18 ms·
Source Code Similarities Between NSA Malware and 'Regin' Trojan
- jgrahamc 12y agoThere are also additional clues pointing to Regin being a Five Eyes tool: In the QWERTY code, there are numerous references to cricket, a sport that enjoys extreme popularity in the Commonwealth. Given the relative popularity of cricket in the US vs. the rest of the world, it's more likely that this was written outside the NSA.
- coding4all 12y agoI don't think it's the sport. I think it's cricket = bug = spy tool.
- ceejayoz 12y agoA spy tool that chirps every few seconds to announce its presence? There are better insects to reference.
- aesede 12y agomaybe because it jumps as malware usually does
- lotsofmangos 12y agoIt is the sport. The references they are referring to in the article include things like LEGSPIN.
- lozf 12y agoJust as likely to be a tounge in cheek play on the stereotypically British line for something unfair: "It's just not cricket"
- bayesianhorse 12y agoOr they had an Indian programmer in their team.
- rogeryu 12y agoOr India was the first target.
- deleted 12y ago[deleted]
- th0br0 12y agoIn the PDF (who's ever shipped binary as text in a pdf btw?) [1] they argue that it might be related to Australia; who knows... [1] http://www.spiegel.de/media/media-35668.pdf http://www.spiegel.de/media/media-35668.pdf
- bjackman 12y agoAlso "source code"... This is clearly not source code.
- palmer_eldritch 12y agoIt's probably just reverse engineers being snobs. Or journalists being journalists. Or both.
- GrinningFool 12y agoI'd argue that it's source code at the lowest possible level...
- logfromblammo 12y agoAnd I'd argue that it is a disassembly of a binary compiled from source code. Source code has the word "source" in it. Unless the original human wrote it directly in assembly without comments or macros (from his padded cell at the asylum, naturally), it is obviously not source code.
- chc 12y ago"Source code" is generally code you can put into a compiler and get out object code. The term "source" refers to the fact that it is used as input. This is why, for example, the GPL specifies that you must release the original source code in the preferred format for editing — so that people wouldn't release source code generated by disassembly or a source-to-source transformer.
- 12y ago
- AlyssaRowan 12y agoI know GCHQ contractors (BAE Detica, funded as a part of the "Mastering The Internet" tender) had a hand in at least some of it; it's not unreasonable to guess it might've been that module, as that does link it? (Although of course, that's just a guess, and doesn't really tell us anything particularly new or useful.) Not that I think nation-state malware is, you know, strictly cricket. (Quite the opposite, I've always said it was an irresponsible and reckless path, all the way back to the 1998 era.)
- AlyssaRowan 12y agoUpdate: It seems Australia's DSD was likely a better guess in this particular instance - more to come from the authors soon. (Which leaves that Detica module currently unaccounted for. I don't know what that could be yet.) Of course, they're all Five Eyes, and at least US and UK have both used it, so I wouldn't be too surprised to see CAN/AUS/NZ too. Leaves us back with the "How do we fix this?" problem. And "how do we find what replaced STRAITBIZARRE"?
- bigfoot 12y agoGiven that a NSA dev team was well aware that the spyware would be discovered and disassembled at some point in time, it was reasonable to intentionally leave behind evidence that points to countries other than the US. I'm not saying that's what happened, but I'd not take the cricket references too serious either.
- MichaelGG 12y agoUsing that logic, what would constitute evidence? That's like the senator in favor of the Japanese interment camps saying that the fact that no Japanese Americans had committed a crime was just even more evidence they were planning something. Edit: More clearly written than my comment: http://lesswrong.com/lw/ih/absence_of_evidence_is_evidence_of_absence/ http://lesswrong.com/lw/ih/absence_of_evidence_is_evidence_o... But basically, people have already come to a conclusion. If the comments said "go <Virginia sports team>", that'd be considered evidence of made in the USA. And if the comments say " go English sports team " then that's evidence of have in the USA, because obviously comments are misleading. Why not go recursive? They wrote about cricket because they wanted to frame the Americans, who always write misleading comments to frame the Brits.
- barryfandango 12y agoSo I can clearly not choose the drink that is in front of you!
- anonbanker 12y agoThat's what I get for fighting a land war in Asia.
- dickson 12y agoThey both did it yo
- gtirloni 12y agoI think disinformation is one of the pillars in their line of work. For all we care, they could have written references to whatever is popular in North Korea.
- zxcvcxz 12y agoHow smart would you have to be to insert references to different cultural aspects other than your own to make it look as if it's from another entity? I think it would take at least the smartness of two average people..
- alfiedotwtf 12y agoIf so, can the people and companies that were affected file a class action?
- teamhappy 12y agoClass action might be a solution for US citizens. The problem with malware though is that you end up infecting a whole lot of innocent civilians all over the place, which the people in Den Haag have slightly mixed feelings about. To be honest, I'm a bit disappointed that these cases never end up in international courts. The rules we have in place seem pretty clear to me.
- coldcode 12y agoUnlikely, you can't sue the Federal Government without its permission. In any case the NSA would simply say "national security" and boom you are done.
- anonbanker 12y agoThen sue Alexander and Clapper for their roles, and lay the case that their actions were not in the scope of the office they held. Then the government says nothing, and bad people get prosecuted.
- LLWM 12y agoFor some malwares that may be true, but I doubt Regin was that sloppy.
- alfiedotwtf 12y agoWhy not? Stuxnet got into the wild and I wouldn't consider it sloppy at all.
- LLWM 12y agoThere's a big difference between "got into the wild" and "caused harm to innocent users".
- deleted 12y ago[deleted]
- bayesianhorse 12y agoMy current opinion on government hacking is, that I actually want democratic government to be the biggest meanest hackers of them all. The alternative, unfortunately, is that either organized crime or non-democratic governments (or a combination of both) would be the biggest meanest hackers. And hacking doesn't really scale. Mass surveillance just through attacking individuals with malware isn't possible, because of limited "talent" and a fear for exposing the tools, like just happened. Building backdoors into systems or encryption schemes, on the other hand, isn't exactly hacking but does scale well to undiscriminate spying on millions of people. The main issue is that intelligence and law enforcement agencies in the western world aren't bound to judicial control as tightly as they should. It also seems that a majority of voters either consent to these powers, or don't care. When politicians want to appear "acting decisively" after terrorist attacks, or foreign hacking incidents, it's not just because they like to do so. They know that, if they don't, voters will disapprove.
- peterkelly 12y agoOr, you know, they could concentrate on defense rather than offense
- bayesianhorse 12y agoHow can they provide adequate defenses without having the best offensive hackers? At the very least, penetration testing is an indispensable tool in cyber security. Also, surveillance of criminal and terrorist organizations without offensive capabilities is impossible.
- spuz 12y agoThe NSA have been accused of discovering vulnerabilities in systems and software but keeping them undisclosed so that they can exploit them themselves. A defensive security agency could be actively trying to secure these systems protecting us not just from government surveillance but all types of nefarious hackers.
- Wilya 12y ago
- madaxe_again 12y agoUh, wasn't Regin apparently used in the Sony hack?
- rndn 12y agoNo?
- madaxe_again 12y agoNo, you're right, belgacom - it was all just reported at about the same time.
- thomasmarcelis 12y agoThere is more than a year difference between the two
- danesparza 12y agoAgreed - more than a year between the two. Here is the full rundown if you're interested: Regin details: http://en.wikipedia.org/wiki/Regin_(malware) http://en.wikipedia.org/wiki/Regin_(malware) Sony hack details: http://en.wikipedia.org/wiki/Sony_Pictures_Entertainment_hack http://en.wikipedia.org/wiki/Sony_Pictures_Entertainment_hac...
- hluska 12y agoNothing like waking up to a story that makes you feel embarrassed by your citizenship. Good job Canada, you're making a Maple Leaf a dangerous symbol all around the world. When I was a youngster, being Canadian meant that Incould travel anywhere and be fine. Granted, there was a > 50% probability that the other Canadians I would meet were really Americans, but that was nothing. My country had a solid international reputation. Now???
- NietTim 12y agoJust imagine being American and being full of false pride...
- deleted 12y ago[deleted]
- Deviant 12y agoHow about being an American that has lived in the States, Aussie, and New Zealand over the past five years - I can't escape the Five Eyes shame :(
- thu 12y agoNot related to this thread, but to your comment about the Maple Leaf: http://www.newsweek.com/why-rebel-groups-love-toyota-hilux-74195 http://www.newsweek.com/why-rebel-groups-love-toyota-hilux-7... Edit: Sorry, I didn't see it was paywalled (I'm not a subscriber of that site). I now see that it counts your visits and disable itself after a few times. "Private" browsing seems to solve the problem.
- cyphunk 12y agothat link is mostly paywalled. do you have another source?
- MichaelGG 12y agoSearch the title. But from old memory: Hilux trucks are built amazingly and have awesome reliability. Real, authentic, Hilux trucks are thus valued by freedom fighters/terrorists in Afghanistan. Canada donated a bunch if real Hilux trucks to Afghanistan, and these vehicles had a Maple Leaf logo. People associated the Maple Leaf with the quality of Hilux, to the point of at least one person getting a Maple Leaf tattoo to signify his quality.
- deleted 12y ago[deleted]
- DavideNL 12y agoUS spying on allies, what else is new? Wasn't most of this already known? From wikipedia https://en.wikipedia.org/wiki/Regin_(malware)#Known_attacks_and_originator_of_malware https://en.wikipedia.org/wiki/Regin_(malware)#Known_attacks_... : `Der Spiegel reported in November 2014.......` `Fox IT found Regin on the computers of one of its customers, and according to their analysis parts of Regin are mentioned in the NSA ANT catalog under the names "Straitbizarre" and "Unitedrake".`
- happyscrappy 12y agoHas Speigel reported on the ubiquitous US spy stations peppered throughout Europe? Have they speculated on why Europe does not close them?
- UnoriginalGuy 12y agoBecause the US shares intelligence with those governments. In some EU countries it is illegal for the government to spy on its citizens (also see the US pre-9/11), so the US spies on those countries and then relays the info back. Pre-9/11 this is also how the US worked. The UK spied on the US and the US spied on the UK, thus both subverting national laws, they then shared intelligence with one another (which is legal) and thus the loophole was born. This is actually the system the US is going back to, it is becoming politically unpopular for the NSA to spy on American Citizens, so GCHQ will likely take over the majority again, the reasons they couldn't after 9/11 was that the workload increase too much in too short a period, and the systems didn't yet exist.
- Lambdanaut 12y agoIn my mind that's conspiracy-theory level claims. Got sources?
- Amezarak 12y agoThis goes all the way back to ECHELON and Five Eyes. If you look up the ECHELON program, you will find documented evidence of exactly that occurring. There is evidence this and similar programs/agreements has been going on since at least WWII. Even now, it's well-documented and well-understood that all the first-world allied nations have varying degrees of intelligence-sharing relationships with their SIGINT programs. For example, with the NSA, you have the Five Eyes countries, and also Tier 2 countries like Germany. I tihnk what also holds them back a little is also the fact it's amazingly hypocritical for them to complain too much, because every industrialized country is spying on every other industrialized country, allied or not. Of course, some are bigger targets than others. The US is obviously the biggest target, but there's smaller scale stuff going on too, as between France and Germany. According to Germany, France is the "evil empire" of industrial espionage perpetrated in part through their SIGINT programs. The focus on the USA, and the NSA, is misleading. The NSA's role is probably comparable to the US government at large's role in world politics, (biggest, most influential) but all other nations are complicit. I don't intend to sound mean, but I feel like the attitude that so many people had in the wake of the Snowden revelations, that spying on allies was unheard of, unexpected, evil, is breathtakingly naive and historically and contextually unaware, and almost like some kind of twisted expression of the stereotypical American arrogance, that only Americans could commit so great an evil. This is an old, old, old game that has always evolved with technology. I guess I rambled on a bit there. Sorry.
- cyphunk 12y agoIt is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack. In the latter many security analysts question NK attribution based on the similarity of code argument given by the US -- pointing out that the code base was in the wild for a long time, could be purchased on black market or reverse/reengineered after picking up the malware from a vulnerable machine. Shouldn't we also assume that this malware, having been in the wild for "10 years", could have simply been modified and thrown into the NSA tool chest? When applying the same level of scepticism from the Sony hack, nothing in this article represents real proof to counter relevant arguments against US attribution. Regardless, the Spiegel assumptions or slant is worthy if for nothing else than to teach everyone the issues with attribution, whether applied to greater or lesser evils.
- at-fates-hands 12y agoI stopped reading the article when I got to this point: "In the QWERTY code, there are numerous references to cricket, a sport that enjoys extreme popularity in the Commonwealth." In the immortal words of John McEnroe, "YOU CANNOT BE SERIOUS!?"
- k-mcgrady 12y ago>> "It is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack." Just playing devils advocate here. The alternative is to do as the USG did and immediately jump to conclusions based on not that great evidence. If they don't give others the benefit of the doubt why should we give it to them?
- dsjoerg 12y agoIf your goal is to understand who is doing what, then you want to be smart about how you draw conclusions. If, on the other hand, your goal is to flame people who have done bad stuff when the opportunity arises, then yeah, go for it.
- d23 12y agoBecause 1) the USG isn't one single guy and 2) the truth might be more important to some than conclusion-jumping.
- rollthehard6 12y agoWhat's the feeling on the morality aspect of this? In a way it seems like the same situation as if US designed and manufactured weaponry were used against a US friendly power by some third party - is it analogous though?
- cyphunk 12y agodown voting on HN has become absurd. Also noticing this on other comments in this thread.
- throwawayaway 12y agoI think the problem is the consensus is the NSA/GCHQ use the tool. Your disagreement is whether the NSA/GCHQ originated it. Your comment reads as if you disagree with there being proof of any use, based on the evidence in the article. There's very little doubt the NSA/GCHQ use the tool. Here's some background reading: https://news.ycombinator.com/item?id=8649402 https://news.ycombinator.com/item?id=8649402 https://news.ycombinator.com/item?id=8653454 https://news.ycombinator.com/item?id=8653454 https://firstlook.org/theintercept/2014/12/13/belgacom-hack-gchq-inside-story/ https://firstlook.org/theintercept/2014/12/13/belgacom-hack-...
- btown 12y agoWhether they originated it, though, is the crux of the issue. Nobody doubts that government agencies undertake cyberwarfare. But the idea that they might have created something that is now being used by nongovernmental parties is the scary thing - it's like saying that the Army lost a cache of weapons now being used by ISIS. (Which itself is true [1], but that's another story.) [1]: http://www.businessinsider.com/isis-captured-a-key-syrian-air-base-2014-8 http://www.businessinsider.com/isis-captured-a-key-syrian-ai...
- throwawayaway 12y ago> But the idea that they might have created something that is now being used by nongovernmental parties is the scary thing Who has that idea? I don't see anyone saying that. also: http://www.nytimes.com/2012/06/21/world/middleeast/cia-said-to-aid-in-steering-arms-to-syrian-rebels.html?pagewanted=all&_r=0 http://www.nytimes.com/2012/06/21/world/middleeast/cia-said-...
- DanBC 12y agoIgnore initial downvotes. People usually supply corrective upvotes if the downvote is unfair.
- rikkus 12y ago"Regin Malware Unmasked as NSA Tool" or NSA Tool found to contain part of Regin malware?
- beagle3 12y agoAssuming all of this is true, and the TPP leaks are indeed what they seem to be - wouldn't the TPP let every corporation outside $COUNTRY sue the government of $COUNTRY for malware? (e.g. for $COUNTRY in Five Eyes)? First upside to the TPP that I've seen, if true.
- grecy 12y agoIf you or I wrote it we'd go to jail for a very, very long time. When a government writes it, nothing happens.
- MichaelGG 12y agoReally? Apart from France, do most countries prosecute the author of computer/hacking tools? I was under the impression that the use of the tools is what mattered. Just like BitTorrent itself has been fine, but any hints of using it for copyright infringement get fire. After all, you could use this malware to spy on your child's use of your PC, which is legal, right?
- pjc50 12y agoSee Dmitry Sklyarov, among others.
- diminoten 12y agoIf you or I kill someone, we'd go to jail for a very, very long time. When a government kills someone, nothing happens. Nothing new.
- deleted 12y ago[deleted]
- jcfrei 12y agoSeeing that this is a keylogger, how complex would it be to enable a sort of SSL protocol between the keyboard and a specific application? The computational overhead should be manageable, the connector (USB) wouldn't need to change and there should be a fallback for any applications which doesn't support it. But if crucial applications like mail and the browser programs could use it, it might deliver another blow to security companies. The way I would implement it is that the keyboard has a switch to enable this SSL type communication. Then the keyboard can perform a Diffie–Hellman key exchange with the current process. As a result any other interaction with the OS would become impossible until that process is terminated - basically disabling all OS related shortcuts etc. This would allow true end to end encryption - even on compromised systems (as long as the kernel code isn't modified to allow accessing the memory of other processes).
- mhei 12y agoIf the operating system is compromised, your application stands no chance hiding its data (including keystrokes) from it. The keystrokes could simply be intercepted after decryption, or even before - if you keyboard controller is that capable, it probably has more than enough space for malware of its own.
- MichaelGG 12y agoIf the OS is compromised, then you can't work around that to secure a program inside the OS. You can run the program somewhere else, like on the keyboard itself. Some secure crypto devices have displays, so you can see what you're signing. The only similar thing I've heard of is the "Secure Attention Sequence" in Windows. That is, pressing CtrlAltDel before entering credentials lets you be sure an application is not mimicking the logon prompt. But of course if the OS is compromised (like by loading a driver that intercepts such keystrokes, like VMware Enhanced Keyboard) all bets are off. Think about it, the OS is executing all the code for the app, and storing all the memory. This is also why there is a push for trusted computing. Being able to have your processor, OS, etc be able to verify they are running a trusted configuration is a powerful thing. It makes the owner of the computer in control. (The downside is when the user is not the owner, but would like to be, then they get upset at restrictions.)
- lsaferite 12y agoTinfoil hat: Hypothetically, if the Russian government were angry with the US government and wanted to give them a black eye, wouldn't having a Russian security firm announce to the world that the NSA was responsible for Reign be a good tactic? Not saying NSA wasn't involved as I don't really trust my government, but when I read the article and saw Kaspersky mentioned, that was the first thing that popped into my head.
- dubbel 12y agoI see your point. In this specific case Fox-IT (Netherlands) said the same thing. They based the claim not on the "source code" but on the fact that Regin was part of programs/processes of the NSA department ANT and mentioned in some leaked presentation slide of them (Source: http://www.spiegel.de/netzwelt/netzpolitik/trojaner-regin-ist-ein-werkzeug-von-nsa-und-gchq-a-1004950.html http://www.spiegel.de/netzwelt/netzpolitik/trojaner-regin-is... (German)). Thinking about infosec companies that publish impactful findings from time to time there is F-Secure from Finland, Fox-IT from the Netherlands, Symantec from the US and Kaspersky from Russia. Does anyone know about important Chinese/Japanese information security companies?
- LLWM 12y agoPublished it where? The only link I can find is http://www.spiegel.de/media/media-35668.pdf http://www.spiegel.de/media/media-35668.pdf, and calling that source code is a bit generous to say the least.
- caskance 12y agoSeriously. Did nobody else here actually come because they were interested in seeing Regin's source code? I feel like I'm in crazy land.
- peterwwillis 12y agoMany espionage tools are designed by organizations that then sell or license their tools to 3rd parties. Just because the NSA used it doesn't mean they wrote it. 'Some reporters were surprised to learn that the University of Maryland had a "covert" NSA facility operating somewhere on or near the school grounds. [..] "Which facility and exactly where it was Snowden worked is unknown, but the NSA has connections to several university facilities, including the Laboratory for Physical Sciences, the Office of Technology Commercialization and the Lab for Telecommunication Science."' http://www.motherjones.com/mojo/2013/06/university-maryland-edward-snowden-nsa http://www.motherjones.com/mojo/2013/06/university-maryland-... Oh, and the University's college hacking team got 1st at the Major League Hacking Championship in 2013, winning over MIT, Carnegie Mellon and Rutgers. https://www.umdrightnow.umd.edu/news/umd-students-win-major-league-hacking-championship https://www.umdrightnow.umd.edu/news/umd-students-win-major-... There are probably hundreds of other organizations which work 'in partnership' with the intelligence community to develop programs which are essentially used to better their espionage and analysis capabilities. Almost all the Virginia/DC/Maryland area's tech companies are employed in one way or another by the federal government, usually for the military or an intelligence agency.
- sudioStudio64 12y agoThe NSA is tasked with doing signals intelligence so I get why they would develop some hacking abilities but you have to wonder where the break over point is with the money they are spending...at some point they are spending enough money that they could actually make a difference in improving our software and infrastructure. I mean, one of the reasons they say that they need these capabilities is because we are so vulnerable...how about actually helping out?
- hox 12y agoThey do. They have lots of documents and guidance on best practice for security. As for code, they started the SELinux project. http://en.m.wikipedia.org/wiki/Security-Enhanced_Linux http://en.m.wikipedia.org/wiki/Security-Enhanced_Linux
- upofadown 12y agoOK, if you believe that there is actually such a thing as "Cyberwar" then this means that the USA has attacked Belgium. Does this give Belgium the right to physically blow up some important American infrastructure? ... or is Cyberwar a type of cold war which would limit the response to some sort of hacking of important American infrastructure?
- ufoolme 12y agoAs a lazy person and Devil's advocate, why does anyone not think that the various intelligence agencies copied the malware? Surely they would have access to some of the best in all their various honeypots be it that they are attacked by everyone and everything. "Good artists copy, great artists steal."-PP
- thesmileyone 12y agoRight on the GCHQ website it states: "In addition, we are also pleased to announce that GCHQ and MI5 are working with their US partners to further strengthen UK-US collaboration on cyber security ..." I think it is fair to say they all use the same tools!