5 ms·
Equation Group Tools
- bediger4000 3y agoWhich APT is this?
- halJordan 3y agoEquation Group was discovered & named in 2015 by kaspersky due to their pervasive use of encryption, kaspersky identified them as actors related to the people who produced stuxnet and flame (which also implicates regin). They are G0020 in the mitre att&ck framework
- runnerup 3y agoNSA, part of USA government[0] 0: https://en.wikipedia.org/wiki/Equation_Group https://en.wikipedia.org/wiki/Equation_Group
- yding 3y agoShould go without saying to run these only in the most secure sandbox you can find?
- runnerup 3y agoAbsolutely. Though IIRC this leak is 6 years old and has already been reasonably well-studied by a lot of very smart people. I don't think any of these were technically even "zero-days", and I'd expect windows/linux to be patched against them now. Even at the time these wouldn't have been as severe as "only run on an air gapped computer and burn the computer afterwards". That type of technology wouldn't be part of a leak like this, but given the amount of undocumented opcodes in various silicon (processors, BMC, TPMs, etc) I wouldn't be surprised if it did exist.
- fullspectrumdev 3y agoA large amount of the leaked files are still poorly documented, particularly the nix stuff. The Eternal stuff for windows kind of captured everyone’s attention, but a LOT of the older Unix tools were ignored for the most part. There’s a lot of neat tricks to be learned by reversing them - even today.
- rig666 3y ago[flagged]
- mjfl 3y agosince these things seem to target individual applications - is this an argument that security through obscurity i.e. writing your own (shitty) servers and such has a security benefit?