11 ms·

Regin: Top-tier espionage tool enables stealthy surveillance

167 points by r721 12y ago

Spearchucker 12y ago
Amazing how Symantec use this to push their software rather than providing even a clue to determining whether you're infected or not. Never miss an opportunity to cash in, I suppose.
- jmartinpetersen 12y ago
  The blog posting includes a link to their whitepaper, which has a couple of pages with "indicators of compromise".
- sandstrom 12y ago
  There are some details in the whitepaper. I don't think this post comes off as an attempt to make more money. Rather, I think it's applaudable that they release information on threats from governments (and not only traditional spyware/virus). Since this is (probably) built by a government, one can be certain that a government somewhere (presumably Western, given the infected countries) is upset about the release. And they didn't cave in to that, which is good.
  - ealexhudson 12y ago
    I would guess they didn't cave because no Government has registered their upset at this. If they did, it would be pretty clear which Government it was - making me think the Government in question has few levers to pull against Symantec.
    - sandstrom 12y ago
      A good point. They cannot force anything without revealing involvement, and after the details are published it's too late to try to influence.
    - billyhoffman 12y ago
      I disagree. Symantec is one of the few companies on the planet that has had to deal with this exact situation before: Stuxnet. By late 2010, Synametic had come to the conclusion that Stuxnet was most probably a joint US/Israeli malware project, designed to disrupt Iran's quest for a nuclear bomb. [1] Just try and imagine that the gravity of that moment. They had stumbled into an international covert action involving weapons of mass destruction. I mean the closest thing I can even compare this with is fiction (the "too many secrets"/"using the magic box" scene in the movie Sneakers). But this wasn't fiction, and Symantec researchers and management had to decide what to do. They could have just shut up and said nothing. After all they were a US company, forbidden by law to even to do business in Iran. But they didn't do that. Rightly or wrongly, they published their findings in a whitepaper and told the world about it. I think Synmantec has earned the benefit of the doubt when dealing with state sponsored malware. [1] http://www.wired.com/2011/07/how-digital-detectives-deciphered-stuxnet/all/ http://www.wired.com/2011/07/how-digital-detectives-decipher...
jmartinpetersen 12y ago
This is equally fascinating and terrifying. The infection vector is still unknown, and they haven't even been able to recover the 64 bit version. Neither China nor the USA is among the ten countries with most infections.
- final 12y ago
  Haven't been able or were persuaded not to.
- huhtenberg 12y ago
  The infection vector is most certainly dynamic and varies by case and with time. Just need a fresh zeroday to make target machine execute the dropper.
lifeisstillgood 12y ago
>>> Its capabilities and the level of resources behind Regin indicate that it is one of the main cyberespionage tools used by a nation state. Wow. Just wow. It should not surprise us, but I wonder what the reaction was when people first realised telephones could be and were being tapped?
- spacefight 12y ago
  >> It should not surprise us, but I wonder what the reaction was when people first realised telephones could be and were being tapped? Outrage?
- digi_owl 12y ago
  Hard to say, radio telegraphs were being sold as "secure" at one point.
  - erglkjahlkh 12y ago
    As are services like Whispersystems RedPhone... Why bother cracking RedPhone when you can just trigger something remotely on the completely unaccredited radio chip, or the SIM, or the OS platform itself. A modern phone does not have one operating system, but 3-4 and they all can - after you crack one - ask services freely from others. The whole architecture of cellphones is so broken that installing RedPhone and thinking someone with resources can't do anything about it is plain laughable. Yes, it drops casuals and non-targeted attacks. But targeted? Never.
- schoen 12y ago
  I remember enjoying this blog post on AT&T's amicus brief in the Olmstead case: https://www.eff.org/deeplinks/2007/08/how-ma-bell-fought-your-privacy-80-years-ago https://www.eff.org/deeplinks/2007/08/how-ma-bell-fought-you... The most awesome comment from AT&T was that "this telephone system offers a means of espionage to which general warrants and writs of assistance were the puniest instruments of tyranny and oppression".
  - lifeisstillgood 12y ago
vezzy-fnord 12y ago
On a less related note, beyond the shiny GUI layer, just how advanced is today's antivirus software anyway? Do they still primarily rely on signature detection? I know that modern systems also perform what's broadly titled "heuristic analysis", but I'm not sure what that specifically entails. Is there any form of system call tracing, sandboxing, file monitoring or what?
- philip1209 12y ago
  A lot of modern malware prevention focuses on monitoring network traffic. Rather than rely on a single machine to self-report its health, technologies monitor the main channel of infection and data transmission, which is communication with the internet. Examples: - FireEye - OpenDNS (where I work) - Palo Alto Networks - ZScalar Case in point - at OpenDNS, we can often identify signs of infection (e.g. communication with DGA domains) before pinpointing the particular malware involved.
- SCHiM 12y ago
  Heuristics look at what a process is doing. For example, a very simple heuristic rule may look like this: if a process does the following: Open another .exe file then Writes to that .exe file Close that .exe file Then it's a virus. Such 'rules' are then used by the detection engine of the anti-virus software, if a program triggers any of these rules it is often labeled as a 'generic' Trojan or virus. Often this tracking is achieved by 'hooking' syscalls of your operating system. But some anti-virus programs also employ emulation and/or sandboxing. Comodo is an example that does sandboxing. Recent developments in anti-virus are what's called 'host-based protection'. Instead of relying on blacklists, such as heuristics and signatures, a custom made 'profile'(whitelist) of the host is made which looks at which applications are installed and what they should be doing. For example: your browser should never attempts to start another process. If it does it means something is wrong. Such host based approaches can detect unknown threats/exploits as they happen. If your browser is exploited and tries to download and execute malware, the system will detect it because it was previously established that your browser has no business starting other applications.
- xorcist 12y ago
  Signature based antivirus, as in "after the fact"-heuristics, remains the most useful. Because, as advanced as the other methods may be, their usefulness remains limited by their public existence. Any malware writer checks their creations against VirusTotal and change it as long as anything flags.
mooneater 12y ago
Nice story. But this is HN: Now how do we ensure our servers are unaffected?
- throwawayaway 12y ago
  Looking at the PDF it appears that it's Windows specific.
  - rsync 12y ago
    Exactly. I read through the page twice trying to simply determine "is this interesting to me at all". No, it's not. As usual, you can thwart "nation state" malware by simply not running Windows. Wake me when there's malware for FreeBSD (seriously - it would change my world).
    - jmartinpetersen 12y ago
      I'm sorry, but this seems incredibly naive. Stuff like this, which is apparently used against designated targets, surfaces because Symantec and similar companies casts an incredibly wide net looking for odd stuff in the wild. Few does this at a large scale for Linux, and I guess nobody does it for FreeBSD. But just because noone has caught sophisticated malware from a nation state in the wild doesn't mean it isn't there. So even if the code doesn't apply to you, the determination this shows from the attacker, would if you have something to hide. Do you seriously expect the NSA (or their chinese counter parts) just to give up and go home if a target they are interested in happens to use something else than Windows?
      - rsync 12y ago
        No, no ... certainly running a non-windows OS does not protect you from the actual nation-state. But the takeaway here is how we should update our threat levels and paranoia levels as a result of this new knowledge. In this case, as usual, it appears to be "not much".
  - ReinhartHack 12y ago
natch 12y ago
[Edit: I missed the PDF whitepaper before writing this comment. It doesn't answer all my questions bit I'll give them credit for a really nice detailed whitepaper.] This article makes me very suspicious of Symantec. How long have they known about this, really? Are they just releasing this information now as a marketing reaction to recent discoveries by competing firms? The vaguely written timeline says in passive voice that Regin has been observed since 2008. By who? Why are we just hearing about it now? I wouldn't blame them for keeping some discoveries quiet for a while so they can do some stealth research, but the timing here really smells like they are being PR driven instead of being driven by doing what's best for the overall security community. What would inspire much more confidence would be a story of how this was discovered, and how the discovery and research played out, as we have seen for some other malware. Instead this looks like they have know about this for a long time, and now for reasons they aren't going to disclose, they have decided, or have been given permission, to reveal some of what they know.
- final 12y ago
  Well people are sending suspicious files to the AV vendors all the time, so Symantec may have found the backdoor a lot later and then found it existing in their DBs.
- throwawayaway 12y ago
  the link they have created to "Backdoor.Regin" points to this: http://www.symantec.com/security_response/writeup.jsp?docid=2013-121221-3645-99 http://www.symantec.com/security_response/writeup.jsp?docid=... which looks unrelated to the point of being incorrect. also quite strange that they say in the PDF it's a kernel mode driver, as my understanding is that windows 7 & co do not allow those to be installed if they are unsigned. EDIT: The pdf covers this later on: > The 64-bit version of Regin’s Stage 1 (wshnetc.dll) is no longer a kernel mode driver, as drivers under 64-bit Windows must be signed. Instead, Stage 1 is a user mode DLL loaded as a Winsock helper when the computer is starting up.
- nikcub 12y ago
  > Why are we just hearing about it now? Once malware is identified properly antivirus firms will usually go through their detection archives and pull out earlier hits. The reason why they don't see them sooner is because they get tends to hundreds of thousands of new threats each week and don't have time to go through each one. Mikko from F-Secure also reported on Twitter that they found Regin[0]. The same thing happen with Stuxnet, and just about every other malware - it is why these firms will keep and check the archives of new detected threats. As for your general suspicions, this is endemic with infosec since there is a natural conflict of interest where those doing the research and reporting on it are also selling solutions. If it makes you feel any less suspicious, the research departments within these antivirus firms are generally isolated from parts of the companies involved in sales and marketing. They are usually small teams that just go out and publish information on cool things they find - although there is often a race to be the first to dissect and publish the details of new malware (which is why you wouldn't sit on knowledge of a new threat). [0] https://twitter.com/mikko/status/536624310035939328 https://twitter.com/mikko/status/536624310035939328
MatthiasP 12y ago
The list of infected countries might tell us a thing about the attacker: Russia and Saudi Arabia at the top: classical US intelligence targets. Pakistan and Afghanistan: Likely anti-islamists effort. Austria, Belgium, Iran: Opec, IEAE, tons of EU-institutions - someone who wants better intel about the nuclear talks with Iran? Ireland, Mexico, India: Hard to find political reasons for those countries, but if you look at it economically: Ireland is the main hub for US companies into the EU, Mexico is a neighbouring country to the US, India: rival to China My totally far-fetched guess would be that this trojan comes from the NSA or the GCHQ, I don't see China caring that much about Saudi Arabia and AfPak.
- throwawayaway 12y ago
  the high percentage of telecoms and private individuals targetted is reminiscent of this: http://arstechnica.com/tech-policy/2013/11/uk-spies-continue-quantum-insert-attack-via-linkedin-slashdot-pages/ http://arstechnica.com/tech-policy/2013/11/uk-spies-continue...
- jacquesm 12y ago
  And a very fat finger points at the US/UK because if they were simply present in statistically normal quantities in the samples they would be amongst the largest of the groups encountered. The fact that they are not suggests a conscious decision not to target those countries, likely emanating from a law rather than from a desire. If this were done by China then the US would be represented strongly.
  - csandreasen 12y ago
    Likewise, if this were done by the US then China would be represented strongly... I'm at a loss to guess attribution behind this one.
    - api 12y ago
      Hmm... good point there. Could also be a private entity -- governments aren't the only ones out there doing this kind of thing. There's a lot of money to be made on commodities markets, for example.
tptacek 12y ago
and alternative encryption in the form of a variant of RC5, which isn’t commonly used RC5 is uncommon because it's a crappy old 1990s cipher. If its use is suggestive of anything, it's probably cryptographic incompetence.
- xnull2guest 12y ago
  Jack Appelbaum suggests that US sponsored cyberweapons tend to use RC6 (http://www.youtube.com/watch?v=b0w36GAyZIA&feature=youtu.be&t=43m30s http://www.youtube.com/watch?v=b0w36GAyZIA&feature=youtu.be&...) for whatever weight that adds to the case that this isn't the US.
  - tptacek 12y ago
    It's Jacob, not Jack. I'm really not sure how much credence I give crypto comments from Appelbaum. The idea doesn't make much sense: the NSA has access to tons of different ciphers; why would they use a patented commercial cipher nobody else uses? It's all the downside of COTS (a public target for cryptanalytic research and an idiosyncratic choice that makes it easier to attribute attacks to them) but none of the upside. With RC6 you don't even get good open source library support. But either way: RC5 and RC6 are very different things.
    - xnull2guest 12y ago
      > It's Jacob, not Jack. Whoops. Silly. Thanks. > I'm really not sure how much credence I give crypto comments from Appelbaum. In this case it isn't a crypto comment as much as it is a forensic one. His suggestion comes from experience working with and reversing US malware. We do know that some US malware samples did use RC6, but that's hardly enough to say with confidence that this is a ubiquitous choice for all US malware. My guess would be that it is not. > With RC6 you don't even get good open source library support. I'm not sure how worried they are about this.
      - tptacek 12y ago
        They should be, because popular open source implementations (really, any popular implementation --- it just happens that every popular crypto implementation is open source) provide deniability.
jonah 12y ago
How are these things named? Is "Regin" or "Stuxnet" a string somewhere? Do the researchers make the names up? (And, what do the creators think of the name their tool is given vs. what they called it.)
- AlyssaRowan 12y ago
  Yes, generally malware is named by the researchers who found it - often even if the creators obviously named it otherwise. I wouldn't be surprised if "Regin" was a reference to how the researchers found big chunks of it tucked away in the registry, or something like that. For example, there's a reference to the name "Myrtus" in Stuxnet, which was (I think) probably the name its creators gave it (and may point to its Israeli origin)?
- nikcub 12y ago
  Stuxnet: named for files .stub (where config was stored) and mrxnet.sys (main driver), by Microsoft Duqu: named for the "~DQ-" temporary files it created, by researchers in Hungary who found it and wrote report Flame: is from a routine called "InstallFlame", so the malware name is likely same between discoverers and writers. The naming convention is usually to find a unique identifier used in the malware. Portmanteau's are common. We often don't find out what the writers name was, although both Stuxnet and Flame were part of Operation Olympic Games[0] [0] http://en.wikipedia.org/wiki/Operation_Olympic_Games http://en.wikipedia.org/wiki/Operation_Olympic_Games
- jonah 12y ago
  From this The Intercept piece[0]: "In Nordic mythology, the name Regin is associated with a violent dwarf who is corrupted by greed. It is unclear how the Regin malware first got its name, but the name appeared for the first time on the VirusTotal website on March 9th 2011." Double meaning or coincidence? e.g. did the authors of this piece just google "Regin" and find out about this dwarf? [0] https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/ https://firstlook.org/theintercept/2014/11/24/secret-regin-m...
datashovel 12y ago
I think the thing that's most frightening here is that those who created this thing have had 6 years to iterate and improve on the design before being discovered, so what has been found may just be the tip of the iceberg.
tempodox 12y ago
That kind of information should be published by the CIA, FBI, NSA, ... themselves instead of destroying Democracy with their secret gag orders. “I'm not allowed to say that I'm not allowed to say anything”. Can it still get worse than it already is? Any random terrorist is more honorable than the Feds. At least they're not lying about being terrorists.
r721 12y ago
"As always, attribution is difficult with cases like this. Our belief is that this malware, for a change, isn't coming from Russia or China." https://www.f-secure.com/weblog/archives/00002766.html https://www.f-secure.com/weblog/archives/00002766.html "Securelist - Regin: Nation-state ownage of GSM networks" http://securelist.com/blog/research/67741/regin-nation-state-ownage-of-gsm-networks/ http://securelist.com/blog/research/67741/regin-nation-state...
rookonaut 12y ago
So... Symantec found this years ago. New version is out. Symantec is allowed to publish the "news"...
junto 12y ago
No five eyes in that list.

167 points by r721 12y ago

Amazing how Symantec use this to push their software rather than providing even a clue to determining whether you're infected or not. Never miss an opportunity to cash in, I suppose.

jmartinpetersen 12y ago
The blog posting includes a link to their whitepaper, which has a couple of pages with "indicators of compromise".
sandstrom 12y ago
There are some details in the whitepaper. I don't think this post comes off as an attempt to make more money. Rather, I think it's applaudable that they release information on threats from governments (and not only traditional spyware/virus). Since this is (probably) built by a government, one can be certain that a government somewhere (presumably Western, given the infected countries) is upset about the release. And they didn't cave in to that, which is good.
- ealexhudson 12y ago
  I would guess they didn't cave because no Government has registered their upset at this. If they did, it would be pretty clear which Government it was - making me think the Government in question has few levers to pull against Symantec.
  - sandstrom 12y ago
    A good point. They cannot force anything without revealing involvement, and after the details are published it's too late to try to influence.
  - billyhoffman 12y ago
    I disagree. Symantec is one of the few companies on the planet that has had to deal with this exact situation before: Stuxnet. By late 2010, Synametic had come to the conclusion that Stuxnet was most probably a joint US/Israeli malware project, designed to disrupt Iran's quest for a nuclear bomb. [1] Just try and imagine that the gravity of that moment. They had stumbled into an international covert action involving weapons of mass destruction. I mean the closest thing I can even compare this with is fiction (the "too many secrets"/"using the magic box" scene in the movie Sneakers). But this wasn't fiction, and Symantec researchers and management had to decide what to do. They could have just shut up and said nothing. After all they were a US company, forbidden by law to even to do business in Iran. But they didn't do that. Rightly or wrongly, they published their findings in a whitepaper and told the world about it. I think Synmantec has earned the benefit of the doubt when dealing with state sponsored malware. [1] http://www.wired.com/2011/07/how-digital-detectives-deciphered-stuxnet/all/ http://www.wired.com/2011/07/how-digital-detectives-decipher...

jmartinpetersen 12y ago

This is equally fascinating and terrifying. The infection vector is still unknown, and they haven't even been able to recover the 64 bit version. Neither China nor the USA is among the ten countries with most infections.

final 12y ago
Haven't been able or were persuaded not to.
huhtenberg 12y ago
The infection vector is most certainly dynamic and varies by case and with time. Just need a fresh zeroday to make target machine execute the dropper.

lifeisstillgood 12y ago

>>> Its capabilities and the level of resources behind Regin indicate that it is one of the main cyberespionage tools used by a nation state. Wow. Just wow. It should not surprise us, but I wonder what the reaction was when people first realised telephones could be and were being tapped?

spacefight 12y ago
>> It should not surprise us, but I wonder what the reaction was when people first realised telephones could be and were being tapped? Outrage?
digi_owl 12y ago
Hard to say, radio telegraphs were being sold as "secure" at one point.
- erglkjahlkh 12y ago
  As are services like Whispersystems RedPhone... Why bother cracking RedPhone when you can just trigger something remotely on the completely unaccredited radio chip, or the SIM, or the OS platform itself. A modern phone does not have one operating system, but 3-4 and they all can - after you crack one - ask services freely from others. The whole architecture of cellphones is so broken that installing RedPhone and thinking someone with resources can't do anything about it is plain laughable. Yes, it drops casuals and non-targeted attacks. But targeted? Never.
schoen 12y ago
I remember enjoying this blog post on AT&T's amicus brief in the Olmstead case: https://www.eff.org/deeplinks/2007/08/how-ma-bell-fought-your-privacy-80-years-ago https://www.eff.org/deeplinks/2007/08/how-ma-bell-fought-you... The most awesome comment from AT&T was that "this telephone system offers a means of espionage to which general warrants and writs of assistance were the puniest instruments of tyranny and oppression".
- lifeisstillgood 12y ago

vezzy-fnord 12y ago

On a less related note, beyond the shiny GUI layer, just how advanced is today's antivirus software anyway? Do they still primarily rely on signature detection? I know that modern systems also perform what's broadly titled "heuristic analysis", but I'm not sure what that specifically entails. Is there any form of system call tracing, sandboxing, file monitoring or what?

philip1209 12y ago
A lot of modern malware prevention focuses on monitoring network traffic. Rather than rely on a single machine to self-report its health, technologies monitor the main channel of infection and data transmission, which is communication with the internet. Examples: - FireEye - OpenDNS (where I work) - Palo Alto Networks - ZScalar Case in point - at OpenDNS, we can often identify signs of infection (e.g. communication with DGA domains) before pinpointing the particular malware involved.
SCHiM 12y ago
Heuristics look at what a process is doing. For example, a very simple heuristic rule may look like this: if a process does the following: Open another .exe file then Writes to that .exe file Close that .exe file Then it's a virus. Such 'rules' are then used by the detection engine of the anti-virus software, if a program triggers any of these rules it is often labeled as a 'generic' Trojan or virus. Often this tracking is achieved by 'hooking' syscalls of your operating system. But some anti-virus programs also employ emulation and/or sandboxing. Comodo is an example that does sandboxing. Recent developments in anti-virus are what's called 'host-based protection'. Instead of relying on blacklists, such as heuristics and signatures, a custom made 'profile'(whitelist) of the host is made which looks at which applications are installed and what they should be doing. For example: your browser should never attempts to start another process. If it does it means something is wrong. Such host based approaches can detect unknown threats/exploits as they happen. If your browser is exploited and tries to download and execute malware, the system will detect it because it was previously established that your browser has no business starting other applications.
xorcist 12y ago
Signature based antivirus, as in "after the fact"-heuristics, remains the most useful. Because, as advanced as the other methods may be, their usefulness remains limited by their public existence. Any malware writer checks their creations against VirusTotal and change it as long as anything flags.

mooneater 12y ago

Nice story. But this is HN: Now how do we ensure our servers are unaffected?

throwawayaway 12y ago
Looking at the PDF it appears that it's Windows specific.
- rsync 12y ago
  Exactly. I read through the page twice trying to simply determine "is this interesting to me at all". No, it's not. As usual, you can thwart "nation state" malware by simply not running Windows. Wake me when there's malware for FreeBSD (seriously - it would change my world).
  - jmartinpetersen 12y ago
    I'm sorry, but this seems incredibly naive. Stuff like this, which is apparently used against designated targets, surfaces because Symantec and similar companies casts an incredibly wide net looking for odd stuff in the wild. Few does this at a large scale for Linux, and I guess nobody does it for FreeBSD. But just because noone has caught sophisticated malware from a nation state in the wild doesn't mean it isn't there. So even if the code doesn't apply to you, the determination this shows from the attacker, would if you have something to hide. Do you seriously expect the NSA (or their chinese counter parts) just to give up and go home if a target they are interested in happens to use something else than Windows?
    - rsync 12y ago
      No, no ... certainly running a non-windows OS does not protect you from the actual nation-state. But the takeaway here is how we should update our threat levels and paranoia levels as a result of this new knowledge. In this case, as usual, it appears to be "not much".
- ReinhartHack 12y ago

natch 12y ago

[Edit: I missed the PDF whitepaper before writing this comment. It doesn't answer all my questions bit I'll give them credit for a really nice detailed whitepaper.] This article makes me very suspicious of Symantec. How long have they known about this, really? Are they just releasing this information now as a marketing reaction to recent discoveries by competing firms? The vaguely written timeline says in passive voice that Regin has been observed since 2008. By who? Why are we just hearing about it now? I wouldn't blame them for keeping some discoveries quiet for a while so they can do some stealth research, but the timing here really smells like they are being PR driven instead of being driven by doing what's best for the overall security community. What would inspire much more confidence would be a story of how this was discovered, and how the discovery and research played out, as we have seen for some other malware. Instead this looks like they have know about this for a long time, and now for reasons they aren't going to disclose, they have decided, or have been given permission, to reveal some of what they know.

final 12y ago
Well people are sending suspicious files to the AV vendors all the time, so Symantec may have found the backdoor a lot later and then found it existing in their DBs.
throwawayaway 12y ago
the link they have created to "Backdoor.Regin" points to this: http://www.symantec.com/security_response/writeup.jsp?docid=2013-121221-3645-99 http://www.symantec.com/security_response/writeup.jsp?docid=... which looks unrelated to the point of being incorrect. also quite strange that they say in the PDF it's a kernel mode driver, as my understanding is that windows 7 & co do not allow those to be installed if they are unsigned. EDIT: The pdf covers this later on: > The 64-bit version of Regin’s Stage 1 (wshnetc.dll) is no longer a kernel mode driver, as drivers under 64-bit Windows must be signed. Instead, Stage 1 is a user mode DLL loaded as a Winsock helper when the computer is starting up.
nikcub 12y ago
> Why are we just hearing about it now? Once malware is identified properly antivirus firms will usually go through their detection archives and pull out earlier hits. The reason why they don't see them sooner is because they get tends to hundreds of thousands of new threats each week and don't have time to go through each one. Mikko from F-Secure also reported on Twitter that they found Regin[0]. The same thing happen with Stuxnet, and just about every other malware - it is why these firms will keep and check the archives of new detected threats. As for your general suspicions, this is endemic with infosec since there is a natural conflict of interest where those doing the research and reporting on it are also selling solutions. If it makes you feel any less suspicious, the research departments within these antivirus firms are generally isolated from parts of the companies involved in sales and marketing. They are usually small teams that just go out and publish information on cool things they find - although there is often a race to be the first to dissect and publish the details of new malware (which is why you wouldn't sit on knowledge of a new threat). [0] https://twitter.com/mikko/status/536624310035939328 https://twitter.com/mikko/status/536624310035939328

MatthiasP 12y ago

The list of infected countries might tell us a thing about the attacker: Russia and Saudi Arabia at the top: classical US intelligence targets. Pakistan and Afghanistan: Likely anti-islamists effort. Austria, Belgium, Iran: Opec, IEAE, tons of EU-institutions - someone who wants better intel about the nuclear talks with Iran? Ireland, Mexico, India: Hard to find political reasons for those countries, but if you look at it economically: Ireland is the main hub for US companies into the EU, Mexico is a neighbouring country to the US, India: rival to China My totally far-fetched guess would be that this trojan comes from the NSA or the GCHQ, I don't see China caring that much about Saudi Arabia and AfPak.

throwawayaway 12y ago
the high percentage of telecoms and private individuals targetted is reminiscent of this: http://arstechnica.com/tech-policy/2013/11/uk-spies-continue-quantum-insert-attack-via-linkedin-slashdot-pages/ http://arstechnica.com/tech-policy/2013/11/uk-spies-continue...
jacquesm 12y ago
And a very fat finger points at the US/UK because if they were simply present in statistically normal quantities in the samples they would be amongst the largest of the groups encountered. The fact that they are not suggests a conscious decision not to target those countries, likely emanating from a law rather than from a desire. If this were done by China then the US would be represented strongly.
- csandreasen 12y ago
  Likewise, if this were done by the US then China would be represented strongly... I'm at a loss to guess attribution behind this one.
  - api 12y ago
    Hmm... good point there. Could also be a private entity -- governments aren't the only ones out there doing this kind of thing. There's a lot of money to be made on commodities markets, for example.

tptacek 12y ago

and alternative encryption in the form of a variant of RC5, which isn’t commonly used RC5 is uncommon because it's a crappy old 1990s cipher. If its use is suggestive of anything, it's probably cryptographic incompetence.

xnull2guest 12y ago
Jack Appelbaum suggests that US sponsored cyberweapons tend to use RC6 (http://www.youtube.com/watch?v=b0w36GAyZIA&feature=youtu.be&t=43m30s http://www.youtube.com/watch?v=b0w36GAyZIA&feature=youtu.be&...) for whatever weight that adds to the case that this isn't the US.
- tptacek 12y ago
  It's Jacob, not Jack. I'm really not sure how much credence I give crypto comments from Appelbaum. The idea doesn't make much sense: the NSA has access to tons of different ciphers; why would they use a patented commercial cipher nobody else uses? It's all the downside of COTS (a public target for cryptanalytic research and an idiosyncratic choice that makes it easier to attribute attacks to them) but none of the upside. With RC6 you don't even get good open source library support. But either way: RC5 and RC6 are very different things.
  - xnull2guest 12y ago
    > It's Jacob, not Jack. Whoops. Silly. Thanks. > I'm really not sure how much credence I give crypto comments from Appelbaum. In this case it isn't a crypto comment as much as it is a forensic one. His suggestion comes from experience working with and reversing US malware. We do know that some US malware samples did use RC6, but that's hardly enough to say with confidence that this is a ubiquitous choice for all US malware. My guess would be that it is not. > With RC6 you don't even get good open source library support. I'm not sure how worried they are about this.
    - tptacek 12y ago
      They should be, because popular open source implementations (really, any popular implementation --- it just happens that every popular crypto implementation is open source) provide deniability.

jonah 12y ago

How are these things named? Is "Regin" or "Stuxnet" a string somewhere? Do the researchers make the names up? (And, what do the creators think of the name their tool is given vs. what they called it.)

AlyssaRowan 12y ago
Yes, generally malware is named by the researchers who found it - often even if the creators obviously named it otherwise. I wouldn't be surprised if "Regin" was a reference to how the researchers found big chunks of it tucked away in the registry, or something like that. For example, there's a reference to the name "Myrtus" in Stuxnet, which was (I think) probably the name its creators gave it (and may point to its Israeli origin)?
nikcub 12y ago
Stuxnet: named for files .stub (where config was stored) and mrxnet.sys (main driver), by Microsoft Duqu: named for the "~DQ-" temporary files it created, by researchers in Hungary who found it and wrote report Flame: is from a routine called "InstallFlame", so the malware name is likely same between discoverers and writers. The naming convention is usually to find a unique identifier used in the malware. Portmanteau's are common. We often don't find out what the writers name was, although both Stuxnet and Flame were part of Operation Olympic Games[0] [0] http://en.wikipedia.org/wiki/Operation_Olympic_Games http://en.wikipedia.org/wiki/Operation_Olympic_Games
jonah 12y ago
From this The Intercept piece[0]: "In Nordic mythology, the name Regin is associated with a violent dwarf who is corrupted by greed. It is unclear how the Regin malware first got its name, but the name appeared for the first time on the VirusTotal website on March 9th 2011." Double meaning or coincidence? e.g. did the authors of this piece just google "Regin" and find out about this dwarf? [0] https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/ https://firstlook.org/theintercept/2014/11/24/secret-regin-m...

datashovel 12y ago

I think the thing that's most frightening here is that those who created this thing have had 6 years to iterate and improve on the design before being discovered, so what has been found may just be the tip of the iceberg.

tempodox 12y ago

That kind of information should be published by the CIA, FBI, NSA, ... themselves instead of destroying Democracy with their secret gag orders. “I'm not allowed to say that I'm not allowed to say anything”. Can it still get worse than it already is? Any random terrorist is more honorable than the Feds. At least they're not lying about being terrorists.

r721 12y ago

"As always, attribution is difficult with cases like this. Our belief is that this malware, for a change, isn't coming from Russia or China." https://www.f-secure.com/weblog/archives/00002766.html https://www.f-secure.com/weblog/archives/00002766.html "Securelist - Regin: Nation-state ownage of GSM networks" http://securelist.com/blog/research/67741/regin-nation-state-ownage-of-gsm-networks/ http://securelist.com/blog/research/67741/regin-nation-state...

rookonaut 12y ago

So... Symantec found this years ago. New version is out. Symantec is allowed to publish the "news"...

junto 12y ago

No five eyes in that list.