26 ms·

“Equation Group” ran the most advanced hacking operation ever uncovered

870 points by privong 12y ago

ptwiggens 12y ago
The update confirms it is the NSA. It is incredible, even the most generous estimation of the NSA's capabilities before the Snowden disclosures now look conservative. This is the stuff conspiracy theories are made of.
- sumitviii 12y ago
  How do they even sift through all the information they get? It has to be a LOT.
  - relaunched 12y ago
    This particular set of exploits has little to do with collecting information. This seems to be directly related to command and control operations, including over systems that aren't connected to the internet. There are a pretty scary set of discovered exploits.
    - sumitviii 12y ago
      I believe this is not the correct thread, but how can anyone sift through so much data, in general? Private companies need simpler things, like people you are likely to know in the real world, from the data they acquire. But intelligence agencies need actionable intelligence. That would require something way more intelligent than a simple spam filter.
      - scott_karana 12y ago
        They don't necessarily need actionable intelligence: just supportive evidence to back up recon/threats/blackmail as part of other agency's actions.
      - lbotos 12y ago
        I think that's the goal of firms like Palantir. To help filter that volume of data.
      - wongarsu 12y ago
        That depends on the data you are talking about. The operations described here don't seems to collect huge amounts of data. If you're talking about the usual dragnet surveillance: a lot of it seems to be relatively simple filters and simple data correlation. For example, you can build huge social graphs with simple metadata. Then you can search for all people who communicate a lot with people who communicate a lot with some known terrorist leader. Of those people, you take just those using tor. If any of them plans to enter the US, you flag them to be detained and searched at the airport. If any of them is already in the US, you can tell FBI to check them out. Or you can look for sudden changes in message volumes. If terrorist leader A suddenly starts to communicate a lot more with random person B and random person C, who in term start communicating with other people, you suddenly have a whole list of people who might be planning a terrorist operation. Of course you still need huge computing capacity even for these relatively simple operations, but they certainly have the funds for a few datacenters.
      - Estragon 12y ago
        > intelligence agencies need actionable intelligence For the most part that hasn't really been how it's worked so far. Generally intelligence agencies have used the information they've gathered so far to try to manipulate people.
  - rodgerd 12y ago
    Given that they appear to have basically perfect ability to gather data, there's got to be some reason we keep having successful terrorist attacks.
    - deleted 12y ago
      [deleted]
    - andrewchambers 12y ago
      Because the serious terrorists avoid anything that may be snooped.
      - rodgerd 12y ago
        So it's a huge waste of money usable only against non-terrorists?
        jacquesm 12y ago
        That's a pretty good summary.
        fit2rule 12y ago
        Its only really useful against non-terrorists, but that doesn't mean its a waste of money: if it is used to make money. So maybe its being used to make money - i.e. targetting non-terrorists (i.e. industrial espionage) - precisely because it is a huge waste of money. Wow, its almost like the whole thing was just a bad idea in the first place - its become self-serving.
        AnimalMuppet 12y ago
        No, it's useful against terrorists whose trade-craft is less than perfect. That's many of them.
    - JabavuAdams 12y ago
      SIGINT won't won't detect two people conspiring in a bug-free room.
  - danielayoub 12y ago
    Data mining algorithms. Remember, they're the world's largest employer of mathematicians.
    - sumitviii 12y ago
      Data interpretation is NLP, not maths.
      - scott_karana 12y ago
        NLP is implemented with logical and statistical modelling. How is it a realm of anything but math? ;) Edit: if you meant that data interpretation is NP, I agree.
        deleted 12y ago
        [deleted]
      - crazypyro 12y ago
        NLP's foundation is in statistics, so calling it "not maths" seems rather short-sighted. Mathematics, especially statistics, play a crucial role in all data interpretation when you get to any kind of scale and they seem to be the biggest of them all.....
    - gwern 12y ago
      'were', I think, may be more operative. I first heard that statistic about a long time ago, more like the '70s. Mathematicians don't seem to be very useful to the NSA's current hacker paradigm. (Note what we haven't gotten from the Snowden leaks so far: any sort of major mathematical or theoretical advance. Amazing hacking infrastructure, though.)
      - Estragon 12y ago
        Given Snowden's stated values, it's highly unlikely that he would report such a breakthrough.
  - pixl97 12y ago
    Had a family member that worked for SPEA (test equipment manufacture). Said different government organizations would bring in boards with massively parallel sets of chips and input/output on them, like nothing they ever saw in any other field. They were expressly forbidden to take pictures of them. Between that and the massive data centers they are building I'm guessing they have rather impressive capabilities.
- AlyssaRowan 12y ago
  UR = UNITEDRAKE ("Regin", basically?). And that'd probably be rmgree5@nsa.gov: that's the format their addresses are in. This does seem to be, broadly-speaking, NSA's top-dollar brand-new 0-day-laden (at the time) malware, that they use to launch their less shiny stuff, which is more awkward and a massive overfunded modular boondoggle. This does not seem to be as freely shared around with the "Five Eyes". By the way, there are innocent machines in the US infected with this thing, at this very moment. Anyone care to explain that? The hard-drive component should be completely detectable, if you don't boot from it, based on the (small, sadly incomplete) fragment of (Cortex-M0?) stuff I've seen. Power-cycle it, send an ATA reset, read the MBR and following sectors. Look out for the NIC "option rom" persistence module, too - you may be well-advised to do it from something really exotic that doesn't run x86, just in case! (Independent hackers are running (µ)Linux on hard disks now, so it's not surprising a huge agency able to spend billions of dollars of tax money funding contractors on tiny pieces of this project got something of a head start!) Not sure of a good way to detect it in software, but it's not perfect, so it probably can be redpilled somehow. Watch for "CD-ROM"s that unexpectedly have ATIPs, I guess?
  - deleted 12y ago
    [deleted]
  - final 12y ago
    >> By the way, there are innocent machines in the US infected with this thing, at this very moment. Nobody is innocent. The government has enemies both internal and external.
  - wongarsu 12y ago
    Detecting an infected hard drive in software would be the usual malware arms race: you find some characteristic of it, they improve the firmware. But if we start to systematically check for it, it should be easy to discover via hardware debugging. Find the JTAG interface on the hard disk controller (or whatever debugging interface the specific processor uses), dump the firmware and compare it to firmware dumps from other hard drives of the same model. I don't see how they could fool that process (given that you have a clean machine to read out the firmware). Of course to be thorough you would have to check pretty much the firmware of every component of the computer.
thejaredhooper 12y ago
What's worse is the fact that this would be more terrifying if this weren't an action to the NSA's credit. Chinese, British, and Russian governments also have the capability of developing intrusive malware at such a scale. I see that this is confirmed as the NSA, but the world has been awfully silent on the intrusiveness of Chinese malware practices. You can not travel safely in China without your domestic devices being breached, yet we don't hear about large-scale projects from their government, which also possesses "near limitless resources" at their disposal. I just think it's interesting there's so much attention on the NSA.
- sumitviii 12y ago
  People would be angry even if they didn't know that Equation Group was part of the NSA.
deleted 12y ago
[deleted]
yeahyeah 12y ago
This is exactly what the NSA should be doing. Everyone (rightfully IMO) complains about overly broad data collection happening within the USA, but here (as with stuxnet) you have the exact opposite, a targeted foreign activity conducted with care and targeting. I know it's not for everyone (not least because not everyone is in the states, huh), and it could be considered a bad precedent, but it's not like Iran asked our permission before they launched their nuclear program, or other states are actually waiting on the US's example to have their own intelligence services do their jobs. If you hold that something like 9/11 should be prevented, and that (actual) WMD programs should be stalled, then it follows that this is a fine way to go about it.
- Alex3917 12y ago
  > It's not like Iran asked our permission before they launched their nuclear program You do realize the U.S. helped launch Iran's nuclear program, right? http://en.wikipedia.org/wiki/Nuclear_program_of_Iran http://en.wikipedia.org/wiki/Nuclear_program_of_Iran
  - yeahyeah 12y ago
    Well if it's on the US then they should have stopped when we asked nicely, right?
    - FeeTinesAMady 12y ago
      Not right. If the US was peaceful, there wouldn't be much of an argument for developing nuclear weapons, but the US is the most aggressive nation in the world, and nuclear weapons are the only thing that give them pause. The actions of the US since the end of World War II - invading other nations at will, interfering in their internal affairs, starting secret wars - give legitimacy to nations who want to develop nuclear weapons for their own defense. Nuclear weapons bring safety from you.
      - allemagne 12y ago
        As far as superpowers in history go, the United States post WWII is downright benevolent. The other contenders in recent memory being: the Soviet Union, the British Empire, Nazi Germany, Imperial Japan, the French Empire, the Italian Empire, Austria-Hungary, and so on and so forth. Once the United States starts claiming pieces of South America and Arabia as their sovereign territory you can start shouting about Iran's self defense. The United States is far from perfect, and all the criticisms you leveled are completely true. But be honest about the situation. The only thing that Iran's government is protecting by developing nuclear weapons is their own corrupt regime and their influence in the middle east.
rosenjon 12y ago
Based on the article, are we to presume that this only affects tech in hostile countries? Or are they doing this to US-based equipment as well? Seems like this will backfire spectacularly when foreign countries and companies stop buying American made tech for fear of these hardware backdoors. Spectacularly irresponsible.
- teraflop 12y ago
  According to the report, the malware was delivered to researchers in dozens of countries, including the UK, India, Mexico, Switzerland, France, and the US itself.
- netman21 12y ago
  Check out bannanaglee. Backdoors in Juniper and Cisco gear. Yes, already having an impact.
- Buge 12y ago
  Would this really be considered a hardware backdoor?
- jrochkind1 12y ago
  Wait, is Mexico a "hostile country"?
  - leroy_masochist 12y ago
    Their central government is not hostile to the United States; cartels and certain cartel-influenced local governments certainly are.
    - jrochkind1 12y ago
      There are of course entities hostile to the United States in every country, including the United States.
gnu8 12y ago
We should all be aware of the fact that these people are the enemy. They don't do these things to "protect freedom", they do them to destroy freedom. Most of the people on Hackernews are uniquely placed to resist. Secure your software. Refuse to cooperate unless legally compelled. Analyze and publish any evidence of government attacks. If you work for the NSA, understand this: you aren't American. You are the Internet Daesh. You will lose.
- rifung 12y ago
  In what way are people who work for the NSA not American? They are literally working to protect American citizens from violence. While you may not agree with their methods, saying you are somehow "more" American than they are, let alone that they aren't American at all is a huge stretch. I think I'm too young and naive to really form a good opinion on what they are doing, but I do know that I definitely haven't done anything I can remember for the sake of this country. Maybe they're being harmful, maybe not, I don't know, but at the very least I like to think they are trying to be helpful.
  - rodgerd 12y ago
    > In what way are people who work for the NSA not American? Gee, I missed when HN became a US-only site. > They are literally working to protect American citizens from violence. Really?
  - javert 12y ago
    Anyone whose work actively undermines the principles of the US Declaration of Independence and the US Constitution has no moral right to the title "American," though they may be Americans in a legal sense. Ignorance is no excuse, but it is an explanation. I have no doubt that most people at the NSA can accurately claim ignorance. As they say, "The road to Hell is paved with good intentions."
  - brainpan 12y ago
    Outside of the rhetorical zone, outside of the we-can-believe-any-feel-good-idealistic-high-minded-righteous-principles-we-want-as-long-as-we're-just-talking-comfortably zone, this is not true. You know how politicians have a certain style of rhetoric they use when addressing the public? How when they go on talk shows or try to speak about some platform/policy they are tendering to the public, there's this whole pretense of them actually believing in not only that the policy being tendered could work after you elect them and people like them, but also they have these "American" ethics/values, or even sometimes universal ethics, which form their motivation for wanting to be in politics, and wanting to enact policy? I'm asking if you notice the gulf between how politicians speak, and what motives they give you the impression they have, versus how they really feel on the inside. One can say I don't knows how they feel on the inside, yet we've been lied to so many times, and we have seen contradictions between their public rhetoric and their private motivations in the past, that we should actually be considered gullible / abused-victim battered-wives if we take the rhetoric and policy prescriptions for, say, the 2016 elections at face value. I can safely predict that these candidates are pushing policies with a pretense of justice and ethics, yet they are for all literal definitions lying about what they say they believe. I used the sort of politicians you vote for as an example that you should already understand. It shouldn't be controversial that Hillary Clinton and Jeb Bush are actually speaking words from behind a more-electable "persona" that is actually a lie. They effectively "pander" to us by talking about doing things "for America" and "for Americans". We've seen their lies in the past contradicted by their actual actions. Anyway, military and civilian contractors in positions of power in the government need to be understood in this light. "In what way are people who work for the NSA not American?" Simple. No one who is not self-deceived, or deceived by others, works in that way. They are self-interested for the most part. They don't want to help everyone in America; there are millions of people in America they despise. The higher the stakes, the less altruistic they are. Give up your "hard-earned" money in taxes? In private charity? Too high of stakes. They be more likely to help other Americans if the others were "the sort of Americans" they prefer, and they prefer to leave the sort of individuals they don't like, or don't know and don't trust, to fend for themselves. That applies to low-level workers, and it applies also applies to individuals at high levels of power. The fact that individuals at high levels have to use political-style fake rhetoric and personas to be appointed to their contracts and their stations does not mean they actually believe it. What truly motivates them is usually selfish things: attaining more wealth, ownership, control, more agency to mold their personal worlds to their will (cars, country clubs, whatever), and more agency to mold their greater civilization to their will (forcing other people to exist in ways that are more pleasing, or convenient to the powerful). You see, there is no America, in reality. The reality that people fundamentally care about, will care about over the deceptive rhetoric when the chips are down, and that the military serves to exist, is wealth, power, and control. We exist in a planetary civilizaion, but we presently pretend that old national civilizations are what motivate us, even as we take action year-in-and-year-out to further along the globalness of our order: we try to globalize/standardize our finance and governance system over every single individual person in every old nation. So it's global power that motivates the ones in power, and building and preserving their own individual status in the global order that is what they are really beholden to. That is why things like "Homeland Security" and NSA domestic information gathering exist: though the people with their hands on the levers of power here say it's to "protect America," they actually don't love all of America. "When the chips are down, these civilized people will eat each other, you'll see." They can't possibly save all of Americans, and they're building a lockdown-safe domestic order that will treat non-conforming Americans just as poorly as they treat non-conforming non-nationals. They are working to protect themselves from violence, not the "Americans" they pander to. You will be protected precisely to the degree that you endorse and support the global regime, and you will be oppressed precisely to the degree that you resist and combat it. Their professed "to protect America" motive is just a fork-tongued, or sugar-coated, rhetorical device that does not comport to the reality in their own heads when they put their heads down on their silk pillows at night. They are protecting their global economic and political order: corporate power, corporate governance, financialization, ueber alles.
wongarsu 12y ago
>It's just about impossible for an outsider to reverse engineer a hard drive, read the existing firmware, and create malicious versions. It's hard, but it isn't like this hasn't been done before: http://spritesmods.com/?art=hddhack&page=3 http://spritesmods.com/?art=hddhack&page=3 And to be honest, I think what they call "about impossible" is just a question of investing enough time and having a somewhat decent understanding of microprocessors and reverse-engineering. I'm not trying to downplay Equation Group's achievement, but it feels like arstechnica is starting to exaggerate here.
- damurdock 12y ago
  The whole "embedded programming is scary and impossible" sentiment seems to be pretty common these days. I mean, it's impressive, but well within the reach of an interested nation-state or even a skilled hobbyist like Sprite_tm. It seems like the prevalence of modified router firmwares (and botnets based on them) should make it clear that firmware modification is A Thing That Happens(TM).
  - tptacek 12y ago
    Anyone who thinks this kind of work requires nation-state backing should look at the (hobbyist!) projects to jailbreak the Xbox, X360 and PS3. Low-level kernel- and hypervisor- programming in which obstacles are casually overcome by dropping zero-day memory corruption bugs in core libraries that would be worth tens of thousands of dollars today just from bounty programs, deploying crypto bugs that make "custom RC5" and "thousands of iterations of SHA1" look like the shoplifted- from- Schneier technique that it appears to actually be (TEA hash collision, ECDSA nonce repeats, &c). And these were, more or less, student side projects.
    - venomsnake 12y ago
      Piracy and cheating has always been gateway to serious programming.
      - trvz 12y ago
mabbo 12y ago
I'm pretty sure intercepting and screwing with mail is a felony... isn't that a felony? How exactly can the US Government have it's employees committing felonies with no warrants or oversight?
- ForHackernews 12y ago
  There are likely secret warrants in FISA court.
  - morcheeba 12y ago
    I used that line to explain to the police officer why I had been sticking raw fish in my neighbors mail. Luckily, he did not have the necessary security clearance to dispute my claim.
  - AlyssaRowan 12y ago
    That doesn't really explain the US researchers infected with this.
    - teraflop 12y ago
      That's what the FISA court is for: to issue secret warrants for surveillance of US citizens' domestic communications.
      - mox1 12y ago
        FISA is for Foreigners outside of US soil. You literally are exactly incorrect.
        maxerickson 12y ago
        No, it only applies on US soil. It's aimed at the communications of foreign powers that involve a person on US soil or somehow else take place on US soil.
        etjossem 12y ago
ForHackernews 12y ago
This is pretty intense malware, but at some level it's reassuring how narrowly-targeted these attacks seem to be. Arguably, this is what the NSA is supposed to be doing: targeted attacks against key systems in hostile nations, not mass dragnet-surveillance of everyone on the Internet.
- sparaker 12y ago
  The general rule is infect everyone, monitor you want to. They want to have options lol.
- letstryagain 12y ago
  Hostile nations now include Belgium and the UK apparently
aselzer 12y ago
While this is undoubtedly scary, it looks very Windows-specific and would seem unlikely to affect a somewhat security-conscious Linux user. Java and IE exploits, autorun files, NTFS... > The malicious firmware created a secret storage vault that survive > military-grade disk wiping and reformatting, making sensitive data > stolen from victims available even after reformatting the drive and > reinstalling the operating system. And that's why it's possibly not the greatest idea to replace simple firmware and drivers with small operating systems (Intel AMT, microcode, SSDs, Smart TVs etc.).
- fragsworth 12y ago
  The attacks were highly specific to the targets they were going after. It's a large team with massive resources - if you become a target, being a Linux user will not protect you from their attacks.
- wongarsu 12y ago
  I suspect that most of their targets use Windows, so we have more malware samples from Windows hosts. The article specifically mentions that they heavily suspect that a Mac malware exists, yet they haven't found it yet. Consequently we don't know which exploits they use to get on Macs. They also talk about a wide range of servers being infected, only attacking Windows servers would be very limiting. My best guess is that if you are a target, using Linux makes their work harder but not impossible. They had over a decade to figure this out and vulnerabilities in Linux software are found all the time.
  - AlyssaRowan 12y ago
    Actually, I think they quite like high-uptime Linux peers for their C&Cs.
  - aselzer 12y ago
    The site shows a PHP script targeting vbulletin. Obviously there are lots of ways of attacking servers, especially if they run PHP applications and such. There was once a PDF exploit for iOS that made it possible to jailbreak the phone (or run any code) if the user opened a PDF, so the PHP program could have been redirecting to something like this. Linux malware would probably have a much lower effectiveness / $, so it doesn't pay off for them.
ChuckMcM 12y ago
Interesting to compare the sophistication of this malware and physical weapon systems such as the Tomahawk cruise missile. One video of cluster munitions shows how the munitions try to attack armor, then vehicles, then groups of people, and then land to become pop up landmines. [1] One has to assume that the capabilities of the other actors is similar. Makes for a pretty scary picture when you think about it. [1] https://www.youtube.com/watch?v=CY9gojFu-_U https://www.youtube.com/watch?v=CY9gojFu-_U
- harkyns_castle 12y ago
  Admittedly I've had a few beers, but what was going on there? It looked like a chaff device or something. I didn't see the massive destruction I was hoping for.
deleted 12y ago
[deleted]
grandalf 12y ago
I think the lesson here is not so much that governments can do this, but that entities with extremely large budgets are implementing broad, interconnected initiatives like this. I think realistically any entity with over $20M could participate meaningfully in these kinds of exploits. The key is that in order to be useful many overlapping initiatives need to exist. It seems like exploiting things like firmware would be pretty easy: You just get a member of your team who is a bit overqualified to apply for a job at the target company. A relatively small team could accomplish this in a few years, aided by the scarcity of top tier engineering talent. The hard part is the social aspect of the attacks, but a single clever individual can come up with many.
- RockyMcNuts 12y ago
  well, in TFA it's a little easier for the NSA than embedding a mole, NSA just tells WD they want to buy drives, but need to audit all the source code including firmware for security issues, then modifies firmware, then intercepts hardware orders from targets and replaces them with ones with compromised firmware.
  - grandalf 12y ago
    True, but I think it makes more sense to look at these tactics in the most general way possible. Firms could be doing them, as could much smaller governments. Most press about itesec is focused on individual vulnerabilities and the tactics used in specific exploits. What we're seeing is tremendous "long game" strategic sophistication. Stuxnet was one example of using many attack vectors to eventually achieve a goal and these revelations suggest that was just the beginning. Sure, intercepting the mail could be difficult, but all it takes is a few compromised UPS drivers and warrants are no longer needed.
peterwwillis 12y ago
I feel bad for the people that work for groups like this. Sure, you get to hack every developed nation in the world and are privy to the most sensitive information in the world. You're also therefore the world's largest liability, and your life is probably very expendable compared to the data you're retrieving. They might have a unique identity just for picking up milk.
ingler 12y ago
I don't know what's more disturbing: the fact that US government does this with impunity or the fact that a sizable group of technically competent citizens defends it.
- azinman2 12y ago
  I'm for it when it doesn't target only US tech like we see here... that harms trade. I'm an American and thus I benefit... plus I think the skills are awesome (to me the tapping optical fiber without cutting it off is more impressive, however). The attack is just like any other malware attack at that point, which everyone will always need to defend better against. If anything this creates a better challenge for SV & tech in general to react to. Apple already has responded and is making it harder to intercept which is good for everyone in the long-run. The US might just be the first ones discovered with it, but to think that no one else will also figure it out (nation-state or not) is very unlikely. Internet + digitized everything makes our current paradigm vulnerable unless everything starts getting more secure.
- pgwhalen 12y ago
  I think the "sizable group of technically competent citizens" realizes that espionage between nation-states is as old as nation-states themselves, and that because of the nature of humanity, it's not going away anytime soon.
  - ingler 12y ago
    It's also where the money is. Getting paid to do the wrong thing is also an old trait of humankind. Remember Google's original motto? Whatever happened to that?
- sheensleeves 12y ago
  Harder to count HN support for a political side, than to count people at a rally. (Sock puppets.)
- LLWM 12y ago
  It disturbs you that other people have different political views than you do?
balls187 12y ago
Anyone get the feeling that at this point, the NSA et al, have moved onto even more sophisticated attacks?
- leroy_masochist 12y ago
  Given that the unearthed program is a decade and a half old, I definitely get that feeling.
  - laurent123456 12y ago
    I'm picturing the NSA engineers laughing at the "advanced hacking" Kaspersky just unearthed, meanwhile working on stuff that would blow our mind and that we'll only discover 20 years from now.
    - chii 12y ago
      i can't imagine how my mind can be blown any more than it already has.
      - balls187 12y ago
        Skynet?
shiven 12y ago
Takeaway lesson #1: re-flash all HDDs/SSDs with verified vanilla firmware from original manufacturer. Lesson #2: Beware any and all data media, CDs, DVDs (Netflix? Blockbuster? Hollywood screeners? ...?), USB drives.
- rasz_pl 12y ago
  #1 using Jtag, nothing else will matter, and even then it will only work until your drive is reflashed again in another attack. Best way to secure HDD would be modifying firmware to DISABLE firmware upgrades and external access to service area permanently. Afaik HDDs keep some executable modules stored on HDD platters, that means 'simply' cutting WR leg on eprom chip is not enough. We are talking quite significant firmware rewrite here.
- mhomde 12y ago
  Couldn't you secure yourself by say running an OS image with a truecrypt partition?
- flurpitude 12y ago
  Lesson #3: Don't order computer hardware or software isntallation disks by mail. Walk into a shop without warning them you're coming.
logicallee 12y ago
do we really need to encourage people to go into this line of work with language like this: >A long list of almost superhuman technical feats illustrate Equation Group's extraordinary skill, painstaking work, and unlimited resources. with the effort these people spend contributing next to zero value in the world (strongly negative value if you add up all the energy wasted on all sides including their 'enemies'; if all these sides spent the same resources on positive constructive research instead, we would be ahead). This genius could be applied to making a compiler/interpreter that just does what you're trying to do, regardless of whether you're a programmer. it's a binary choice: have these people perform 'superhuman' feats of self-destruction and obfuscated encryption and finding zero-days.... ... or give humanity the tools that every one of the seven billion people on it can instantiate any idea in seconds and have it actually be correctly interpreted and done. Resources are spent tricking people so they don't notice something. Where are the resources being spent helping people do what they're trying to? The example I always go to is: since the creation of the United States, how much inter-state (Iowa and Massachusetts) spying, warmaking, border control, etc, is wasted? Could this have something to do with its performance over the last couple of centuries? I think of these types of programs as 'welfare for geniuses'. give them an office and something to do. but for God's sake, spit them out again. The optimal amount of state spying is, let's face it, much closer to zero than its current levels. Spend on enough universal education that everyone shares values and nobody is destructive; put the rest into fundamental research and development. I don't mind that the government exists to do research, employ people, and keep the world safe. But put some limits on it, and please don't encourage this with language like I quoted at the top. humanity has better things to do with its time. nobody wants to live in a prison.
gloriousduke 12y ago
Just think, a member of the group is probably reading this thread right now...
- robertmgreen5 12y ago
  hahahaha...
  - dhimes 12y ago
    This made me LOL
- rasz_pl 12y ago
  Looking at the timeline Im guessing they were recruited under cover of Darpa from regular Defcon attendees. L0pht is a good example, Mudge probably was involved at one point, he lured a lot of geeks and hackers to the dark side.
packetized 12y ago
Scalpel, not a sledgehammer.
adambatkin 12y ago
We definitely throw our weight around and interfere with Iran's domestic affairs. But this is definitely a case of "we think our morals are better than yours" (and we have bigger guns so we're gonna enforce those morals). The Iranian government funds terrorist groups around the world, and has called for the destruction of certain other countries. So yeah, if we have the ability to stifle them (particularly their nuclear ambitions) I say we go for it. I do feel bad for many of the Iranian people. Many of them do not like their government and are therefore held hostage by the events around them, which they have no control over, and may disagree with.
- Ar-Curunir 12y ago
  Hmm, and what about the Saudi government that actually does fund terrorist activities and opposes almost everything that America claims to stand for? America is fine with propping up that regime, so why is Iran an issue, when from everything that I've read and experienced (12 years in the Middle East) there have been no implications of Iran in modern terrorist activities? What moral have high ground can you take then?
  - somebehemoth 12y ago
    "when from everything that I've read and experienced (12 years in the Middle East) there have been no implications of Iran in modern terrorist activities?" - Iran does not recognize Israel. - Iran supplies political support and weapons to Hamas,[14] an organization classified by Israel, the United States, Canada, the European Union and Japan as a terrorist organization. Mahmoud Abbas, President of the Palestinian National Authority, has said "Hamas is funded by Iran. It claims it is financed by donations, but the donations are nothing like what it receives from Iran".[15] From 2000 to 2004, Hamas was responsible for killing nearly 400 Israelis and wounding more than 2,000 in 425 attacks, according to the Israeli Ministry of Foreign Affairs. From 2001 through May 2008, Hamas launched more than 3,000 Qassam rockets and 2,500 mortar attacks into Israel.[16] - Iranian proxies killed an estimated 1,100 US troops in Iraq.[35] In addition, insurgents supported by Iran reportedly committed acts of terrorism.[34][36][37] Lots more here: http://en.wikipedia.org/wiki/Iran_and_state-sponsored_terrorism http://en.wikipedia.org/wiki/Iran_and_state-sponsored_terror... I am not claiming these are all fact, but I think there is little doubt that they are at least "implications" as you put it. (edited for formatting.)
rl3 12y ago
I'm surprised the CPU microcode angle isn't mentioned.
- teraflop 12y ago
  Has there ever been a non-theoretical use of microcode in malware? I would expect it to be difficult for a lot of reasons (the maximum microcode size is probably quite limited; the format is extremely proprietary; and there's only so much overhead you can add at the instruction level before you start causing a noticeable slowdown). Also, microcode updates aren't retained when the system is powered, so you still need to have a persistent backdoor installed at the OS level. Given that, it's not clear what additional benefit a microcode backdoor would provide.
  - kw71 12y ago
    If you are going to modify a BIOS, then the BIOS can apply the microcode update. No need to tamper with OS then.
  - rl3 12y ago
    > Has there ever been a non-theoretical use of microcode in malware? Not to my knowledge. Indeed, the difficulty involved as well as proprietary nature of the format seems to indicate such an attack vector would be restricted to only the most sophisticated actors. So, it's no wonder that there are no real-world examples, assuming that they even exist in the first place. > Also, microcode updates aren't retained when the system is powered, ... While true, I don't necessarily see this as a fatal blow to the attack vector's utility. Without delving into raw speculation, I'm sure there's plenty of clever ways to craft attacks unique to what microcode affords. That said, it seems likely that microcode attacks would be treated more as a specialized capability augmenting something like what the article outlines, rather than a method of attack unto itself.
  - rasz_pl 12y ago
    You 'only' need one instruction compromised/customized to be able to breach ring barrier/take over mmu.
Iknowitall 12y ago
What is the NSA is doing here is more subtle and I do not think they fully realize it. They are heavily financing and accelerating the speed of damages that people on the dark side can do. They are "inspiring" a bunch of curious teenagers (in the best case) or a bunch of cyber criminals (in the worst case) to create another malware like that. They are putting out there first of all the ideas, second the conviction that it is possible to do so, and third sample code to study, improve and deploy. This race to being the "smarter" spy is unfortunately leading us in a very risky world to live in. A lose-lose preposition. The press and the antivirus researchers are also not being too smart here to make this public available.
- Iknowitall 12y ago
  By the way, would you put a bunch of secret technology (maybe a new bomb) partially hidden in a manhole in the middle of the street, just in case a spy passing by needs to use it? That is pretty much what they are doing here... code is easy to move around and to copy. Today (or in relatively short amount of time) who wants that code bad enough will be able to find it. That technology that took yeas and million of dollars to develop is now available to the bad guys. Face palm!
nadaviv 12y ago
One of the images [0] in the article identifies a C&C server used by the attackers, technology-revealed.com. The script appears to embed an invisible iframe pointing to a page on that domain, which probably infects the machine using some zero-day exploit on the browser or one of its plugins. The domain is still registered, but appears not to be running an HTTP server anymore. Might be interesting to investigate if someone wants to look into that. [0] http://cdn.arstechnica.net/wp-content/uploads/2015/02/malicious-php-script-1280x719.jpg http://cdn.arstechnica.net/wp-content/uploads/2015/02/malici...
- compbio 12y ago
  The article also mentions fanny.bmp as an NSA exploit. Here a post from 2010 [1] from someone who encountered this virus on an USB stick and saved the virus: https://forum.lowyat.net/topic/1488855/all https://forum.lowyat.net/topic/1488855/all
grandalf 12y ago
The point isn't whether we should be surprised this is the NSA, the interesting thing is that this layered strategy is what you do if you have access to lots of money and talent.
datashovel 12y ago
I would like to ask anyone reading this to hypothesize with me. What if the US government was broadly and knowingly corrupt? How comfortable would you feel knowing that they had such broad and powerful technical capabilities? How would you fight against such a machine, to uproot the corruption? I'm in awe of these technical feats, but also cautious about the implications of an all-knowing, all-powerful government presence who can infringe on your basic rights at-will.
- Cthulhu_ 12y ago
  It's not a what-if actually, the US government - or at least the higher-ups, like the senate - are bought by those with money. And buying votes / power / votes is the core principle of corruption.
  - datashovel 12y ago
    I didn't want to sound too presumptuous when I wrote the comment, but I would agree the current state of things is far from ideal.
rey12rey 12y ago
Equation Group: Questions and Answers by Kaspersky [pdf] --> https://cdn1.vox-cdn.com/uploads/chorus_asset/file/3415904/Equation_group_questions_and_answers.0.pdf https://cdn1.vox-cdn.com/uploads/chorus_asset/file/3415904/E...
harkyns_castle 12y ago
Might as well tattoo a UUID on our foreheads and be done with it at this rate. God I hate hearing the apologists for the NSA in these threads. Are you so devoid of empathy?
- harkyns_castle 12y ago
  Downvote all you like. I'm over this, and I'm getting out of the IT game. If everything I do can be taken at will by a far more powerful, and greedy, team than I can do anything about, what is the point. Time for a change of career. I've always wanted to protect our dying forests and species in any case. Renouncing my US citizenship too. This is all too disgusting.
  - iak8god 12y ago
    > Renouncing my US citizenship too. Statements like this make it hard to take your comment seriously, but I'm going to try. > Time for a change of career. I've always wanted to protect our dying forests and species in any case. What makes you think you can do anything about this? If you're in tech, it's likely that's where your training, experience, and interests lie and so that's where you're likely to be most effective for now. Why not spread awareness of issues that concern you and work with like-minded people to do what you can. Do you think your fancy new career protecting the environment won't involve working against powerful and greedy opponents?
- nhstanley 12y ago
  Empathy for whom? I know pacifists want to believe we live in a post-war world, and if only we would not make guns or do the kind of things the NSA is doing here we'll suddenly live in a perfect world—but by what fantastical mechanism do you actually think that will happen?
  - harkyns_castle 12y ago
    The old pacifist keyword, its a bit like the communist keyword. The only war we have at the moment is the one you (assuming you're a shill) created and want to sustain. Because if you don't, it all falls down. Its about the US dollar, and oil.
ilitirit 12y ago
How can one detect infection?
anton000 12y ago
Wasn't there a demonstration of a similar HDD exploit posted on HN earlier? edit: found it https://news.ycombinator.com/item?id=8665865 https://news.ycombinator.com/item?id=8665865
oglees 12y ago
Absolutely! I live in Bulgaria, Eastern Europe, a poor, small country, which has been accepted in NATO and the European Union, but still is hosted by the past-Soviet`s secret intelligence services of Moscow, which are now illegal, but has agents and the absolute power over the legal secret services in Bulgaria. The surveillance is much larger, than in the USA, but all the info goes to Moscow. So, what are you troubling about, when NSA is pure American, and has the purpose to protect you from the legions of Russian, Chinese hackers - officially military, or just playing and stilling criminals, and all the Islamic recruiters, who are trying to recruit American citizens for their Jihad against The Civilization... I don`t understand, are you stupid, people, or what? NSA has the duty to protect you, and you are acting as children, whom parents has been installed a security program on your PC, to protect you from pedophiles... It`s the same case with the NSA surveillance!
n1x0n997 12y ago
So there is this new shodan-like database that takes data from massive scans of the Internet (I think?) etc... Might be worth running all C&Cs through it to discover more domains , for example https://rateip.com/ipv4/190.60.202.4 https://rateip.com/ipv4/190.60.202.4

870 points by privong 12y ago

The update confirms it is the NSA. It is incredible, even the most generous estimation of the NSA's capabilities before the Snowden disclosures now look conservative. This is the stuff conspiracy theories are made of.

sumitviii 12y ago
How do they even sift through all the information they get? It has to be a LOT.
- relaunched 12y ago
  This particular set of exploits has little to do with collecting information. This seems to be directly related to command and control operations, including over systems that aren't connected to the internet. There are a pretty scary set of discovered exploits.
  - sumitviii 12y ago
    I believe this is not the correct thread, but how can anyone sift through so much data, in general? Private companies need simpler things, like people you are likely to know in the real world, from the data they acquire. But intelligence agencies need actionable intelligence. That would require something way more intelligent than a simple spam filter.
    - scott_karana 12y ago
      They don't necessarily need actionable intelligence: just supportive evidence to back up recon/threats/blackmail as part of other agency's actions.
    - lbotos 12y ago
      I think that's the goal of firms like Palantir. To help filter that volume of data.
    - wongarsu 12y ago
      That depends on the data you are talking about. The operations described here don't seems to collect huge amounts of data. If you're talking about the usual dragnet surveillance: a lot of it seems to be relatively simple filters and simple data correlation. For example, you can build huge social graphs with simple metadata. Then you can search for all people who communicate a lot with people who communicate a lot with some known terrorist leader. Of those people, you take just those using tor. If any of them plans to enter the US, you flag them to be detained and searched at the airport. If any of them is already in the US, you can tell FBI to check them out. Or you can look for sudden changes in message volumes. If terrorist leader A suddenly starts to communicate a lot more with random person B and random person C, who in term start communicating with other people, you suddenly have a whole list of people who might be planning a terrorist operation. Of course you still need huge computing capacity even for these relatively simple operations, but they certainly have the funds for a few datacenters.
    - Estragon 12y ago
      > intelligence agencies need actionable intelligence For the most part that hasn't really been how it's worked so far. Generally intelligence agencies have used the information they've gathered so far to try to manipulate people.
- rodgerd 12y ago
  Given that they appear to have basically perfect ability to gather data, there's got to be some reason we keep having successful terrorist attacks.
  - deleted 12y ago
    [deleted]
  - andrewchambers 12y ago
    Because the serious terrorists avoid anything that may be snooped.
    - rodgerd 12y ago
      So it's a huge waste of money usable only against non-terrorists?
      - jacquesm 12y ago
        That's a pretty good summary.
      - fit2rule 12y ago
        Its only really useful against non-terrorists, but that doesn't mean its a waste of money: if it is used to make money. So maybe its being used to make money - i.e. targetting non-terrorists (i.e. industrial espionage) - precisely because it is a huge waste of money. Wow, its almost like the whole thing was just a bad idea in the first place - its become self-serving.
      - AnimalMuppet 12y ago
        No, it's useful against terrorists whose trade-craft is less than perfect. That's many of them.
  - JabavuAdams 12y ago
    SIGINT won't won't detect two people conspiring in a bug-free room.
- danielayoub 12y ago
  Data mining algorithms. Remember, they're the world's largest employer of mathematicians.
  - sumitviii 12y ago
    Data interpretation is NLP, not maths.
    - scott_karana 12y ago
      NLP is implemented with logical and statistical modelling. How is it a realm of anything but math? ;) Edit: if you meant that data interpretation is NP, I agree.
      - deleted 12y ago
        [deleted]
    - crazypyro 12y ago
      NLP's foundation is in statistics, so calling it "not maths" seems rather short-sighted. Mathematics, especially statistics, play a crucial role in all data interpretation when you get to any kind of scale and they seem to be the biggest of them all.....
  - gwern 12y ago
    'were', I think, may be more operative. I first heard that statistic about a long time ago, more like the '70s. Mathematicians don't seem to be very useful to the NSA's current hacker paradigm. (Note what we haven't gotten from the Snowden leaks so far: any sort of major mathematical or theoretical advance. Amazing hacking infrastructure, though.)
    - Estragon 12y ago
      Given Snowden's stated values, it's highly unlikely that he would report such a breakthrough.
- pixl97 12y ago
  Had a family member that worked for SPEA (test equipment manufacture). Said different government organizations would bring in boards with massively parallel sets of chips and input/output on them, like nothing they ever saw in any other field. They were expressly forbidden to take pictures of them. Between that and the massive data centers they are building I'm guessing they have rather impressive capabilities.
AlyssaRowan 12y ago
UR = UNITEDRAKE ("Regin", basically?). And that'd probably be rmgree5@nsa.gov: that's the format their addresses are in. This does seem to be, broadly-speaking, NSA's top-dollar brand-new 0-day-laden (at the time) malware, that they use to launch their less shiny stuff, which is more awkward and a massive overfunded modular boondoggle. This does not seem to be as freely shared around with the "Five Eyes". By the way, there are innocent machines in the US infected with this thing, at this very moment. Anyone care to explain that? The hard-drive component should be completely detectable, if you don't boot from it, based on the (small, sadly incomplete) fragment of (Cortex-M0?) stuff I've seen. Power-cycle it, send an ATA reset, read the MBR and following sectors. Look out for the NIC "option rom" persistence module, too - you may be well-advised to do it from something really exotic that doesn't run x86, just in case! (Independent hackers are running (µ)Linux on hard disks now, so it's not surprising a huge agency able to spend billions of dollars of tax money funding contractors on tiny pieces of this project got something of a head start!) Not sure of a good way to detect it in software, but it's not perfect, so it probably can be redpilled somehow. Watch for "CD-ROM"s that unexpectedly have ATIPs, I guess?
- deleted 12y ago
  [deleted]
- final 12y ago
  >> By the way, there are innocent machines in the US infected with this thing, at this very moment. Nobody is innocent. The government has enemies both internal and external.
- wongarsu 12y ago
  Detecting an infected hard drive in software would be the usual malware arms race: you find some characteristic of it, they improve the firmware. But if we start to systematically check for it, it should be easy to discover via hardware debugging. Find the JTAG interface on the hard disk controller (or whatever debugging interface the specific processor uses), dump the firmware and compare it to firmware dumps from other hard drives of the same model. I don't see how they could fool that process (given that you have a clean machine to read out the firmware). Of course to be thorough you would have to check pretty much the firmware of every component of the computer.

thejaredhooper 12y ago

What's worse is the fact that this would be more terrifying if this weren't an action to the NSA's credit. Chinese, British, and Russian governments also have the capability of developing intrusive malware at such a scale. I see that this is confirmed as the NSA, but the world has been awfully silent on the intrusiveness of Chinese malware practices. You can not travel safely in China without your domestic devices being breached, yet we don't hear about large-scale projects from their government, which also possesses "near limitless resources" at their disposal. I just think it's interesting there's so much attention on the NSA.

sumitviii 12y ago
People would be angry even if they didn't know that Equation Group was part of the NSA.

deleted 12y ago

[deleted]

yeahyeah 12y ago

This is exactly what the NSA should be doing. Everyone (rightfully IMO) complains about overly broad data collection happening within the USA, but here (as with stuxnet) you have the exact opposite, a targeted foreign activity conducted with care and targeting. I know it's not for everyone (not least because not everyone is in the states, huh), and it could be considered a bad precedent, but it's not like Iran asked our permission before they launched their nuclear program, or other states are actually waiting on the US's example to have their own intelligence services do their jobs. If you hold that something like 9/11 should be prevented, and that (actual) WMD programs should be stalled, then it follows that this is a fine way to go about it.

Alex3917 12y ago
> It's not like Iran asked our permission before they launched their nuclear program You do realize the U.S. helped launch Iran's nuclear program, right? http://en.wikipedia.org/wiki/Nuclear_program_of_Iran http://en.wikipedia.org/wiki/Nuclear_program_of_Iran
- yeahyeah 12y ago
  Well if it's on the US then they should have stopped when we asked nicely, right?
  - FeeTinesAMady 12y ago
    Not right. If the US was peaceful, there wouldn't be much of an argument for developing nuclear weapons, but the US is the most aggressive nation in the world, and nuclear weapons are the only thing that give them pause. The actions of the US since the end of World War II - invading other nations at will, interfering in their internal affairs, starting secret wars - give legitimacy to nations who want to develop nuclear weapons for their own defense. Nuclear weapons bring safety from you.
    - allemagne 12y ago
      As far as superpowers in history go, the United States post WWII is downright benevolent. The other contenders in recent memory being: the Soviet Union, the British Empire, Nazi Germany, Imperial Japan, the French Empire, the Italian Empire, Austria-Hungary, and so on and so forth. Once the United States starts claiming pieces of South America and Arabia as their sovereign territory you can start shouting about Iran's self defense. The United States is far from perfect, and all the criticisms you leveled are completely true. But be honest about the situation. The only thing that Iran's government is protecting by developing nuclear weapons is their own corrupt regime and their influence in the middle east.

rosenjon 12y ago

Based on the article, are we to presume that this only affects tech in hostile countries? Or are they doing this to US-based equipment as well? Seems like this will backfire spectacularly when foreign countries and companies stop buying American made tech for fear of these hardware backdoors. Spectacularly irresponsible.

teraflop 12y ago
According to the report, the malware was delivered to researchers in dozens of countries, including the UK, India, Mexico, Switzerland, France, and the US itself.
netman21 12y ago
Check out bannanaglee. Backdoors in Juniper and Cisco gear. Yes, already having an impact.
Buge 12y ago
Would this really be considered a hardware backdoor?
jrochkind1 12y ago
Wait, is Mexico a "hostile country"?
- leroy_masochist 12y ago
  Their central government is not hostile to the United States; cartels and certain cartel-influenced local governments certainly are.
  - jrochkind1 12y ago
    There are of course entities hostile to the United States in every country, including the United States.

gnu8 12y ago

We should all be aware of the fact that these people are the enemy. They don't do these things to "protect freedom", they do them to destroy freedom. Most of the people on Hackernews are uniquely placed to resist. Secure your software. Refuse to cooperate unless legally compelled. Analyze and publish any evidence of government attacks. If you work for the NSA, understand this: you aren't American. You are the Internet Daesh. You will lose.

rifung 12y ago
In what way are people who work for the NSA not American? They are literally working to protect American citizens from violence. While you may not agree with their methods, saying you are somehow "more" American than they are, let alone that they aren't American at all is a huge stretch. I think I'm too young and naive to really form a good opinion on what they are doing, but I do know that I definitely haven't done anything I can remember for the sake of this country. Maybe they're being harmful, maybe not, I don't know, but at the very least I like to think they are trying to be helpful.
- rodgerd 12y ago
  > In what way are people who work for the NSA not American? Gee, I missed when HN became a US-only site. > They are literally working to protect American citizens from violence. Really?
- javert 12y ago
  Anyone whose work actively undermines the principles of the US Declaration of Independence and the US Constitution has no moral right to the title "American," though they may be Americans in a legal sense. Ignorance is no excuse, but it is an explanation. I have no doubt that most people at the NSA can accurately claim ignorance. As they say, "The road to Hell is paved with good intentions."
- brainpan 12y ago
  Outside of the rhetorical zone, outside of the we-can-believe-any-feel-good-idealistic-high-minded-righteous-principles-we-want-as-long-as-we're-just-talking-comfortably zone, this is not true. You know how politicians have a certain style of rhetoric they use when addressing the public? How when they go on talk shows or try to speak about some platform/policy they are tendering to the public, there's this whole pretense of them actually believing in not only that the policy being tendered could work after you elect them and people like them, but also they have these "American" ethics/values, or even sometimes universal ethics, which form their motivation for wanting to be in politics, and wanting to enact policy? I'm asking if you notice the gulf between how politicians speak, and what motives they give you the impression they have, versus how they really feel on the inside. One can say I don't knows how they feel on the inside, yet we've been lied to so many times, and we have seen contradictions between their public rhetoric and their private motivations in the past, that we should actually be considered gullible / abused-victim battered-wives if we take the rhetoric and policy prescriptions for, say, the 2016 elections at face value. I can safely predict that these candidates are pushing policies with a pretense of justice and ethics, yet they are for all literal definitions lying about what they say they believe. I used the sort of politicians you vote for as an example that you should already understand. It shouldn't be controversial that Hillary Clinton and Jeb Bush are actually speaking words from behind a more-electable "persona" that is actually a lie. They effectively "pander" to us by talking about doing things "for America" and "for Americans". We've seen their lies in the past contradicted by their actual actions. Anyway, military and civilian contractors in positions of power in the government need to be understood in this light. "In what way are people who work for the NSA not American?" Simple. No one who is not self-deceived, or deceived by others, works in that way. They are self-interested for the most part. They don't want to help everyone in America; there are millions of people in America they despise. The higher the stakes, the less altruistic they are. Give up your "hard-earned" money in taxes? In private charity? Too high of stakes. They be more likely to help other Americans if the others were "the sort of Americans" they prefer, and they prefer to leave the sort of individuals they don't like, or don't know and don't trust, to fend for themselves. That applies to low-level workers, and it applies also applies to individuals at high levels of power. The fact that individuals at high levels have to use political-style fake rhetoric and personas to be appointed to their contracts and their stations does not mean they actually believe it. What truly motivates them is usually selfish things: attaining more wealth, ownership, control, more agency to mold their personal worlds to their will (cars, country clubs, whatever), and more agency to mold their greater civilization to their will (forcing other people to exist in ways that are more pleasing, or convenient to the powerful). You see, there is no America, in reality. The reality that people fundamentally care about, will care about over the deceptive rhetoric when the chips are down, and that the military serves to exist, is wealth, power, and control. We exist in a planetary civilizaion, but we presently pretend that old national civilizations are what motivate us, even as we take action year-in-and-year-out to further along the globalness of our order: we try to globalize/standardize our finance and governance system over every single individual person in every old nation. So it's global power that motivates the ones in power, and building and preserving their own individual status in the global order that is what they are really beholden to. That is why things like "Homeland Security" and NSA domestic information gathering exist: though the people with their hands on the levers of power here say it's to "protect America," they actually don't love all of America. "When the chips are down, these civilized people will eat each other, you'll see." They can't possibly save all of Americans, and they're building a lockdown-safe domestic order that will treat non-conforming Americans just as poorly as they treat non-conforming non-nationals. They are working to protect themselves from violence, not the "Americans" they pander to. You will be protected precisely to the degree that you endorse and support the global regime, and you will be oppressed precisely to the degree that you resist and combat it. Their professed "to protect America" motive is just a fork-tongued, or sugar-coated, rhetorical device that does not comport to the reality in their own heads when they put their heads down on their silk pillows at night. They are protecting their global economic and political order: corporate power, corporate governance, financialization, ueber alles.

wongarsu 12y ago

>It's just about impossible for an outsider to reverse engineer a hard drive, read the existing firmware, and create malicious versions. It's hard, but it isn't like this hasn't been done before: http://spritesmods.com/?art=hddhack&page=3 http://spritesmods.com/?art=hddhack&page=3 And to be honest, I think what they call "about impossible" is just a question of investing enough time and having a somewhat decent understanding of microprocessors and reverse-engineering. I'm not trying to downplay Equation Group's achievement, but it feels like arstechnica is starting to exaggerate here.

damurdock 12y ago
The whole "embedded programming is scary and impossible" sentiment seems to be pretty common these days. I mean, it's impressive, but well within the reach of an interested nation-state or even a skilled hobbyist like Sprite_tm. It seems like the prevalence of modified router firmwares (and botnets based on them) should make it clear that firmware modification is A Thing That Happens(TM).
- tptacek 12y ago
  Anyone who thinks this kind of work requires nation-state backing should look at the (hobbyist!) projects to jailbreak the Xbox, X360 and PS3. Low-level kernel- and hypervisor- programming in which obstacles are casually overcome by dropping zero-day memory corruption bugs in core libraries that would be worth tens of thousands of dollars today just from bounty programs, deploying crypto bugs that make "custom RC5" and "thousands of iterations of SHA1" look like the shoplifted- from- Schneier technique that it appears to actually be (TEA hash collision, ECDSA nonce repeats, &c). And these were, more or less, student side projects.
  - venomsnake 12y ago
    Piracy and cheating has always been gateway to serious programming.
    - trvz 12y ago

mabbo 12y ago

I'm pretty sure intercepting and screwing with mail is a felony... isn't that a felony? How exactly can the US Government have it's employees committing felonies with no warrants or oversight?

ForHackernews 12y ago
There are likely secret warrants in FISA court.
- morcheeba 12y ago
  I used that line to explain to the police officer why I had been sticking raw fish in my neighbors mail. Luckily, he did not have the necessary security clearance to dispute my claim.
- AlyssaRowan 12y ago
  That doesn't really explain the US researchers infected with this.
  - teraflop 12y ago
    That's what the FISA court is for: to issue secret warrants for surveillance of US citizens' domestic communications.
    - mox1 12y ago
      FISA is for Foreigners outside of US soil. You literally are exactly incorrect.
      - maxerickson 12y ago
        No, it only applies on US soil. It's aimed at the communications of foreign powers that involve a person on US soil or somehow else take place on US soil.
      - etjossem 12y ago

ForHackernews 12y ago

This is pretty intense malware, but at some level it's reassuring how narrowly-targeted these attacks seem to be. Arguably, this is what the NSA is supposed to be doing: targeted attacks against key systems in hostile nations, not mass dragnet-surveillance of everyone on the Internet.

sparaker 12y ago
The general rule is infect everyone, monitor you want to. They want to have options lol.
letstryagain 12y ago
Hostile nations now include Belgium and the UK apparently

aselzer 12y ago

While this is undoubtedly scary, it looks very Windows-specific and would seem unlikely to affect a somewhat security-conscious Linux user. Java and IE exploits, autorun files, NTFS... > The malicious firmware created a secret storage vault that survive > military-grade disk wiping and reformatting, making sensitive data > stolen from victims available even after reformatting the drive and > reinstalling the operating system. And that's why it's possibly not the greatest idea to replace simple firmware and drivers with small operating systems (Intel AMT, microcode, SSDs, Smart TVs etc.).

fragsworth 12y ago
The attacks were highly specific to the targets they were going after. It's a large team with massive resources - if you become a target, being a Linux user will not protect you from their attacks.
wongarsu 12y ago
I suspect that most of their targets use Windows, so we have more malware samples from Windows hosts. The article specifically mentions that they heavily suspect that a Mac malware exists, yet they haven't found it yet. Consequently we don't know which exploits they use to get on Macs. They also talk about a wide range of servers being infected, only attacking Windows servers would be very limiting. My best guess is that if you are a target, using Linux makes their work harder but not impossible. They had over a decade to figure this out and vulnerabilities in Linux software are found all the time.
- AlyssaRowan 12y ago
  Actually, I think they quite like high-uptime Linux peers for their C&Cs.
- aselzer 12y ago
  The site shows a PHP script targeting vbulletin. Obviously there are lots of ways of attacking servers, especially if they run PHP applications and such. There was once a PDF exploit for iOS that made it possible to jailbreak the phone (or run any code) if the user opened a PDF, so the PHP program could have been redirecting to something like this. Linux malware would probably have a much lower effectiveness / $, so it doesn't pay off for them.

ChuckMcM 12y ago

Interesting to compare the sophistication of this malware and physical weapon systems such as the Tomahawk cruise missile. One video of cluster munitions shows how the munitions try to attack armor, then vehicles, then groups of people, and then land to become pop up landmines. [1] One has to assume that the capabilities of the other actors is similar. Makes for a pretty scary picture when you think about it. [1] https://www.youtube.com/watch?v=CY9gojFu-_U https://www.youtube.com/watch?v=CY9gojFu-_U

harkyns_castle 12y ago
Admittedly I've had a few beers, but what was going on there? It looked like a chaff device or something. I didn't see the massive destruction I was hoping for.

deleted 12y ago

[deleted]

grandalf 12y ago

I think the lesson here is not so much that governments can do this, but that entities with extremely large budgets are implementing broad, interconnected initiatives like this. I think realistically any entity with over $20M could participate meaningfully in these kinds of exploits. The key is that in order to be useful many overlapping initiatives need to exist. It seems like exploiting things like firmware would be pretty easy: You just get a member of your team who is a bit overqualified to apply for a job at the target company. A relatively small team could accomplish this in a few years, aided by the scarcity of top tier engineering talent. The hard part is the social aspect of the attacks, but a single clever individual can come up with many.

RockyMcNuts 12y ago
well, in TFA it's a little easier for the NSA than embedding a mole, NSA just tells WD they want to buy drives, but need to audit all the source code including firmware for security issues, then modifies firmware, then intercepts hardware orders from targets and replaces them with ones with compromised firmware.
- grandalf 12y ago
  True, but I think it makes more sense to look at these tactics in the most general way possible. Firms could be doing them, as could much smaller governments. Most press about itesec is focused on individual vulnerabilities and the tactics used in specific exploits. What we're seeing is tremendous "long game" strategic sophistication. Stuxnet was one example of using many attack vectors to eventually achieve a goal and these revelations suggest that was just the beginning. Sure, intercepting the mail could be difficult, but all it takes is a few compromised UPS drivers and warrants are no longer needed.

peterwwillis 12y ago

I feel bad for the people that work for groups like this. Sure, you get to hack every developed nation in the world and are privy to the most sensitive information in the world. You're also therefore the world's largest liability, and your life is probably very expendable compared to the data you're retrieving. They might have a unique identity just for picking up milk.

ingler 12y ago

I don't know what's more disturbing: the fact that US government does this with impunity or the fact that a sizable group of technically competent citizens defends it.

azinman2 12y ago
I'm for it when it doesn't target only US tech like we see here... that harms trade. I'm an American and thus I benefit... plus I think the skills are awesome (to me the tapping optical fiber without cutting it off is more impressive, however). The attack is just like any other malware attack at that point, which everyone will always need to defend better against. If anything this creates a better challenge for SV & tech in general to react to. Apple already has responded and is making it harder to intercept which is good for everyone in the long-run. The US might just be the first ones discovered with it, but to think that no one else will also figure it out (nation-state or not) is very unlikely. Internet + digitized everything makes our current paradigm vulnerable unless everything starts getting more secure.
pgwhalen 12y ago
I think the "sizable group of technically competent citizens" realizes that espionage between nation-states is as old as nation-states themselves, and that because of the nature of humanity, it's not going away anytime soon.
- ingler 12y ago
  It's also where the money is. Getting paid to do the wrong thing is also an old trait of humankind. Remember Google's original motto? Whatever happened to that?
sheensleeves 12y ago
Harder to count HN support for a political side, than to count people at a rally. (Sock puppets.)
LLWM 12y ago
It disturbs you that other people have different political views than you do?

balls187 12y ago

Anyone get the feeling that at this point, the NSA et al, have moved onto even more sophisticated attacks?

leroy_masochist 12y ago
Given that the unearthed program is a decade and a half old, I definitely get that feeling.
- laurent123456 12y ago
  I'm picturing the NSA engineers laughing at the "advanced hacking" Kaspersky just unearthed, meanwhile working on stuff that would blow our mind and that we'll only discover 20 years from now.
  - chii 12y ago
    i can't imagine how my mind can be blown any more than it already has.
    - balls187 12y ago
      Skynet?

shiven 12y ago

Takeaway lesson #1: re-flash all HDDs/SSDs with verified vanilla firmware from original manufacturer. Lesson #2: Beware any and all data media, CDs, DVDs (Netflix? Blockbuster? Hollywood screeners? ...?), USB drives.

rasz_pl 12y ago
#1 using Jtag, nothing else will matter, and even then it will only work until your drive is reflashed again in another attack. Best way to secure HDD would be modifying firmware to DISABLE firmware upgrades and external access to service area permanently. Afaik HDDs keep some executable modules stored on HDD platters, that means 'simply' cutting WR leg on eprom chip is not enough. We are talking quite significant firmware rewrite here.
mhomde 12y ago
Couldn't you secure yourself by say running an OS image with a truecrypt partition?
flurpitude 12y ago
Lesson #3: Don't order computer hardware or software isntallation disks by mail. Walk into a shop without warning them you're coming.

logicallee 12y ago

do we really need to encourage people to go into this line of work with language like this: >A long list of almost superhuman technical feats illustrate Equation Group's extraordinary skill, painstaking work, and unlimited resources. with the effort these people spend contributing next to zero value in the world (strongly negative value if you add up all the energy wasted on all sides including their 'enemies'; if all these sides spent the same resources on positive constructive research instead, we would be ahead). This genius could be applied to making a compiler/interpreter that just does what you're trying to do, regardless of whether you're a programmer. it's a binary choice: have these people perform 'superhuman' feats of self-destruction and obfuscated encryption and finding zero-days.... ... or give humanity the tools that every one of the seven billion people on it can instantiate any idea in seconds and have it actually be correctly interpreted and done. Resources are spent tricking people so they don't notice something. Where are the resources being spent helping people do what they're trying to? The example I always go to is: since the creation of the United States, how much inter-state (Iowa and Massachusetts) spying, warmaking, border control, etc, is wasted? Could this have something to do with its performance over the last couple of centuries? I think of these types of programs as 'welfare for geniuses'. give them an office and something to do. but for God's sake, spit them out again. The optimal amount of state spying is, let's face it, much closer to zero than its current levels. Spend on enough universal education that everyone shares values and nobody is destructive; put the rest into fundamental research and development. I don't mind that the government exists to do research, employ people, and keep the world safe. But put some limits on it, and please don't encourage this with language like I quoted at the top. humanity has better things to do with its time. nobody wants to live in a prison.

gloriousduke 12y ago

Just think, a member of the group is probably reading this thread right now...

robertmgreen5 12y ago
hahahaha...
- dhimes 12y ago
  This made me LOL
rasz_pl 12y ago
Looking at the timeline Im guessing they were recruited under cover of Darpa from regular Defcon attendees. L0pht is a good example, Mudge probably was involved at one point, he lured a lot of geeks and hackers to the dark side.

packetized 12y ago

Scalpel, not a sledgehammer.

adambatkin 12y ago

We definitely throw our weight around and interfere with Iran's domestic affairs. But this is definitely a case of "we think our morals are better than yours" (and we have bigger guns so we're gonna enforce those morals). The Iranian government funds terrorist groups around the world, and has called for the destruction of certain other countries. So yeah, if we have the ability to stifle them (particularly their nuclear ambitions) I say we go for it. I do feel bad for many of the Iranian people. Many of them do not like their government and are therefore held hostage by the events around them, which they have no control over, and may disagree with.

Ar-Curunir 12y ago
Hmm, and what about the Saudi government that actually does fund terrorist activities and opposes almost everything that America claims to stand for? America is fine with propping up that regime, so why is Iran an issue, when from everything that I've read and experienced (12 years in the Middle East) there have been no implications of Iran in modern terrorist activities? What moral have high ground can you take then?
- somebehemoth 12y ago
  "when from everything that I've read and experienced (12 years in the Middle East) there have been no implications of Iran in modern terrorist activities?" - Iran does not recognize Israel. - Iran supplies political support and weapons to Hamas,[14] an organization classified by Israel, the United States, Canada, the European Union and Japan as a terrorist organization. Mahmoud Abbas, President of the Palestinian National Authority, has said "Hamas is funded by Iran. It claims it is financed by donations, but the donations are nothing like what it receives from Iran".[15] From 2000 to 2004, Hamas was responsible for killing nearly 400 Israelis and wounding more than 2,000 in 425 attacks, according to the Israeli Ministry of Foreign Affairs. From 2001 through May 2008, Hamas launched more than 3,000 Qassam rockets and 2,500 mortar attacks into Israel.[16] - Iranian proxies killed an estimated 1,100 US troops in Iraq.[35] In addition, insurgents supported by Iran reportedly committed acts of terrorism.[34][36][37] Lots more here: http://en.wikipedia.org/wiki/Iran_and_state-sponsored_terrorism http://en.wikipedia.org/wiki/Iran_and_state-sponsored_terror... I am not claiming these are all fact, but I think there is little doubt that they are at least "implications" as you put it. (edited for formatting.)

rl3 12y ago

I'm surprised the CPU microcode angle isn't mentioned.

teraflop 12y ago
Has there ever been a non-theoretical use of microcode in malware? I would expect it to be difficult for a lot of reasons (the maximum microcode size is probably quite limited; the format is extremely proprietary; and there's only so much overhead you can add at the instruction level before you start causing a noticeable slowdown). Also, microcode updates aren't retained when the system is powered, so you still need to have a persistent backdoor installed at the OS level. Given that, it's not clear what additional benefit a microcode backdoor would provide.
- kw71 12y ago
  If you are going to modify a BIOS, then the BIOS can apply the microcode update. No need to tamper with OS then.
- rl3 12y ago
  > Has there ever been a non-theoretical use of microcode in malware? Not to my knowledge. Indeed, the difficulty involved as well as proprietary nature of the format seems to indicate such an attack vector would be restricted to only the most sophisticated actors. So, it's no wonder that there are no real-world examples, assuming that they even exist in the first place. > Also, microcode updates aren't retained when the system is powered, ... While true, I don't necessarily see this as a fatal blow to the attack vector's utility. Without delving into raw speculation, I'm sure there's plenty of clever ways to craft attacks unique to what microcode affords. That said, it seems likely that microcode attacks would be treated more as a specialized capability augmenting something like what the article outlines, rather than a method of attack unto itself.
- rasz_pl 12y ago
  You 'only' need one instruction compromised/customized to be able to breach ring barrier/take over mmu.

Iknowitall 12y ago

What is the NSA is doing here is more subtle and I do not think they fully realize it. They are heavily financing and accelerating the speed of damages that people on the dark side can do. They are "inspiring" a bunch of curious teenagers (in the best case) or a bunch of cyber criminals (in the worst case) to create another malware like that. They are putting out there first of all the ideas, second the conviction that it is possible to do so, and third sample code to study, improve and deploy. This race to being the "smarter" spy is unfortunately leading us in a very risky world to live in. A lose-lose preposition. The press and the antivirus researchers are also not being too smart here to make this public available.

Iknowitall 12y ago
By the way, would you put a bunch of secret technology (maybe a new bomb) partially hidden in a manhole in the middle of the street, just in case a spy passing by needs to use it? That is pretty much what they are doing here... code is easy to move around and to copy. Today (or in relatively short amount of time) who wants that code bad enough will be able to find it. That technology that took yeas and million of dollars to develop is now available to the bad guys. Face palm!

nadaviv 12y ago

One of the images [0] in the article identifies a C&C server used by the attackers, technology-revealed.com. The script appears to embed an invisible iframe pointing to a page on that domain, which probably infects the machine using some zero-day exploit on the browser or one of its plugins. The domain is still registered, but appears not to be running an HTTP server anymore. Might be interesting to investigate if someone wants to look into that. [0] http://cdn.arstechnica.net/wp-content/uploads/2015/02/malicious-php-script-1280x719.jpg http://cdn.arstechnica.net/wp-content/uploads/2015/02/malici...

compbio 12y ago
The article also mentions fanny.bmp as an NSA exploit. Here a post from 2010 [1] from someone who encountered this virus on an USB stick and saved the virus: https://forum.lowyat.net/topic/1488855/all https://forum.lowyat.net/topic/1488855/all

grandalf 12y ago

The point isn't whether we should be surprised this is the NSA, the interesting thing is that this layered strategy is what you do if you have access to lots of money and talent.

datashovel 12y ago

I would like to ask anyone reading this to hypothesize with me. What if the US government was broadly and knowingly corrupt? How comfortable would you feel knowing that they had such broad and powerful technical capabilities? How would you fight against such a machine, to uproot the corruption? I'm in awe of these technical feats, but also cautious about the implications of an all-knowing, all-powerful government presence who can infringe on your basic rights at-will.

Cthulhu_ 12y ago
It's not a what-if actually, the US government - or at least the higher-ups, like the senate - are bought by those with money. And buying votes / power / votes is the core principle of corruption.
- datashovel 12y ago
  I didn't want to sound too presumptuous when I wrote the comment, but I would agree the current state of things is far from ideal.

rey12rey 12y ago

Equation Group: Questions and Answers by Kaspersky [pdf] --> https://cdn1.vox-cdn.com/uploads/chorus_asset/file/3415904/Equation_group_questions_and_answers.0.pdf https://cdn1.vox-cdn.com/uploads/chorus_asset/file/3415904/E...

harkyns_castle 12y ago

Might as well tattoo a UUID on our foreheads and be done with it at this rate. God I hate hearing the apologists for the NSA in these threads. Are you so devoid of empathy?

harkyns_castle 12y ago
Downvote all you like. I'm over this, and I'm getting out of the IT game. If everything I do can be taken at will by a far more powerful, and greedy, team than I can do anything about, what is the point. Time for a change of career. I've always wanted to protect our dying forests and species in any case. Renouncing my US citizenship too. This is all too disgusting.
- iak8god 12y ago
  > Renouncing my US citizenship too. Statements like this make it hard to take your comment seriously, but I'm going to try. > Time for a change of career. I've always wanted to protect our dying forests and species in any case. What makes you think you can do anything about this? If you're in tech, it's likely that's where your training, experience, and interests lie and so that's where you're likely to be most effective for now. Why not spread awareness of issues that concern you and work with like-minded people to do what you can. Do you think your fancy new career protecting the environment won't involve working against powerful and greedy opponents?
nhstanley 12y ago
Empathy for whom? I know pacifists want to believe we live in a post-war world, and if only we would not make guns or do the kind of things the NSA is doing here we'll suddenly live in a perfect world—but by what fantastical mechanism do you actually think that will happen?
- harkyns_castle 12y ago
  The old pacifist keyword, its a bit like the communist keyword. The only war we have at the moment is the one you (assuming you're a shill) created and want to sustain. Because if you don't, it all falls down. Its about the US dollar, and oil.

ilitirit 12y ago

How can one detect infection?

anton000 12y ago

Wasn't there a demonstration of a similar HDD exploit posted on HN earlier? edit: found it https://news.ycombinator.com/item?id=8665865 https://news.ycombinator.com/item?id=8665865

oglees 12y ago

Absolutely! I live in Bulgaria, Eastern Europe, a poor, small country, which has been accepted in NATO and the European Union, but still is hosted by the past-Soviet`s secret intelligence services of Moscow, which are now illegal, but has agents and the absolute power over the legal secret services in Bulgaria. The surveillance is much larger, than in the USA, but all the info goes to Moscow. So, what are you troubling about, when NSA is pure American, and has the purpose to protect you from the legions of Russian, Chinese hackers - officially military, or just playing and stilling criminals, and all the Islamic recruiters, who are trying to recruit American citizens for their Jihad against The Civilization... I don`t understand, are you stupid, people, or what? NSA has the duty to protect you, and you are acting as children, whom parents has been installed a security program on your PC, to protect you from pedophiles... It`s the same case with the NSA surveillance!

n1x0n997 12y ago

So there is this new shodan-like database that takes data from massive scans of the Internet (I think?) etc... Might be worth running all C&Cs through it to discover more domains , for example https://rateip.com/ipv4/190.60.202.4 https://rateip.com/ipv4/190.60.202.4