8 ms·

Secret Malware in EU Attack Linked to US and British Intelligence

147 points by FredericJ 12y ago

justcommenting 12y ago
re-posting AlyssaRowan's comment (https://news.ycombinator.com/item?id=8653692 https://news.ycombinator.com/item?id=8653692) here: "Got more payload chunks. Wow, they were sloppy with this - found plenty of symbol references still in them! So far, that makes references to LEGSPIN, WILLISCHECK, HOPSCOTCH, STARBUCKS, FOGGYBOTTOM, SALVAGERABBIT. I believe this may be NSA's UNITEDRAKE implant architecture, specifically."
- waterlesscloud 12y ago
  FOGGYBOTTOM is so particularly US Govt that it almost feels like misdirection. Or a programmer mad he has to do the task. Heh. ("Foggy Bottom" is an oblique reference to the US State Dept, after the DC district where it's located)
  - mikecb 12y ago
    Also the location of the Office of Strategic Services, the WWII precursor to CIA.
iresa 12y ago
So the UK attacked Ireland. Nice one.
- jh888 12y ago
  It's nothing new: http://www.theguardian.com/uk/2000/may/31/northernireland.richardnortontaylor http://www.theguardian.com/uk/2000/may/31/northernireland.ri... (2000) I'm sure all they learned about politicians/activitists and their family helped in the "negotiations" on Northern Ireland and other matters.
- AlyssaRowan 12y ago
  It's no surprise at all the UK has intelligence targets in Ireland: go read up on The Troubles. (I walked right past a live IRA bomb as a child. Spent half an hour longer shopping, and maybe I wouldn't be typing this.) Of course, that situation just isn't today what it used to be. As for the US, a lot of corps have operations and/or headquarters in Ireland for tax reasons. For example you might recall a story about Microsoft, the FBI, and email.
- anigbrowl 12y ago
  Given the centuries-long political problems between the two nations, what else would you expect? Ireland has an intelligence agency too which I'm sure does its share of covert information-gathering (at least I hope so, or it wouldn't be much good): http://en.wikipedia.org/wiki/Directorate_of_Intelligence_%28Ireland%29 http://en.wikipedia.org/wiki/Directorate_of_Intelligence_%28...
  - rmc 12y ago
    The IRA (et al.) do attack the Irish State, since they don't recognise it (e.g. https://en.wikipedia.org/wiki/Death_of_Jerry_McCabe https://en.wikipedia.org/wiki/Death_of_Jerry_McCabe ). However the UK police force & intelligence agency is much more advanced by the Irish one.
    - anigbrowl 12y ago
      I know. I'm from Limerick although I live in the USA now.
      - rmc 12y ago
        Shit, sorry
        anigbrowl 12y ago
        No worries ;)
deleted 12y ago
[deleted]
guiambros 12y ago
Oh snap! "The archive also contains the output of ProcMon, Process Monitor, a system monitoring tool distributed by Microsoft and commonly used in forensics and intrusion analysis. This file identifies the infected system and provides a variety of interesting information about the network. For instance: USERDNSDOMAIN=BGC.NET USERDOMAIN=BELGACOM USERNAME=id051897a USERPROFILE=C:\Users\id051897a" Also love the comment at the end: "Below is a list of hashes for the files The Intercept is making available for download. Given that that it has been over a year since the Belgacom operation was publicly outed, The Intercept considers it likely that the GCHQ/NSA has REPLACED THEIR TOOLKIT AND NO CURRENT OPERATIONS WILL BE AFFECTED by the publication of these samples."
- rasz_pl 12y ago
  oh snap what? This is a file uploaded by BELGACOM admin to VirusTotal database. It is NOT a file NSA published somewhere. Currently we only know this malware was used in belgacom hack, there is still no proof it is nsa code.
  - guiambros 12y ago
    Do you really have any doubt about who's behind this? We can debate about motivations and who their target really was (Belgacom may have been collateral damage), but despite "proof", there's little doubt about who wrote it.
    - rasz_pl 12y ago
      Yes, just like FBI assassinating Kennedy because Oh snap cuba! You act like its some sort of proof, like this totalvirus upload came from Langley IP.
      - guiambros 12y ago
        I simply pointed out that the person who uploaded to virustotal certainly didn't realize it also had Belgacom domain name, username, and a list of all the processes running on the machine. > Yes, just like FBI assassinating Kennedy because Oh snap cuba! I have no doubt where this came from, despite not having Gen. Keith Alexander's email in the logs.
lazaroclapp 12y ago
Interesting. What I don't get from this analysis or the one by Symantec is how this rootkit is able to install kernel drivers on 64-bit Windows with driver signing enabled. Is this using a new vulnerability to do so? An existing one? Did the GCHQ/NSA managed to get their hands on the keys necessary to sign Windows drivers? Each scenario has implications for code signing as a security technique...
- dmix 12y ago
  With DUQU and Stuxnet, the agencies had stolen the signing cert from Taiwanese businesses. Duqu = stolen from https://en.wikipedia.org/wiki/C-Media https://en.wikipedia.org/wiki/C-Media Stuxnet = stolen from https://en.wikipedia.org/wiki/Realtek https://en.wikipedia.org/wiki/Realtek Not hard to find a valid cert when you're a nation state. Source: https://firstlook.org/theintercept/2014/11/12/stuxnet/ https://firstlook.org/theintercept/2014/11/12/stuxnet/
  - nullc 12y ago
    "stolen"
    - dmix 12y ago
      Are you suggesting they were acquired by other means?
- iresa 12y ago
  It's well established that there are links between the most important IT companies and the gov't. Why the surprise?
- throwawayaway 12y ago
  > Symantec is how this rootkit is able to install kernel drivers on 64-bit Windows with driver signing enabled. if you read the symantec pdf whitepaper, that is only how the 32 bit one works, the 64bit one works differently - something to do with winsock.
munin 12y ago
it would be really good if the people reverse engineering malicious software knew how computers worked: "This Regin driver recurrently checks that the current IRQL (Interrupt Request Level) is set to PASSIVE_LEVEL using the KeGetCurrentIrql() function in many parts of the code, probably in order to operate as silently as possible and to prevent possible IRQL confusion. This technique is another example of the level of precaution the developers took while designing this malware framework." what does that even MEAN?!
- deleted 12y ago
  [deleted]
- userbinator 12y ago
  They do. http://blogs.msdn.com/b/doronh/archive/2010/02/02/what-is-irql.aspx http://blogs.msdn.com/b/doronh/archive/2010/02/02/what-is-ir...
  - munin 12y ago
    no they don't, checking IRQL has nothing to do with "operating as silently as possible".
    - throwawayaway 12y ago
      go on...
      - deleted 12y ago
        [deleted]
        throwawayaway 12y ago
        so this could broadly be categorised as an innocent typo, they were in the right ballpark!
    - kybernetyk 12y ago
zodiakzz 12y ago
Stupid question.. is it not possible to identify the IP addresses this thing contacts?

147 points by FredericJ 12y ago

re-posting AlyssaRowan's comment (https://news.ycombinator.com/item?id=8653692 https://news.ycombinator.com/item?id=8653692) here: "Got more payload chunks. Wow, they were sloppy with this - found plenty of symbol references still in them! So far, that makes references to LEGSPIN, WILLISCHECK, HOPSCOTCH, STARBUCKS, FOGGYBOTTOM, SALVAGERABBIT. I believe this may be NSA's UNITEDRAKE implant architecture, specifically."

waterlesscloud 12y ago
FOGGYBOTTOM is so particularly US Govt that it almost feels like misdirection. Or a programmer mad he has to do the task. Heh. ("Foggy Bottom" is an oblique reference to the US State Dept, after the DC district where it's located)
- mikecb 12y ago
  Also the location of the Office of Strategic Services, the WWII precursor to CIA.

iresa 12y ago

So the UK attacked Ireland. Nice one.

jh888 12y ago
It's nothing new: http://www.theguardian.com/uk/2000/may/31/northernireland.richardnortontaylor http://www.theguardian.com/uk/2000/may/31/northernireland.ri... (2000) I'm sure all they learned about politicians/activitists and their family helped in the "negotiations" on Northern Ireland and other matters.
AlyssaRowan 12y ago
It's no surprise at all the UK has intelligence targets in Ireland: go read up on The Troubles. (I walked right past a live IRA bomb as a child. Spent half an hour longer shopping, and maybe I wouldn't be typing this.) Of course, that situation just isn't today what it used to be. As for the US, a lot of corps have operations and/or headquarters in Ireland for tax reasons. For example you might recall a story about Microsoft, the FBI, and email.
anigbrowl 12y ago
Given the centuries-long political problems between the two nations, what else would you expect? Ireland has an intelligence agency too which I'm sure does its share of covert information-gathering (at least I hope so, or it wouldn't be much good): http://en.wikipedia.org/wiki/Directorate_of_Intelligence_%28Ireland%29 http://en.wikipedia.org/wiki/Directorate_of_Intelligence_%28...
- rmc 12y ago
  The IRA (et al.) do attack the Irish State, since they don't recognise it (e.g. https://en.wikipedia.org/wiki/Death_of_Jerry_McCabe https://en.wikipedia.org/wiki/Death_of_Jerry_McCabe ). However the UK police force & intelligence agency is much more advanced by the Irish one.
  - anigbrowl 12y ago
    I know. I'm from Limerick although I live in the USA now.
    - rmc 12y ago
      Shit, sorry
      - anigbrowl 12y ago
        No worries ;)

deleted 12y ago

[deleted]

guiambros 12y ago

Oh snap! "The archive also contains the output of ProcMon, Process Monitor, a system monitoring tool distributed by Microsoft and commonly used in forensics and intrusion analysis. This file identifies the infected system and provides a variety of interesting information about the network. For instance: USERDNSDOMAIN=BGC.NET USERDOMAIN=BELGACOM USERNAME=id051897a USERPROFILE=C:\Users\id051897a" Also love the comment at the end: "Below is a list of hashes for the files The Intercept is making available for download. Given that that it has been over a year since the Belgacom operation was publicly outed, The Intercept considers it likely that the GCHQ/NSA has REPLACED THEIR TOOLKIT AND NO CURRENT OPERATIONS WILL BE AFFECTED by the publication of these samples."

rasz_pl 12y ago
oh snap what? This is a file uploaded by BELGACOM admin to VirusTotal database. It is NOT a file NSA published somewhere. Currently we only know this malware was used in belgacom hack, there is still no proof it is nsa code.
- guiambros 12y ago
  Do you really have any doubt about who's behind this? We can debate about motivations and who their target really was (Belgacom may have been collateral damage), but despite "proof", there's little doubt about who wrote it.
  - rasz_pl 12y ago
    Yes, just like FBI assassinating Kennedy because Oh snap cuba! You act like its some sort of proof, like this totalvirus upload came from Langley IP.
    - guiambros 12y ago
      I simply pointed out that the person who uploaded to virustotal certainly didn't realize it also had Belgacom domain name, username, and a list of all the processes running on the machine. > Yes, just like FBI assassinating Kennedy because Oh snap cuba! I have no doubt where this came from, despite not having Gen. Keith Alexander's email in the logs.

lazaroclapp 12y ago

Interesting. What I don't get from this analysis or the one by Symantec is how this rootkit is able to install kernel drivers on 64-bit Windows with driver signing enabled. Is this using a new vulnerability to do so? An existing one? Did the GCHQ/NSA managed to get their hands on the keys necessary to sign Windows drivers? Each scenario has implications for code signing as a security technique...

dmix 12y ago
With DUQU and Stuxnet, the agencies had stolen the signing cert from Taiwanese businesses. Duqu = stolen from https://en.wikipedia.org/wiki/C-Media https://en.wikipedia.org/wiki/C-Media Stuxnet = stolen from https://en.wikipedia.org/wiki/Realtek https://en.wikipedia.org/wiki/Realtek Not hard to find a valid cert when you're a nation state. Source: https://firstlook.org/theintercept/2014/11/12/stuxnet/ https://firstlook.org/theintercept/2014/11/12/stuxnet/
- nullc 12y ago
  "stolen"
  - dmix 12y ago
    Are you suggesting they were acquired by other means?
iresa 12y ago
It's well established that there are links between the most important IT companies and the gov't. Why the surprise?
throwawayaway 12y ago
> Symantec is how this rootkit is able to install kernel drivers on 64-bit Windows with driver signing enabled. if you read the symantec pdf whitepaper, that is only how the 32 bit one works, the 64bit one works differently - something to do with winsock.

munin 12y ago

it would be really good if the people reverse engineering malicious software knew how computers worked: "This Regin driver recurrently checks that the current IRQL (Interrupt Request Level) is set to PASSIVE_LEVEL using the KeGetCurrentIrql() function in many parts of the code, probably in order to operate as silently as possible and to prevent possible IRQL confusion. This technique is another example of the level of precaution the developers took while designing this malware framework." what does that even MEAN?!

deleted 12y ago
[deleted]
userbinator 12y ago
They do. http://blogs.msdn.com/b/doronh/archive/2010/02/02/what-is-irql.aspx http://blogs.msdn.com/b/doronh/archive/2010/02/02/what-is-ir...
- munin 12y ago
  no they don't, checking IRQL has nothing to do with "operating as silently as possible".
  - throwawayaway 12y ago
    go on...
    - deleted 12y ago
      [deleted]
      - throwawayaway 12y ago
        so this could broadly be categorised as an innocent typo, they were in the right ballpark!
  - kybernetyk 12y ago

zodiakzz 12y ago

Stupid question.. is it not possible to identify the IP addresses this thing contacts?