5 ms·

NSA-linked Bvp47 Linux backdoor widely undetected for 10 years

35 points by thinkmassive 5y ago

phendrenad2 5y ago
Terminology nitpick: This isn't a backdoor. This is an APT. (Otherwise, we need a new term for "code with an intentional security hole", which isn't what's happening here).
- ncmncm 5y ago
  Agree, I looked and looked for anything that would make it a backdoor.
aborsy 5y ago
>> In the case of the Bvp47 Linux backdoor, Pangu Lab researchers say that it was used on targets in the telecom, military, higher-education, economic, and science sectors So basically NSA spies also on scientists and their research.
UltraViolence 5y ago
There's almost never an indication how the backdoor is installed. Is there an internet exploitable vulnerability in the TCP/IP stack? Most home routers these days have firewalls enabled and no amount of NSA technical wizardry is going to get past those.
- Wiseacre 5y ago
  Can't they have backdoors by design? For example, open source printers are not a thing because of the backdoors and security measures required in order to sell your printer on the market.
  - technerder 5y ago
    Out of curiosity, what backdoors are you referring to?
    - eth0up 5y ago
      Probably referring to tracking dots, eg: https://en.m.wikipedia.org/wiki/Machine_Identification_Code https://en.m.wikipedia.org/wiki/Machine_Identification_Code
- mhoad 5y ago
  I can’t tell if you’re being sarcastic with that second paragraph but obviously getting past extremely complicated firewalls is a pretty key skill set of a signals intelligence agency and the one that comes built into your home router isn’t going to provide any meaningful protection against a well resourced and persistent attacker
0cVlTeIATBs 5y ago
The press release: https://www.pangulab.cn/en/post/the_bvp47_a_top-tier_backdoor_of_us_nsa_equation_group/ https://www.pangulab.cn/en/post/the_bvp47_a_top-tier_backdoo... The report: https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_... This is an analysis of a file they obtained in 2013, which has elements that were revealed in the Shadow Brokers files. The list of victims is from those files, too, from 2017.
willyywt 5y ago
The title is ambiguious: "Bvp47 Linux backdoor" means "a virus called Bvp47 is a Linux backdoor", not "Linux has a backdoor which is named Bvp47" The "backdoor" is refered from the pangulab report[1] but I think it actually means "virus" in common sense. (Maybe security people speek different technical jargons than linux users?) [1] https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_...

35 points by thinkmassive 5y ago

Terminology nitpick: This isn't a backdoor. This is an APT. (Otherwise, we need a new term for "code with an intentional security hole", which isn't what's happening here).

ncmncm 5y ago
Agree, I looked and looked for anything that would make it a backdoor.

aborsy 5y ago

>> In the case of the Bvp47 Linux backdoor, Pangu Lab researchers say that it was used on targets in the telecom, military, higher-education, economic, and science sectors So basically NSA spies also on scientists and their research.

UltraViolence 5y ago

There's almost never an indication how the backdoor is installed. Is there an internet exploitable vulnerability in the TCP/IP stack? Most home routers these days have firewalls enabled and no amount of NSA technical wizardry is going to get past those.

Wiseacre 5y ago
Can't they have backdoors by design? For example, open source printers are not a thing because of the backdoors and security measures required in order to sell your printer on the market.
- technerder 5y ago
  Out of curiosity, what backdoors are you referring to?
  - eth0up 5y ago
    Probably referring to tracking dots, eg: https://en.m.wikipedia.org/wiki/Machine_Identification_Code https://en.m.wikipedia.org/wiki/Machine_Identification_Code
mhoad 5y ago
I can’t tell if you’re being sarcastic with that second paragraph but obviously getting past extremely complicated firewalls is a pretty key skill set of a signals intelligence agency and the one that comes built into your home router isn’t going to provide any meaningful protection against a well resourced and persistent attacker

0cVlTeIATBs 5y ago

The press release: https://www.pangulab.cn/en/post/the_bvp47_a_top-tier_backdoor_of_us_nsa_equation_group/ https://www.pangulab.cn/en/post/the_bvp47_a_top-tier_backdoo... The report: https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_... This is an analysis of a file they obtained in 2013, which has elements that were revealed in the Shadow Brokers files. The list of victims is from those files, too, from 2017.

willyywt 5y ago

The title is ambiguious: "Bvp47 Linux backdoor" means "a virus called Bvp47 is a Linux backdoor", not "Linux has a backdoor which is named Bvp47" The "backdoor" is refered from the pangulab report[1] but I think it actually means "virus" in common sense. (Maybe security people speek different technical jargons than linux users?) [1] https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_...