to help that poster understand why someone would not question the claim.
        seppin 6y ago
        "I am the greatest cook in the world" is hyperbole, even if you believe it to be true. Please google the basic definitions of words before you use them.
      - reedjosh 6y ago
        I'm sure the intended purpose is to vent frustrations, but maybe also to make aware those who've turned their eye from the US's terrible tyrannical and oppressive nature at home and abroad in favor of tribal political trivialities. It's not an incorrect statement either. I'd put the US up there with China, Russia, Big Tech, and the UN for forces of evil in the world right now.
        kube-system 6y ago
        What does "force of evil" mean anyway? It seems like a subjective measurement based entirely on tribalism as a foundation.
        reedjosh 6y ago
        > What does "force of evil" mean anyway? Yes, subjective. But here's my belief and how I believe it applies. I believe evil is the abandonment of reason in any way. Instigation of force or coercion is an un-reason-able act no matter whether done by an individual or group of people. Currently the US is engaged in numerous instigative forceful and coercive acts. Further, much of what the US does would not be possible without people abandoning their own reasoning for the fallacy of authority. Here I do not mean appealing to authority, but instead `following orders` without consideration to one's own responsibility to also not instigate force/violence/coercion. We could go down the path listing instigative acts of the US, but I believe most reasonable people know that the US is engaged in a number of these acts and would prefer it wasn't.
  - aero-glide2 6y ago
    Yeah, and CNN saying Chinese or Russian hackers always
    - cyberlurker 6y ago
      Even if you think CNN is bad it still might be true.
      - deleted 6y ago
        [deleted]
      - jessaustin 6y ago
        Truly, a level of excellence to which all "news" organizations should aspire. "CNN" is a recursive acronym, modeled after "GNU".
        Banana699 6y ago
        what a galaxy brain joke
  - wait_a_minute 6y ago
    Because the entire goal is to promote skepticism about the USA while remaining as mum as possible on Russia and China. In the case of Russia, it’s not a secret that they try to disrupt and divide the states via internal conflicts so they can take over if we decline because of it. Here is just one example: https://www.wsj.com/articles/russian-backed-facebook-accounts-organized-events-on-all-sides-of-polarizing-issues-1509355801 https://www.wsj.com/articles/russian-backed-facebook-account... We also know that hundreds of thousands of foreign-sponsored accounts on Twitter, Reddit, Facebook, etc, have been banned over the years. (Please fact check by googling!)
    - ClumsyPilot 6y ago
      Eh, we are at a apoint where every self respecting political party has thousands of fake twitter accounts.
    - Lammy 6y ago
      Meanwhile all you people stoking nationalist fervor keep the global population of generally-well-meaning humans divided and hating each other instead of uniting into a whole that demands a better life for everyone. Please stop.
    - freeflight 6y ago
      > Here is just one example: Here's an example that in major parts contributed to a civil war going on to this day: The existence of a US military operation that manipulates social media trough sock-puppet accounts [0] was revealed around the same time Syrians were riled up to regime change trough.. social media [1]. Said social media presence kept announcing "Days of Rage" protests in Syria which initially no Syrian even showed up to. These operations predate anything noteworthy Russia did on the same front, as most of that only started in the wake of the Ukraine revolution, which also saw plenty of blatant US interference [2]. Back then Russia was diplomatically very vocal about how unprecedented the foreign interference in Ukraine was. What followed was St. Petersburg troll farms heavily targeting the US. > We also know that hundreds of thousands of foreign-sponsored accounts on Twitter, Reddit, Facebook, etc, have been banned over the years. (Please fact check by googling!) How many domestic sponsored accounts have been banned? Zero, which means that on US based social media these kind of outfits are fighting with a heavy home game advantage [3], yet in most of these places that never comes up, it's always "Look out for the Russian/Chinese propagandist!", just like you are doing here. Which usually ends up targeting skeptical people not wholeheartedly endorsing the "Good vs Evil" narrative and not any actual propagandists. [0] http://www.theguardian.com/technology/2011/mar/17/us-spy-operation-social-networks http://www.theguardian.com/technology/2011/mar/17/us-spy-ope... [1] https://www.france24.com/en/20110203-syria-democracy-protests-facebook-twitter-friday-prayers-egypt https://www.france24.com/en/20110203-syria-democracy-protest... [2] https://www.theguardian.com/world/2013/dec/15/john-mccain-ukraine-protests-support-just-cause https://www.theguardian.com/world/2013/dec/15/john-mccain-uk... [3] https://www.reddit.com/r/Blackout2015/comments/4ylml3/reddit_has_removed_their_blog_post_identifying/ https://www.reddit.com/r/Blackout2015/comments/4ylml3/reddit...
  - tck42 6y ago
    The Broadcom link in the posted tweet records [some of?] their reasoning. Things like very North America specific strings, activity happening M-F for certain things (compilation, etc), capability (access to zero days implying deep pockets to buy said zero days), and breadth of target, etc. That said - it ABSOLUTELY BOGGLES MY MIND that, if these are not leaked, but rather recovered from attempted attacks, how are _any_ valid timestamps and strings not randomized as part of the build process!? I'm not saying it refutes or confirms, I'm just wondering - how difficult is it to read an ELF | PE and remove / change those things, and if it's as easy as I'm thinking, why would you not do so? Or replace with preprocessor directives that you could setup to random values for production builds to use strings and timestamps that indicate some other entity? All of this seems straightforward to me, like, could do via shell scripting or python. Is there a valid reason to leave this stuff in? Are we seeing some low priority work that the TLA wants to leak to show that they're out there and capable?
    - cronix 6y ago
      > Or replace with preprocessor directives that you could setup to random values for production builds to use strings and timestamps that indicate some other entity? They do, except they're not random. Check out the CIA Vault 7 leaks from a few years ago. They purposefully leave trails that point to other countries including using foreign languages for variable names/comments. > “[D]esigned to allow for flexible and easy-to-use obfuscation” as “string obfuscation algorithms (especially those that are unique) are often used to link malware to a specific developer or development shop.” > The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion, — but there are other possibilities, such as hiding fake error messages. https://www.mintpressnews.com/wikileaks-reveals-marble-proof-cia-disguises-hacks-russian-chinese-arabic/226475/ https://www.mintpressnews.com/wikileaks-reveals-marble-proof...
      - tck42 6y ago
  - boomboomsubban 6y ago
    >But when someone accuses the US we never add any salt. Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting. This thread also isn't full of calls for sanctions against the US or talk of overthrowing the government. I don't actually doubt many of the reports claiming North Korea or whoever were behind some attack, I know they are likely engaging in such activities. I just don't think the evidence is convincing enough to use as a casus belli or similar reason to take our own malicious actions. I would take a similar stance with this CIA malware, but nobody here is calling for punishment based on it.
    - cyberlurker 6y ago
      Yea, I cautiously share this viewpoint. I don’t want a cyber "Remember the Maine! To hell with Spain!" event. https://en.m.wikipedia.org/wiki/USS_Maine_(1889) https://en.m.wikipedia.org/wiki/USS_Maine_(1889)
  - Jenk 6y ago
    Given the public image of North Korea is one of a time capsule from the 60s I think it's more a case that the North Korean effort is considered inadequate or incapable, whilst the US TLAs have virtually limitless resources.
  - at-fates-hands 6y ago
    Likewise, Kaspersky always seems to ferret out CIA activities quite frequently; but never seems to get the same kind of discoveries on his own countries hacking exploits and activities.
    - kirill5pol 6y ago
      I mean is this unexpected or even being argued here? This is the same case regardless of home country. Of course they would focus on CIA or NSA exploits
  - Groxx 6y ago
    Seems reasonable to assume that a government saying "it wasn't us" or "it was them" is a heavily politically-motivated statement, not a strictly technical one. Regardless of it being accurate or not - there are reasons to keep quiet even if there's conclusive proof. This is a case of a third party saying "we think it was probably X". You can't rule out other motivations here either, but there's a fair bit more room for it to be less politically motivated.
  - tehjoker 6y ago
    The existence of their insane levels of funding and well known history of coups, lies, dirty tricks, and mass murder makes it extremely easy to believe US intelligence is capable of deploying computer bullshit lol. Of course, if there is credible evidence exhonorating them we can look at that.
    - adrianN 6y ago
      There are plenty of other actors capable of "deploying computer bullshit". Why shouldn't one of them be the culprit here?
      - lawxls 6y ago
        Because this thread is about CIA malware?
  - tsimionescu 6y ago
    There's a difference between Microsoft or Google or Symantec coming out and saying 'this was NK malware' and the CIA or NSA or FBI saying 'this was NK malware' - people would be more inclined to believe the former rather then the later, even though we would still have to imagine that it's possible they are saying this because of CIA/FBI/NSA influence. Likewise, Kaspersky is more believable than if the FSB came out with this story, even if we must be cautious that it could be an FSB story.
  - deleted 6y ago
    [deleted]
  - acruns 6y ago
    we should consider the source and timing for sure.
  - throwawayfff 6y ago
    The last round of skeptics were skeptical of Russian hacking, and were shouted down for asking for more evidence then "experts agreed". They're either still around lurking or have just moved on. No one wants to post just to get down voted or shadow banned.
  - cowmoo728 6y ago
    Until a few years ago, I was skeptical that North Korea had the technical expertise to pull off some of the hacking that was being attributed to them. In the past 5+ years, however, it's become increasingly clear that they have a well funded and dedicated team of competent hackers. The NSA and CIA, on the hand, are always assumed to have some of the best hackers in the world. So when I read that some huge exploit with multiple complex 0-days chained together has been discovered, and it's being attributed to the USA and/or Israel, I usually assume that's true because very few other countries have the ability to pull it off.
    - mike_d 6y ago
      North Korean cyber capabilities were likely heavily thwarted for a long time by the fact that the United States could observe all the traffic entering and exiting the country. As a result they operate units completely overseas. North Korean students launch attacks from Indian Universities. They have networks of individuals that spend all day cashing out ATMs in Malta. The Chilbosan Hotel in Shenyang, China is a front used by the RGB as a forward base for cyber operations.
  - coliveira 6y ago
    The CIA was caught lying and cheating several times in official investigations. Can you imagine what they have done when nobody else is looking?
  - da_chicken 6y ago
    > Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting. It's not genuine skepticism. It's people on social media wanting Internet points for pointing something out. It's devil's advocates and "well akshully..." people just saying something to make a point. People don't do it on CIA stories because it's not honest skepticism in the first place. It's not fun when the sarcastic and cynical responses make you even more jaded about your own country. <--- Now, kindly do the needful, dear reader.
  - deleted 6y ago
    [deleted]
- germinalphrase 6y ago
  Hopefully - we never find out the extent of our (and their) capabilities.
- Dolores12 6y ago
  Now compare it to how fast US intelligence analysts are. They may conclude who is behind attack in a matter of days. (For example, recent solarwinds attack)
  - nzmsv 6y ago
    Conclusion prefetching is awesome, isn't it?
  - auiya 6y ago
    Correct, different campaign signatures can make attribution happen quickly, or slowly. Just depends what data the analyst has to work with.
- deleted 6y ago
  [deleted]
- sitzkrieg 6y ago
  and to think thats because they seemingly randomly decided to go back and re analyze this older stuff
  - bredren 6y ago
    >seemingly randomly decided
- dilyevsky 6y ago
  I’d say it’s likely they were instructed to sit on it until the time is right
  - sturza 6y ago
    Did you take occam’s razor into account? Why is this likely?
    - dilyevsky 6y ago
      The timing is very sus given recent and ongoing spy mania in eastern europe (if you’ve been following)
      - ddalex 6y ago
        The thing in EastEurope is not intelligence-based, its' political.
        dilyevsky 6y ago
        There’s a difference?
        ddalex 6y ago
        The difference is that there is no new informational knowledge coming out from the East Europe affair. It's just matching expulsion numbers, but none of the parties (or the general public) learned anything new (as with this disclosure).
    - smolder 6y ago
      Occam's razor hardly ever applies to stuff like this (news in the intelligence space) because deception is the whole game. A tendency to believe simpler explanations is something they exploit. I think Occam's razor is often misapplied in this way. It's for explaining natural phenomena, not for surmising the intent of an intelligent entity with an incentive to deceive.
- canada_dry 6y ago
  > determine all this from some binary Reminiscent of how cipher decoders knew their German operators well enough that it assisted in the decipher process.
- craig131 6y ago
  Using inductive reasoning, they're probably still deploying first-stage malware en mass that activates under certain network conditions. Truly scary stuff.
jimmyed 6y ago
Aside: Kaspersky is a Russian company.
- hctaw 6y ago
  Whose products are sanctioned against use in US government systems because of ties to Russian intelligence services. But you should take both these statements with a grain of salt when either side of the field stands to gain (or lose) something.
- kube-system 6y ago
  Not sure it's really meaningful to simply say they're a "Russian company". More specifically, they're a company that has been accused of cooperating with the FSB in attacks against the US government. https://en.wikipedia.org/wiki/Kaspersky_bans_and_allegations_of_Russian_government_ties https://en.wikipedia.org/wiki/Kaspersky_bans_and_allegations... Whatever the case, it's probably wise to take their statements with some skepticism of bias in this regard.
  - throwaway210222 6y ago
    Or: "they're a company that has been accused without evidence of cooperating with the FSB in attacks against the US government by US entities aligned to the US-based actors that they have exposed". FTFY.
    - kube-system 6y ago
      I used the word "accused" intentionally. My pointing out a potential bias here is not a diminishment of anyone else's potential bias.
    - viro 6y ago
      > without evidence of cooperating with the FSB That isn't true. This "without evidence" shit is rather silly when it comes to top-secret sources and methods. Blow decades of work and risk getting people killed to Prove that an ex-KGB officer helps an authoritative regime thats known to poison its enemies. People said the same shit about Huawei, then all the KPN shit. Link: https://www.bloomberg.com/news/articles/2017-07-11/kaspersky-lab-has-been-working-with-russian-intelligence https://www.bloomberg.com/news/articles/2017-07-11/kaspersky...
jmann99999 6y ago
I may have missed it in the article, but as a sysadmin, i’m trying to figure out what I should do. It appears the CIA has created malware. I assume, if they have exploited some hole, others will too. While I appreciate the heads up, Can anyone offer suggestions on how to mitigate this malware? What do I do? Do I have to rely on Kaspersky?
- wil421 6y ago
  > Kaspersky said that while it has not seen any of these samples in the wild, they believe Purple Lambert samples “were likely deployed in 2014 and possibly as late as 2015.” You don’t do anything because you are not the target. It’s never been seen in the wild.
- FpUser 6y ago
  If you want to be protected from the US made malware you do not go to US antimalware vendor. If you want to be protected against Russian malware you do not get antimalware from Russia. So pick your poison.
  - ronsor 6y ago
    Solution: Install US and Russian antiviruses simultaneously.
    - FpUser 6y ago
      Won't it led to an instant annihilation?
  - deleted 6y ago
    [deleted]
- barkingcat 6y ago
  Almost all government created malware uses 0days that they've kept back or held back from public disclosure, so there's nothing really you can do (aside from waiting for disclosure). That's the point of a CIA hack isn't it? If there's something you can do, then they've failed at their job, and it's time for hiring the next batch of developers (yes these are developers with a paid day job - to make malware for the CIA). In university, most computer science or computer engineering students had to make a choice whether to work for the country's security agencies and/or the military industries (via internships, being recruited, or just plain applying to government/pentagon/fbi/cia/nsa/csis jobs, etc), and that's their choice to make. From the government's point of view, it's no different than recruiting soldiers for the Army/Navy/Marines. If they couldn't train you to their standards for basic fitness and basic shooting skills, they've failed and you'd probably wash out from infantry school. The other thing you could do is to contribute to initiatives that do specific research into looking for vulnerabilities. It's no guarantee that you'll find the same vulnerabilities that the CIA is exploiting though, or you might find entirely other ones that they've been using for other exploits.
d33lio 6y ago
AV company known to have ties to russian intelligence flagpoles when it thinks it found traces of US intelligence... color me surprised...
Sunscratch 6y ago
"Kaspersky believes it found new CIA malware"... being itself russian FSB malware...
- Dolores12 6y ago
  Your comment makes no sense. If it were russian malware it would be outed by counterparts in a second. Still ZERO evidence, just FUD. I would also prefer to have FSB malware, just because their power is limited.
  - viro 6y ago
    Well they have been outed as working with the FSB. You know it randomly uploads files to be analyzed and those files have been found in the poccession of the FSB right?
athrowaway3z 6y ago
Any concrete info on the 'magic packet'?
- reedjosh 6y ago
  Yes, I would love to know what they were triggering on.
- j3th9n 6y ago
  You probably have to think of something like port knocking: https://en.wikipedia.org/wiki/Port_knocking https://en.wikipedia.org/wiki/Port_knocking
brummm 6y ago
I always wonder. The CIA/NSA must essentially target the big Amazon, google and microsoft clouds to get blanket access to everything running and stored there. Seems like a no brainer from their standpoint.
- sascha_sl 6y ago
  Or they just ask, which is essentially how prism already worked for user data.
  - reedjosh 6y ago
    Yeah, I highly doubt there's any targeting there. The big tech Co.s are practically fronts for the US Gov.
    - noir_lord 6y ago
      > Yeah, I highly doubt there's any targeting there. The big tech Co.s are practically fronts for the US Gov. https://en.wikipedia.org/wiki/War_Is_a_Racket https://en.wikipedia.org/wiki/War_Is_a_Racket (1935). History doesn't repeat but it does rhyme. It seems to be the natural state that centres of power co-operate with each other lest they lose their power. Churches with Kings, Corporations with Government.
  - boston_clone 6y ago
    Didn't some PRISM documents show that Google's internal use of TLS 1.2 was blocking a more widespread collection of data? I'll see if I can find the slide that articulated the issue.
    - caeril 6y ago
      That was part of it. The other part was "Do what we tell you, or you'll be Joe Nacchioed" In a 2013 interview, Marissa Meyer made it abundantly clear this is why Yahoo "voluntarily" joined PRISM. One can assume the rest were similarly influenced.
cyberlab 6y ago
> the malware samples appear to have been compiled seven years ago, in 2014 So it was possible then to analyze the metadata of the files and determine when the malware was made/compiled? That seems like bad OPSEC. If I was CIA I would be rigorous in modifying and faking when certain files were last modified or created, and possibly stripping other damaging metadata (if it's incriminating enough). This is basic metadata hygiene employed by journalists, whistleblowers etc
- asimpletune 6y ago
  I think it was based more on when the samples were found
  - cyberlab 6y ago
    Yet the samples retain their original creation date?
    - techrat 6y ago
      The year was given. Suppose it was found as early as 2014 on a device that had since been retired. That's one way to ballpark its creation year.
- hugh-avherald 6y ago
  Maybe it's less suspicious to have benign metadata than no metadata.
  - cyberlab 6y ago
    Yeah, which is why I suggest faking metadata than simply stripping it. There are anti-forensic tools for doing that.
    - surye 6y ago
      Honest question, how do we know that this wasn't faked? What makes the 2014 date more problematic, and what would it be faked to be?
Wassimo 6y ago
CIA, NSA, FBI, what else is new? Our society is doomed.
phendrenad2 6y ago
Is there a link to any actual posts or blog by Kaspersky on the matter? This seems to be missing from their official communications...
- hoppyhoppy2 6y ago
  The link is included in the article ("Kaspersky’s full description is below, from its <link>quarterly APT report</link> released today.") The linked article's url is https://securelist.com/apt-trends-report-q1-2021/101967/ https://securelist.com/apt-trends-report-q1-2021/101967/ , which is from a site called "SECURELIST by Kaspersky".
  - nvr219 6y ago
    That link says nothing about the CIA
gowld 6y ago
Interesting in light of the recent comments on HN that therecord.media is (partly) funded by the CIA.
- alert0 6y ago
  The author is one of the highest signal accounts I follow on Twitter. He seems to want to report on everything. [1] Also, relevant thread. [2] 1. https://twitter.com/campuscodi/status/1387026165597151234 https://twitter.com/campuscodi/status/1387026165597151234 2. https://twitter.com/riskybusiness/status/1387194016790323200 https://twitter.com/riskybusiness/status/1387194016790323200
bpolovko 6y ago
Why would I trust politicized Russian company about such thing? Few years ago it had a scandall where it was discovered that their own tools were injected with spi malware. https://careers.kaspersky.com/ https://careers.kaspersky.com/
squarefoot 6y ago
We're lucky that we can still catch some of them now. The current status of closed CPUs running proprietary firmware talking with closed chipsets running proprietary firmware blobs would make trivially easy to move the malware injection to the iron level for agencies funded by governments. Once they accomplish it, detecting their spyware using software, at any privilege level, will become impossible. I fear the scenario in which magic packets with a signature that turns off detection in network hardware (proprietary firmware) and interfaces (again, proprietary firmware) can directly instruct a system (proprietary firmware) unbeknownst to the user; it seems impossible today, however all it takes is having enough closed software and firmware so that a covert channel can be created from the CPU to the external world. Governments have enough funds and motivation to tell most network iron manufacturers to produce hardware according to some additional specifications.
- f430 6y ago
  not convinced. since its the CIA, I trust them they are doing it for a good cause.
  - trampi 6y ago
    you forgot /s
    - f430 6y ago
      not needed. if this was FSB or PSB then...
- 2OEH8eoCRo0 6y ago
  It's not impossible but it's complicated and the more complicated the harder to it is to keep secret. It's easier to just amass exploits for use when needed.
  - DyslexicAtheist 6y ago
    right, that's why there is no need for all the elaborate schemes proposed by the shameful Bloomberg "Big Hack" conspiracy. Doing so would be a) stupid and b) cost a bomb. for plausible deniability and to be able to reuse the same attack vector over and over, it's cheaper to just intercept shipments and install/modify what they need: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... impossible to reproduce unless you have the exact same equipment.
fouric 6y ago
Two weeks ago, the NSA accused the Russian SVR (intelligence agency) of exploiting vulnerabilities in US networks and suggesting that they were behind the SolarWinds compromise[1]. Now, Kaspersky (which is suspected to be affiliated with Russian intelligence - possibly unwillingly) claims to have found CIA malware (effectively "burning" it, if it's real). The timing does not seem to be a coincidence. Tit-for-tat? [1] https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2573391/russian-foreign-intelligence-service-exploiting-five-publicly-known-vulnerabili/ https://www.nsa.gov/News-Features/Feature-Stories/Article-Vi...
- stunt 6y ago
  But CIA developing malware isn't news to anyone. How is this a tit-for-tat then?
  - fallingknife 6y ago
    The tit-for-tat goes the other way: 1. expose malware the CIA doesn't want exposed 2. get accused by the CIA of being in bed with the Russians "working for the Russians" is the go to baseless political smear these days
    - sophacles 6y ago
      I would like to point out that a russian security company almost certainly has ties with the russian government. Particularly a very large, well respected one. It would be like accusing oracle or amazon of having ties with the US government.
      - varjag 6y ago
        Kaspersky himself is a 1987 KGB school alumni. The naïveté of Westerners is sometimes astonishing.
        caeril 6y ago
        This is a very good point, and stands in stark contrast with no management or employees of FireEye or CrowdStrike ever being associated with FVEY intelligence services. Nope, it's ONLY the evil Russians. The naïveté of non-Westerners is sometimes astonishing.
kureikain 6y ago
How do they release malware in to the wild? Inject some application? Run google ads and point traffic to these?
tdhz77 6y ago
I don’t have Rollback so I'm not able to comment.
deleted 6y ago
[deleted]
DevKoala 6y ago
Do we sanction and vilify ourselves now?
hilyen 6y ago
We need to end all secret gov agencies. They are out of control & happily stomping out liberties without discretion.
- INTPenis 6y ago
  Sure, as soon as we end all jealousy and suspicion in the human race. Glhf
  - jessaustin 6y ago
    Is there any reason to believe that unsupervised hidden criminals in the public employ have ever done anything to decrease or ameliorate "jealousy and suspicion"? To the contrary, one finds they have inspired massive amounts of both.
koonsolo 6y ago
I always wonder where EU fits into the malware scene. We already know which countries have these kind of espionage tools: US, Russia, China, North Korea, Israel. So is EU really that ethical to not engage in these kinds of moves? Or they are smart enough not to get discovered? Or somebody here will point out that I'm just not up to date?
- nargek 6y ago
  There was malware from EU, i know that France developed some of them[1]. -- [1] https://apt.thaicert.or.th/cgi-bin/showcard.cgi?g=Snowglobe%2C%20Animal%20Farm&n=1 https://apt.thaicert.or.th/cgi-bin/showcard.cgi?g=Snowglobe%...
- teichmann 6y ago
  In Germany there was the Staatstrojaner (Federal Trojan horse) case uncovered by the Chaos Computer Club: https://en.wikipedia.org/wiki/Chaos_Computer_Club#Staatstrojaner_affair https://en.wikipedia.org/wiki/Chaos_Computer_Club#Staatstroj...
- DyslexicAtheist 6y ago
  Europe's malware industry has mostly been legalised in the name of fighting (narco)terrorists and pedos: E.g. on this "legalized" end of the spectrum Netherlands, Italy, UK, Germany, Switzerland, France, all have _very_ active companies and strong talent pool for offsec skills and what is "legal malware" (Bundestrojaner varieties like Mini/Mega-Panzer, etc). ETSI in France works hard so that the term "malware" doesn't even enter language (instead it's middleboxes like eTLS or standards covering the framework of Lawful Interception). The countries listed have strong relation between offsec vendors and consultants and the IC. E.g. Kudelski Security in Geneve prides itself on breaking phones, supplying tooling and a lab to Europol. HackingTeam, Gamma International, EncroChat, Sky ECC, Vupen, ... = all European. The EU countries which have (some) talent but lack the jobs are often "painted as corrupt" backwaters where "everyone is a criminal[1]", usually cover the rest. [1] e.g. see this PR/FUD video produced by the ghouls at Norton pretending to be journalists: https://www.youtube.com/watch?v=un_XI4MM6QI https://www.youtube.com/watch?v=un_XI4MM6QI
__m 6y ago
Imagine the outrage if it was chinese maleware, HN comments would call for the boycott of china and political measures
- wraptile 6y ago
  American software has been under "boycott" since PRISM - it's kinda getting old. Additionally I feel that people are bit tired of USA's evilness and the results of it are not so apparent but we hear of chinese protesters disappearing every week.
icare_1er 6y ago
So, to summarize, according to Kaspersky, the West creates malware, and according to Mandiant, North Korea and Russia create malware. What a great discovery !!
peter_d_sherman 6y ago
>"While an initial analysis did not find any shared code with any previously-known malware samples, Kaspersky has recently re-analyzed the files and said it found that “the samples have intersections of coding patterns, style and techniques that have been seen in various Lambert families.” To the writers of these things: In the future, would you kindly NOT name your malware after terms in Physics: https://en.wikipedia.org/wiki/Lambert_(unit) https://en.wikipedia.org/wiki/Lambert_(unit)

578 points by arkadiyt 6y ago

efnx 6y ago

So this was deployed in 2014 and we’re just connecting all the dots now? It really makes you wonder what’s being deployed at the moment. The fact that they can determine all this from some binary is amazing. Security researchers really are techno-archaeologists.

mc32 6y ago
I recall how when we had North Korean hacking activities and official attributions people would say, but how do we know it was them and how do we know the government isn’t making things up? But when someone accuses the US we never add any salt. Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting.
- vbezhenar 6y ago
  One reason would be the capability. There's no doubt that there are US citizens able to produce complex software including malware. Same could be said about China or Russia. But when it comes to North Korea, I really have doubts about their IT competence. Sure, they probably have some good programmers able to create ordinary IT systems. But working on edge of current technologies - that's what I have my doubts about.
  - throwaway210222 6y ago
    Why exactly do you think no North Korean can make malware? Hell, I've seen malware from countries in Africa that lack food. These societies have a lot of kurtosis.
  - kevin_thibedeau 6y ago
    Their biggest trading partner uses them as an attack dog to do the things they don't want to be directly associated with. It isn't unreasonable that it was given to them.
    - kube-system 6y ago
      If they can get fighter jets, tanks, and missiles from China and Russia, certainly they can get some malware.
  - daniel-cussen 6y ago
    Well, by comparison, Iran is very competent at cyber but they keep getting their uranium centrifuges hacked. North Korea, on the other hand, already didn't get hacked, and built the bomb. They have a lot less money than South Korea, and their political system is...what it is...but I don't see any reason a North Korean can't study just as hard as a South Korean and achieve similar results. I think people confuse North Korea's suffering with weakness. I'll grant that there is a lot of hunger, but the mission from the beginning, of the guerrilla fighters who now run the country, was sovereignty at all costs. And I'd say purely in terms of sovereignty North Korea is doing remarkably well.
    - tgragnato 6y ago
      Iranian getting their centrifuges hacked probably has to do more with geography than cyber. Israel is a powerful ally. I would compare South Korea more to a US protected country than to an ally. Given the dynamics with China, the Asian region is "less controllable" than Persia.
  - tclancy 6y ago
    This may be helpful then: https://www.newyorker.com/magazine/2021/04/26/the-incredible-rise-of-north-koreas-hacking-army https://www.newyorker.com/magazine/2021/04/26/the-incredible...
- pc86 6y ago
  It's human nature to give things that fit your preconceived notions and biases the benefit of the doubt over those that don't, even when you're aware of this effect. The best we can do is try to be cognizant of it and be really self-critical about our knee-jerk reactions.
  - measuring_tape 6y ago
    Assuming it was said by someone fin the USA, there's also utility in this framing. Remaining critical of your own government is pretty healthy for a democracy.
- willcipriano 6y ago
  If I had to wager I'd always bet on the CIA lying, I don't see how anyone could come to another conclusion given their history.
  - Koshkin 6y ago
    I've come to a conclusion that, from the evolutionary standpoint, lying (and stealing) is one of the most important forms of the intelligent behavior. We see it in the animal world, so this unavoidably should be seen as such in the world of humans...
    - andy_ppp 6y ago
      Humans have the option of trying to be ethical as well and a lot of people would question if the CIA always behaves ethically.
      - ectopod 6y ago
        Surely no-one believes the CIA always behaves ethically. Especially after the post-9/11 kidnap, torture and murder rampage. Perhaps you meant a lot of people question if the CIA ever behaves ethically.
        andy_ppp 6y ago
        I’m sure the people that work there think they are a thin line against the harm others would like to do to America. “The ends justify the means”.
        mandmandam 6y ago
        I would hope they're smarter than that, but apparently not many are.
    - kungito 6y ago
      Trying to take the optimal route in prisoners dilemma would make smart animals stop this behaviour
- djbebs 6y ago
  I mean, given the amount of malware made by the CIA and NSA, is it really a stretch that this is just one more?
- RedComet 6y ago
  Its probably because the US government is the single greatest force for evil in the world right now.
  - dcsommer 6y ago
    This kind of hyperbole is neither instructive nor accurate. What is the intended purpose of this comment?
    - RedComet 6y ago
      It is accurate and not hyperbole. But the point is to help that poster understand why someone would not question the claim.
      - seppin 6y ago
        "I am the greatest cook in the world" is hyperbole, even if you believe it to be true. Please google the basic definitions of words before you use them.
    - reedjosh 6y ago
      I'm sure the intended purpose is to vent frustrations, but maybe also to make aware those who've turned their eye from the US's terrible tyrannical and oppressive nature at home and abroad in favor of tribal political trivialities. It's not an incorrect statement either. I'd put the US up there with China, Russia, Big Tech, and the UN for forces of evil in the world right now.
      - kube-system 6y ago
        What does "force of evil" mean anyway? It seems like a subjective measurement based entirely on tribalism as a foundation.
        reedjosh 6y ago
        > What does "force of evil" mean anyway? Yes, subjective. But here's my belief and how I believe it applies. I believe evil is the abandonment of reason in any way. Instigation of force or coercion is an un-reason-able act no matter whether done by an individual or group of people. Currently the US is engaged in numerous instigative forceful and coercive acts. Further, much of what the US does would not be possible without people abandoning their own reasoning for the fallacy of authority. Here I do not mean appealing to authority, but instead `following orders` without consideration to one's own responsibility to also not instigate force/violence/coercion. We could go down the path listing instigative acts of the US, but I believe most reasonable people know that the US is engaged in a number of these acts and would prefer it wasn't.
- aero-glide2 6y ago
  Yeah, and CNN saying Chinese or Russian hackers always
  - cyberlurker 6y ago
    Even if you think CNN is bad it still might be true.
    - deleted 6y ago
      [deleted]
    - jessaustin 6y ago
      Truly, a level of excellence to which all "news" organizations should aspire. "CNN" is a recursive acronym, modeled after "GNU".
      - Banana699 6y ago
        what a galaxy brain joke
- wait_a_minute 6y ago
  Because the entire goal is to promote skepticism about the USA while remaining as mum as possible on Russia and China. In the case of Russia, it’s not a secret that they try to disrupt and divide the states via internal conflicts so they can take over if we decline because of it. Here is just one example: https://www.wsj.com/articles/russian-backed-facebook-accounts-organized-events-on-all-sides-of-polarizing-issues-1509355801 https://www.wsj.com/articles/russian-backed-facebook-account... We also know that hundreds of thousands of foreign-sponsored accounts on Twitter, Reddit, Facebook, etc, have been banned over the years. (Please fact check by googling!)
  - ClumsyPilot 6y ago
    Eh, we are at a apoint where every self respecting political party has thousands of fake twitter accounts.
  - Lammy 6y ago
    Meanwhile all you people stoking nationalist fervor keep the global population of generally-well-meaning humans divided and hating each other instead of uniting into a whole that demands a better life for everyone. Please stop.
  - freeflight 6y ago
    > Here is just one example: Here's an example that in major parts contributed to a civil war going on to this day: The existence of a US military operation that manipulates social media trough sock-puppet accounts [0] was revealed around the same time Syrians were riled up to regime change trough.. social media [1]. Said social media presence kept announcing "Days of Rage" protests in Syria which initially no Syrian even showed up to. These operations predate anything noteworthy Russia did on the same front, as most of that only started in the wake of the Ukraine revolution, which also saw plenty of blatant US interference [2]. Back then Russia was diplomatically very vocal about how unprecedented the foreign interference in Ukraine was. What followed was St. Petersburg troll farms heavily targeting the US. > We also know that hundreds of thousands of foreign-sponsored accounts on Twitter, Reddit, Facebook, etc, have been banned over the years. (Please fact check by googling!) How many domestic sponsored accounts have been banned? Zero, which means that on US based social media these kind of outfits are fighting with a heavy home game advantage [3], yet in most of these places that never comes up, it's always "Look out for the Russian/Chinese propagandist!", just like you are doing here. Which usually ends up targeting skeptical people not wholeheartedly endorsing the "Good vs Evil" narrative and not any actual propagandists. [0] http://www.theguardian.com/technology/2011/mar/17/us-spy-operation-social-networks http://www.theguardian.com/technology/2011/mar/17/us-spy-ope... [1] https://www.france24.com/en/20110203-syria-democracy-protests-facebook-twitter-friday-prayers-egypt https://www.france24.com/en/20110203-syria-democracy-protest... [2] https://www.theguardian.com/world/2013/dec/15/john-mccain-ukraine-protests-support-just-cause https://www.theguardian.com/world/2013/dec/15/john-mccain-uk... [3] https://www.reddit.com/r/Blackout2015/comments/4ylml3/reddit_has_removed_their_blog_post_identifying/ https://www.reddit.com/r/Blackout2015/comments/4ylml3/reddit...
- tck42 6y ago
  The Broadcom link in the posted tweet records [some of?] their reasoning. Things like very North America specific strings, activity happening M-F for certain things (compilation, etc), capability (access to zero days implying deep pockets to buy said zero days), and breadth of target, etc. That said - it ABSOLUTELY BOGGLES MY MIND that, if these are not leaked, but rather recovered from attempted attacks, how are _any_ valid timestamps and strings not randomized as part of the build process!? I'm not saying it refutes or confirms, I'm just wondering - how difficult is it to read an ELF | PE and remove / change those things, and if it's as easy as I'm thinking, why would you not do so? Or replace with preprocessor directives that you could setup to random values for production builds to use strings and timestamps that indicate some other entity? All of this seems straightforward to me, like, could do via shell scripting or python. Is there a valid reason to leave this stuff in? Are we seeing some low priority work that the TLA wants to leak to show that they're out there and capable?
  - cronix 6y ago
    > Or replace with preprocessor directives that you could setup to random values for production builds to use strings and timestamps that indicate some other entity? They do, except they're not random. Check out the CIA Vault 7 leaks from a few years ago. They purposefully leave trails that point to other countries including using foreign languages for variable names/comments. > “[D]esigned to allow for flexible and easy-to-use obfuscation” as “string obfuscation algorithms (especially those that are unique) are often used to link malware to a specific developer or development shop.” > The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion, — but there are other possibilities, such as hiding fake error messages. https://www.mintpressnews.com/wikileaks-reveals-marble-proof-cia-disguises-hacks-russian-chinese-arabic/226475/ https://www.mintpressnews.com/wikileaks-reveals-marble-proof...
    - tck42 6y ago
- boomboomsubban 6y ago
  >But when someone accuses the US we never add any salt. Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting. This thread also isn't full of calls for sanctions against the US or talk of overthrowing the government. I don't actually doubt many of the reports claiming North Korea or whoever were behind some attack, I know they are likely engaging in such activities. I just don't think the evidence is convincing enough to use as a casus belli or similar reason to take our own malicious actions. I would take a similar stance with this CIA malware, but nobody here is calling for punishment based on it.
  - cyberlurker 6y ago
    Yea, I cautiously share this viewpoint. I don’t want a cyber "Remember the Maine! To hell with Spain!" event. https://en.m.wikipedia.org/wiki/USS_Maine_(1889) https://en.m.wikipedia.org/wiki/USS_Maine_(1889)
- Jenk 6y ago
  Given the public image of North Korea is one of a time capsule from the 60s I think it's more a case that the North Korean effort is considered inadequate or incapable, whilst the US TLAs have virtually limitless resources.
- at-fates-hands 6y ago
  Likewise, Kaspersky always seems to ferret out CIA activities quite frequently; but never seems to get the same kind of discoveries on his own countries hacking exploits and activities.
  - kirill5pol 6y ago
    I mean is this unexpected or even being argued here? This is the same case regardless of home country. Of course they would focus on CIA or NSA exploits
- Groxx 6y ago
  Seems reasonable to assume that a government saying "it wasn't us" or "it was them" is a heavily politically-motivated statement, not a strictly technical one. Regardless of it being accurate or not - there are reasons to keep quiet even if there's conclusive proof. This is a case of a third party saying "we think it was probably X". You can't rule out other motivations here either, but there's a fair bit more room for it to be less politically motivated.
- tehjoker 6y ago
  The existence of their insane levels of funding and well known history of coups, lies, dirty tricks, and mass murder makes it extremely easy to believe US intelligence is capable of deploying computer bullshit lol. Of course, if there is credible evidence exhonorating them we can look at that.
  - adrianN 6y ago
    There are plenty of other actors capable of "deploying computer bullshit". Why shouldn't one of them be the culprit here?
    - lawxls 6y ago
      Because this thread is about CIA malware?
- tsimionescu 6y ago
  There's a difference between Microsoft or Google or Symantec coming out and saying 'this was NK malware' and the CIA or NSA or FBI saying 'this was NK malware' - people would be more inclined to believe the former rather then the later, even though we would still have to imagine that it's possible they are saying this because of CIA/FBI/NSA influence. Likewise, Kaspersky is more believable than if the FSB came out with this story, even if we must be cautious that it could be an FSB story.
- deleted 6y ago
  [deleted]
- acruns 6y ago
  we should consider the source and timing for sure.
- throwawayfff 6y ago
  The last round of skeptics were skeptical of Russian hacking, and were shouted down for asking for more evidence then "experts agreed". They're either still around lurking or have just moved on. No one wants to post just to get down voted or shadow banned.
- cowmoo728 6y ago
  Until a few years ago, I was skeptical that North Korea had the technical expertise to pull off some of the hacking that was being attributed to them. In the past 5+ years, however, it's become increasingly clear that they have a well funded and dedicated team of competent hackers. The NSA and CIA, on the hand, are always assumed to have some of the best hackers in the world. So when I read that some huge exploit with multiple complex 0-days chained together has been discovered, and it's being attributed to the USA and/or Israel, I usually assume that's true because very few other countries have the ability to pull it off.
  - mike_d 6y ago
    North Korean cyber capabilities were likely heavily thwarted for a long time by the fact that the United States could observe all the traffic entering and exiting the country. As a result they operate units completely overseas. North Korean students launch attacks from Indian Universities. They have networks of individuals that spend all day cashing out ATMs in Malta. The Chilbosan Hotel in Shenyang, China is a front used by the RGB as a forward base for cyber operations.
- coliveira 6y ago
  The CIA was caught lying and cheating several times in official investigations. Can you imagine what they have done when nobody else is looking?
- da_chicken 6y ago
  > Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting. It's not genuine skepticism. It's people on social media wanting Internet points for pointing something out. It's devil's advocates and "well akshully..." people just saying something to make a point. People don't do it on CIA stories because it's not honest skepticism in the first place. It's not fun when the sarcastic and cynical responses make you even more jaded about your own country. <--- Now, kindly do the needful, dear reader.
- deleted 6y ago
  [deleted]
germinalphrase 6y ago
Hopefully - we never find out the extent of our (and their) capabilities.
Dolores12 6y ago
Now compare it to how fast US intelligence analysts are. They may conclude who is behind attack in a matter of days. (For example, recent solarwinds attack)
- nzmsv 6y ago
  Conclusion prefetching is awesome, isn't it?
- auiya 6y ago
  Correct, different campaign signatures can make attribution happen quickly, or slowly. Just depends what data the analyst has to work with.
deleted 6y ago
[deleted]
sitzkrieg 6y ago
and to think thats because they seemingly randomly decided to go back and re analyze this older stuff
- bredren 6y ago
  >seemingly randomly decided
dilyevsky 6y ago
I’d say it’s likely they were instructed to sit on it until the time is right
- sturza 6y ago
  Did you take occam’s razor into account? Why is this likely?
  - dilyevsky 6y ago
    The timing is very sus given recent and ongoing spy mania in eastern europe (if you’ve been following)
    - ddalex 6y ago
      The thing in EastEurope is not intelligence-based, its' political.
      - dilyevsky 6y ago
        There’s a difference?
        ddalex 6y ago
        The difference is that there is no new informational knowledge coming out from the East Europe affair. It's just matching expulsion numbers, but none of the parties (or the general public) learned anything new (as with this disclosure).
  - smolder 6y ago
    Occam's razor hardly ever applies to stuff like this (news in the intelligence space) because deception is the whole game. A tendency to believe simpler explanations is something they exploit. I think Occam's razor is often misapplied in this way. It's for explaining natural phenomena, not for surmising the intent of an intelligent entity with an incentive to deceive.
canada_dry 6y ago
> determine all this from some binary Reminiscent of how cipher decoders knew their German operators well enough that it assisted in the decipher process.
craig131 6y ago
Using inductive reasoning, they're probably still deploying first-stage malware en mass that activates under certain network conditions. Truly scary stuff.

jimmyed 6y ago

Aside: Kaspersky is a Russian company.

hctaw 6y ago
Whose products are sanctioned against use in US government systems because of ties to Russian intelligence services. But you should take both these statements with a grain of salt when either side of the field stands to gain (or lose) something.
kube-system 6y ago
Not sure it's really meaningful to simply say they're a "Russian company". More specifically, they're a company that has been accused of cooperating with the FSB in attacks against the US government. https://en.wikipedia.org/wiki/Kaspersky_bans_and_allegations_of_Russian_government_ties https://en.wikipedia.org/wiki/Kaspersky_bans_and_allegations... Whatever the case, it's probably wise to take their statements with some skepticism of bias in this regard.
- throwaway210222 6y ago
  Or: "they're a company that has been accused without evidence of cooperating with the FSB in attacks against the US government by US entities aligned to the US-based actors that they have exposed". FTFY.
  - kube-system 6y ago
    I used the word "accused" intentionally. My pointing out a potential bias here is not a diminishment of anyone else's potential bias.
  - viro 6y ago
    > without evidence of cooperating with the FSB That isn't true. This "without evidence" shit is rather silly when it comes to top-secret sources and methods. Blow decades of work and risk getting people killed to Prove that an ex-KGB officer helps an authoritative regime thats known to poison its enemies. People said the same shit about Huawei, then all the KPN shit. Link: https://www.bloomberg.com/news/articles/2017-07-11/kaspersky-lab-has-been-working-with-russian-intelligence https://www.bloomberg.com/news/articles/2017-07-11/kaspersky...

jmann99999 6y ago

I may have missed it in the article, but as a sysadmin, i’m trying to figure out what I should do. It appears the CIA has created malware. I assume, if they have exploited some hole, others will too. While I appreciate the heads up, Can anyone offer suggestions on how to mitigate this malware? What do I do? Do I have to rely on Kaspersky?

wil421 6y ago
> Kaspersky said that while it has not seen any of these samples in the wild, they believe Purple Lambert samples “were likely deployed in 2014 and possibly as late as 2015.” You don’t do anything because you are not the target. It’s never been seen in the wild.
FpUser 6y ago
If you want to be protected from the US made malware you do not go to US antimalware vendor. If you want to be protected against Russian malware you do not get antimalware from Russia. So pick your poison.
- ronsor 6y ago
  Solution: Install US and Russian antiviruses simultaneously.
  - FpUser 6y ago
    Won't it led to an instant annihilation?
- deleted 6y ago
  [deleted]
barkingcat 6y ago
Almost all government created malware uses 0days that they've kept back or held back from public disclosure, so there's nothing really you can do (aside from waiting for disclosure). That's the point of a CIA hack isn't it? If there's something you can do, then they've failed at their job, and it's time for hiring the next batch of developers (yes these are developers with a paid day job - to make malware for the CIA). In university, most computer science or computer engineering students had to make a choice whether to work for the country's security agencies and/or the military industries (via internships, being recruited, or just plain applying to government/pentagon/fbi/cia/nsa/csis jobs, etc), and that's their choice to make. From the government's point of view, it's no different than recruiting soldiers for the Army/Navy/Marines. If they couldn't train you to their standards for basic fitness and basic shooting skills, they've failed and you'd probably wash out from infantry school. The other thing you could do is to contribute to initiatives that do specific research into looking for vulnerabilities. It's no guarantee that you'll find the same vulnerabilities that the CIA is exploiting though, or you might find entirely other ones that they've been using for other exploits.

d33lio 6y ago

AV company known to have ties to russian intelligence flagpoles when it thinks it found traces of US intelligence... color me surprised...

Sunscratch 6y ago

"Kaspersky believes it found new CIA malware"... being itself russian FSB malware...

Dolores12 6y ago
Your comment makes no sense. If it were russian malware it would be outed by counterparts in a second. Still ZERO evidence, just FUD. I would also prefer to have FSB malware, just because their power is limited.
- viro 6y ago
  Well they have been outed as working with the FSB. You know it randomly uploads files to be analyzed and those files have been found in the poccession of the FSB right?

athrowaway3z 6y ago

Any concrete info on the 'magic packet'?

reedjosh 6y ago
Yes, I would love to know what they were triggering on.
j3th9n 6y ago
You probably have to think of something like port knocking: https://en.wikipedia.org/wiki/Port_knocking https://en.wikipedia.org/wiki/Port_knocking

brummm 6y ago

I always wonder. The CIA/NSA must essentially target the big Amazon, google and microsoft clouds to get blanket access to everything running and stored there. Seems like a no brainer from their standpoint.

sascha_sl 6y ago
Or they just ask, which is essentially how prism already worked for user data.
- reedjosh 6y ago
  Yeah, I highly doubt there's any targeting there. The big tech Co.s are practically fronts for the US Gov.
  - noir_lord 6y ago
    > Yeah, I highly doubt there's any targeting there. The big tech Co.s are practically fronts for the US Gov. https://en.wikipedia.org/wiki/War_Is_a_Racket https://en.wikipedia.org/wiki/War_Is_a_Racket (1935). History doesn't repeat but it does rhyme. It seems to be the natural state that centres of power co-operate with each other lest they lose their power. Churches with Kings, Corporations with Government.
- boston_clone 6y ago
  Didn't some PRISM documents show that Google's internal use of TLS 1.2 was blocking a more widespread collection of data? I'll see if I can find the slide that articulated the issue.
  - caeril 6y ago
    That was part of it. The other part was "Do what we tell you, or you'll be Joe Nacchioed" In a 2013 interview, Marissa Meyer made it abundantly clear this is why Yahoo "voluntarily" joined PRISM. One can assume the rest were similarly influenced.

cyberlab 6y ago

> the malware samples appear to have been compiled seven years ago, in 2014 So it was possible then to analyze the metadata of the files and determine when the malware was made/compiled? That seems like bad OPSEC. If I was CIA I would be rigorous in modifying and faking when certain files were last modified or created, and possibly stripping other damaging metadata (if it's incriminating enough). This is basic metadata hygiene employed by journalists, whistleblowers etc

asimpletune 6y ago
I think it was based more on when the samples were found
- cyberlab 6y ago
  Yet the samples retain their original creation date?
  - techrat 6y ago
    The year was given. Suppose it was found as early as 2014 on a device that had since been retired. That's one way to ballpark its creation year.
hugh-avherald 6y ago
Maybe it's less suspicious to have benign metadata than no metadata.
- cyberlab 6y ago
  Yeah, which is why I suggest faking metadata than simply stripping it. There are anti-forensic tools for doing that.
  - surye 6y ago
    Honest question, how do we know that this wasn't faked? What makes the 2014 date more problematic, and what would it be faked to be?

Wassimo 6y ago

CIA, NSA, FBI, what else is new? Our society is doomed.

phendrenad2 6y ago

Is there a link to any actual posts or blog by Kaspersky on the matter? This seems to be missing from their official communications...

hoppyhoppy2 6y ago
The link is included in the article ("Kaspersky’s full description is below, from its <link>quarterly APT report</link> released today.") The linked article's url is https://securelist.com/apt-trends-report-q1-2021/101967/ https://securelist.com/apt-trends-report-q1-2021/101967/ , which is from a site called "SECURELIST by Kaspersky".
- nvr219 6y ago
  That link says nothing about the CIA

gowld 6y ago

Interesting in light of the recent comments on HN that therecord.media is (partly) funded by the CIA.

alert0 6y ago
The author is one of the highest signal accounts I follow on Twitter. He seems to want to report on everything. [1] Also, relevant thread. [2] 1. https://twitter.com/campuscodi/status/1387026165597151234 https://twitter.com/campuscodi/status/1387026165597151234 2. https://twitter.com/riskybusiness/status/1387194016790323200 https://twitter.com/riskybusiness/status/1387194016790323200

bpolovko 6y ago

Why would I trust politicized Russian company about such thing? Few years ago it had a scandall where it was discovered that their own tools were injected with spi malware. https://careers.kaspersky.com/ https://careers.kaspersky.com/

squarefoot 6y ago

We're lucky that we can still catch some of them now. The current status of closed CPUs running proprietary firmware talking with closed chipsets running proprietary firmware blobs would make trivially easy to move the malware injection to the iron level for agencies funded by governments. Once they accomplish it, detecting their spyware using software, at any privilege level, will become impossible. I fear the scenario in which magic packets with a signature that turns off detection in network hardware (proprietary firmware) and interfaces (again, proprietary firmware) can directly instruct a system (proprietary firmware) unbeknownst to the user; it seems impossible today, however all it takes is having enough closed software and firmware so that a covert channel can be created from the CPU to the external world. Governments have enough funds and motivation to tell most network iron manufacturers to produce hardware according to some additional specifications.

f430 6y ago
not convinced. since its the CIA, I trust them they are doing it for a good cause.
- trampi 6y ago
  you forgot /s
  - f430 6y ago
    not needed. if this was FSB or PSB then...
2OEH8eoCRo0 6y ago
It's not impossible but it's complicated and the more complicated the harder to it is to keep secret. It's easier to just amass exploits for use when needed.
- DyslexicAtheist 6y ago
  right, that's why there is no need for all the elaborate schemes proposed by the shameful Bloomberg "Big Hack" conspiracy. Doing so would be a) stupid and b) cost a bomb. for plausible deniability and to be able to reuse the same attack vector over and over, it's cheaper to just intercept shipments and install/modify what they need: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... impossible to reproduce unless you have the exact same equipment.

fouric 6y ago

Two weeks ago, the NSA accused the Russian SVR (intelligence agency) of exploiting vulnerabilities in US networks and suggesting that they were behind the SolarWinds compromise[1]. Now, Kaspersky (which is suspected to be affiliated with Russian intelligence - possibly unwillingly) claims to have found CIA malware (effectively "burning" it, if it's real). The timing does not seem to be a coincidence. Tit-for-tat? [1] https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2573391/russian-foreign-intelligence-service-exploiting-five-publicly-known-vulnerabili/ https://www.nsa.gov/News-Features/Feature-Stories/Article-Vi...

stunt 6y ago
But CIA developing malware isn't news to anyone. How is this a tit-for-tat then?
- fallingknife 6y ago
  The tit-for-tat goes the other way: 1. expose malware the CIA doesn't want exposed 2. get accused by the CIA of being in bed with the Russians "working for the Russians" is the go to baseless political smear these days
  - sophacles 6y ago
    I would like to point out that a russian security company almost certainly has ties with the russian government. Particularly a very large, well respected one. It would be like accusing oracle or amazon of having ties with the US government.
    - varjag 6y ago
      Kaspersky himself is a 1987 KGB school alumni. The naïveté of Westerners is sometimes astonishing.
      - caeril 6y ago
        This is a very good point, and stands in stark contrast with no management or employees of FireEye or CrowdStrike ever being associated with FVEY intelligence services. Nope, it's ONLY the evil Russians. The naïveté of non-Westerners is sometimes astonishing.

kureikain 6y ago

How do they release malware in to the wild? Inject some application? Run google ads and point traffic to these?

tdhz77 6y ago

I don’t have Rollback so I'm not able to comment.

deleted 6y ago

[deleted]

DevKoala 6y ago

Do we sanction and vilify ourselves now?

hilyen 6y ago

We need to end all secret gov agencies. They are out of control & happily stomping out liberties without discretion.

INTPenis 6y ago
Sure, as soon as we end all jealousy and suspicion in the human race. Glhf
- jessaustin 6y ago
  Is there any reason to believe that unsupervised hidden criminals in the public employ have ever done anything to decrease or ameliorate "jealousy and suspicion"? To the contrary, one finds they have inspired massive amounts of both.

koonsolo 6y ago

I always wonder where EU fits into the malware scene. We already know which countries have these kind of espionage tools: US, Russia, China, North Korea, Israel. So is EU really that ethical to not engage in these kinds of moves? Or they are smart enough not to get discovered? Or somebody here will point out that I'm just not up to date?

nargek 6y ago
There was malware from EU, i know that France developed some of them[1]. -- [1] https://apt.thaicert.or.th/cgi-bin/showcard.cgi?g=Snowglobe%2C%20Animal%20Farm&n=1 https://apt.thaicert.or.th/cgi-bin/showcard.cgi?g=Snowglobe%...
teichmann 6y ago
In Germany there was the Staatstrojaner (Federal Trojan horse) case uncovered by the Chaos Computer Club: https://en.wikipedia.org/wiki/Chaos_Computer_Club#Staatstrojaner_affair https://en.wikipedia.org/wiki/Chaos_Computer_Club#Staatstroj...
DyslexicAtheist 6y ago
Europe's malware industry has mostly been legalised in the name of fighting (narco)terrorists and pedos: E.g. on this "legalized" end of the spectrum Netherlands, Italy, UK, Germany, Switzerland, France, all have _very_ active companies and strong talent pool for offsec skills and what is "legal malware" (Bundestrojaner varieties like Mini/Mega-Panzer, etc). ETSI in France works hard so that the term "malware" doesn't even enter language (instead it's middleboxes like eTLS or standards covering the framework of Lawful Interception). The countries listed have strong relation between offsec vendors and consultants and the IC. E.g. Kudelski Security in Geneve prides itself on breaking phones, supplying tooling and a lab to Europol. HackingTeam, Gamma International, EncroChat, Sky ECC, Vupen, ... = all European. The EU countries which have (some) talent but lack the jobs are often "painted as corrupt" backwaters where "everyone is a criminal[1]", usually cover the rest. [1] e.g. see this PR/FUD video produced by the ghouls at Norton pretending to be journalists: https://www.youtube.com/watch?v=un_XI4MM6QI https://www.youtube.com/watch?v=un_XI4MM6QI

__m 6y ago

Imagine the outrage if it was chinese maleware, HN comments would call for the boycott of china and political measures

wraptile 6y ago
American software has been under "boycott" since PRISM - it's kinda getting old. Additionally I feel that people are bit tired of USA's evilness and the results of it are not so apparent but we hear of chinese protesters disappearing every week.

icare_1er 6y ago

So, to summarize, according to Kaspersky, the West creates malware, and according to Mandiant, North Korea and Russia create malware. What a great discovery !!

peter_d_sherman 6y ago

>"While an initial analysis did not find any shared code with any previously-known malware samples, Kaspersky has recently re-analyzed the files and said it found that “the samples have intersections of coding patterns, style and techniques that have been seen in various Lambert families.” To the writers of these things: In the future, would you kindly NOT name your malware after terms in Physics: https://en.wikipedia.org/wiki/Lambert_(unit) https://en.wikipedia.org/wiki/Lambert_(unit)