Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet
Threaded  |  Newest First  |  Oldest First
GonzSTL
GonzSTL,
User Rank: Ninja
2/17/2015 | 9:47:32 AM
Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet
"This malware is extremely sophisticated. Its way more complex than anything we've seen. It's most likely a nation-state because there doesn't seem to be any connection with cybercrime,"

It appears that Big Brother has been watching for a very long time. I'm actually not surprised by the revelation of the existence of this group. For a long time, I had suspected that such an operation theoretically exists, and that the justification of their existence is simply national security. Nor am I surprised by the sophistication of their technology, right down to the hard drive OS itself. In fact, we will probably discover that the technology possibly includes infiltration of the computer BIOS. Call me paranoid, but as I look at it, nation-states have the resources and motivation to carry out these operations, and most certainly have been researching this for decades. I do like the name "Equation Group" though – very clever.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/17/2015 | 10:26:25 AM
Re: Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet
The nation-states seem to be commanding a lot of the hacker headllnes recently, haven't they? @GonzSTL, I hope you've been following our 'Why They Hack' series. The fifth and final article -- on the USA -- is very timely and a good companion to the news about Espionage Group. 
GonzSTL
GonzSTL,
User Rank: Ninja
2/17/2015 | 10:29:36 AM
Re: Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet
@Marilyn: Yes they have, and it really isn't a surprise! I have been following that series. They are quite interesting and thought provoking, and I've even commented a few times, for whatever that's worth.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/17/2015 | 10:32:25 AM
Re: Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet
Your comments are always worth reading, @Gonz. Glad you are enjoying the series. It does add a lot of contest to the headlines... 
GonzSTL
GonzSTL,
User Rank: Ninja
2/17/2015 | 11:05:49 AM
Re: Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet
@Marilyn: I'm sure you are aware of this, but for the benefit of the readers, (ISC)² has a link to that series, and other Dark Reading articles in their "Latest Industry News" section.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/17/2015 | 11:09:01 AM
Re: Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet
I don't think I picked up on that. So many thanks for sharing!
GonzSTL
GonzSTL,
User Rank: Ninja
2/17/2015 | 11:12:32 AM
Re: Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet
Sure thing. It's quite remarkable to be linked from (ISC)², an industry and world renowned institution for IT Security.
BurgessCT
BurgessCT,
User Rank: Apprentice
2/17/2015 | 10:26:13 AM
Going to the ROOT has been a Nation State goal for some time
Great read, and the Kaspersky revelations are interesting.  

The use of USB/CD-ROMs to jump the airgap have been around for some time and used with frequency by the penetration test industry (who hasn't heard of a tale or two of USB sticks dropped in corporate parking lots, or the embarassment IBM suffered when their USB stick which they were handing out at the Aus-CERT conference in 2010 carried with it pre-positioned malware). Indeed going after the hard drive has also been a goal of many. China used this technique in 2007 against Taiwan. I wrote in my April 2008 piece: "Nation States Espionage and Counterespionage" 

"In mid-November 2007, Taiwan's investigation bureau reported that hard-disk drives manufactured by Seagate in Thailand and sold in Taiwan had been contaminated with Trojan horse malware while the drives were in the hands of "Chinese sub-contractors" during the manufacturing process. The malware automatically uploaded information saved on the hard drive and, if the computer was connected to the Internet, forwarded the saved information to a Beijing Internet address without the user's knowledge"

It would appear the Equation Group has successfully improved on these methodologies.  Here's hoping the Equation Group are the good guys.

Thanks,

Christopher

CEO Prevendra

SgS125
SgS125,
User Rank: Ninja
2/17/2015 | 11:14:00 AM
Not that hard after all.
"This is what makes this group gods among APT actors. We have never seen anything close to this," Kamluk says. Knowing how to reprogram a hard drive would entail gathering intelligence from each vendor, which is no simple feat, he says. "Then it would take a very skilled programmer many months or years to master this."

 

Please..... Anyone who has programmed back in the 80's knows this is not true.

We used to have to write routines direct for hardware.

It's not that hard.
anon2023887558
anon2023887558,
User Rank: Apprentice
2/17/2015 | 11:53:15 AM
Re: Not that hard after all.
Yup, I remember debugging the old WD controller cards manually and it wouldn't take years to master anything about it, especially if you had the source code and didn't have to decompile anything.

Noobs,  Sheesh!
BertrandW414
BertrandW414,
User Rank: Strategist
2/17/2015 | 5:09:13 PM
Equation Group's Apparent Allegiance
Given that this Equation group is astonishingly effective, aren't you a bit relieved that they are most likely run by an agency in the U.S. goverment and not run by China or Russia?! To borrow from something LBJ once said about J. Edgar Hoover (and to clean it up a bit), it is better that they are in the tent shooting out, rather than outside shooting in.
kill -9
kill -9,
User Rank: Apprentice
2/18/2015 | 10:59:36 PM
Newly Discovered Master Cyber Espionage Group . . .
If one has been following the APT drama over the past several years and if one has read what Kaspersky has made available on the interwebs, it's all but impossible to ignore the trail of breadcrumbs that lead to 39°6′32″N 76°46′17″W. Even eWeek sussed it out . . .
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
2/19/2015 | 4:24:32 PM
Re: Newly Discovered Master Cyber Espionage Group . . .
It's definitely not tough to guess who's behind it, but Kaspersky's not gonna say it out loud publicly.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-42247
PUBLISHED: 2022-10-03
pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name.
CVE-2022-41443
PUBLISHED: 2022-10-03
phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.
CVE-2022-33882
PUBLISHED: 2022-10-03
Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop app (ADA). An attacker could leverage this vulnerability to escalate privileges and execute arbitrary code.
CVE-2022-42306
PUBLISHED: 2022-10-03
An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange during registration and cause a NULL pointer exception, effectively crashing the pbx_exchange process.
CVE-2022-42307
PUBLISHED: 2022-10-03
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.