Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/17/2015 | 10:26:25 AM
Re: Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet
The nation-states seem to be commanding a lot of the hacker headllnes recently, haven't they? @GonzSTL, I hope you've been following our 'Why They Hack' series. The fifth and final article -- on the USA -- is very timely and a good companion to the news about Espionage Group. 
User Rank: Apprentice
2/17/2015 | 10:26:13 AM
Going to the ROOT has been a Nation State goal for some time
Great read, and the Kaspersky revelations are interesting.  

The use of USB/CD-ROMs to jump the airgap have been around for some time and used with frequency by the penetration test industry (who hasn't heard of a tale or two of USB sticks dropped in corporate parking lots, or the embarassment IBM suffered when their USB stick which they were handing out at the Aus-CERT conference in 2010 carried with it pre-positioned malware). Indeed going after the hard drive has also been a goal of many. China used this technique in 2007 against Taiwan. I wrote in my April 2008 piece: "Nation States Espionage and Counterespionage" 

"In mid-November 2007, Taiwan's investigation bureau reported that hard-disk drives manufactured by Seagate in Thailand and sold in Taiwan had been contaminated with Trojan horse malware while the drives were in the hands of "Chinese sub-contractors" during the manufacturing process. The malware automatically uploaded information saved on the hard drive and, if the computer was connected to the Internet, forwarded the saved information to a Beijing Internet address without the user's knowledge"

It would appear the Equation Group has successfully improved on these methodologies.  Here's hoping the Equation Group are the good guys.



CEO Prevendra

User Rank: Ninja
2/17/2015 | 9:47:32 AM
Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet
"This malware is extremely sophisticated. Its way more complex than anything we've seen. It's most likely a nation-state because there doesn't seem to be any connection with cybercrime,"

It appears that Big Brother has been watching for a very long time. I'm actually not surprised by the revelation of the existence of this group. For a long time, I had suspected that such an operation theoretically exists, and that the justification of their existence is simply national security. Nor am I surprised by the sophistication of their technology, right down to the hard drive OS itself. In fact, we will probably discover that the technology possibly includes infiltration of the computer BIOS. Call me paranoid, but as I look at it, nation-states have the resources and motivation to carry out these operations, and most certainly have been researching this for decades. I do like the name "Equation Group" though – very clever.
<<   <   Page 2 / 2

Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We need more votes, check the obituaries.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-01-26
KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter.
PUBLISHED: 2021-01-26
The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.
PUBLISHED: 2021-01-26
SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
PUBLISHED: 2021-01-26
NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions prior to 32.5, contains a vulnerability in the apply_binaries.sh script used to install NVIDIA components into the root file system image, in which improper access control is applied, which may lead to an un...
PUBLISHED: 2021-01-26
NVIDIA Tegra kernel in Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, all L4T versions prior to r32.5, contains a vulnerability in the INA3221 driver in which improper access control may lead to unauthorized users gaining access to system power usage data, which may lead to...