Russian researchers expose breakthrough U.S. spying program

[Figaro]

The U.S. National Security Agency has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba and other top manufacturers, giving the agency the means to eavesdrop on the majority of the world's computers, according to cyber researchers and former operatives.

That long-sought and closely guarded ability was part of a cluster of spying programs discovered by Kaspersky Lab, the Moscow-based security software maker that has exposed a series of Western cyberespionage operations.

Russian researchers expose breakthrough U.S. spying program Reuters

Uncle Sam is looking for vicious propaganda Insulters for its campaign to stamp out anti-war dissent. Sign up now at the Center for Strategic Counterthinking Communications

 

[Godboy]

Its unfortunate that it was discovered, but I have to imagine they have all kinds of little tricks like that, so hopefully it wont matter too much.

 

[cnm]

Vastly over hyped according to what purports to be the official Kapersky blog.

Indestructible malware by Equation cyberspies is out there – but don’t panic (yet)

A virus in HDD firmware is real what s next Kaspersky Lab Official Blog

However, don’t rush to find your screwdriver – we don’t expect this ultimate infection ability to become mainstream. Even the Equation group itself probably only used it a few times, as HDD infector module is extremely rare on victim’s systems.

For starters, hard drive reprogramming is much more complex than writing, let’s say, Windows software. Each hard drive model is unique and it is very expensive and painstaking to develop an alternative firmware. A hacker must obtain the hard drive vendor’s internal documentation (which is nearly impossible), purchase some drives of the exact same model, develop and test required functionality, and squeeze malicious routines into existing firmware, all while keeping its original functions.

This is very high profile engineering which requires months of development and millions in investment. That’s why it’s not feasible to use this kind of stealth technologies in criminal malware or even most targeted attacks. In addition, firmware development is obviously a boutique approach which can’t be easily scaled. Many manufacturers release firmware for multiple drives each month, new models come out constantly, and hacking each one is something beyond the possibility (and need) for the Equation group – and anyone else.​

 

[TyroneSlothrop]

Its unfortunate that it was discovered, but I have to imagine they have all kinds of little tricks like that, so hopefully it wont matter too much.

"unfortunate" ...that Big Brother is there .....1984

 

[TyroneSlothrop]

 

[quorthon]

Its unfortunate that it was discovered, but I have to imagine they have all kinds of little tricks like that, so hopefully it wont matter too much.

"unfortunate" ...that Big Brother is there .....1984

They have many more tricks and guess who are targeted. We, the people...

 

[Godboy]

Its unfortunate that it was discovered, but I have to imagine they have all kinds of little tricks like that, so hopefully it wont matter too much.

"unfortunate" ...that Big Brother is there .....1984

They have many more tricks and guess who are targeted. We, the people...

Uhuh, yeah, I feel sooo threatened. When is the last time you heard about the NSA busting your average citizen for anything? You go ahead and worry about shit that doesn't effect us, meanwhile the rest of us sane people will handle national security for the idiots like you.

 

[quorthon]

Uhuh, yeah, I feel sooo threatened. When is the last time you heard about the NSA busting your average citizen for anything? You go ahead and worry about shit that doesn't effect us, meanwhile the rest of us sane people will handle national security for the idiots like you.

So who's an idiot? When is the last time you heard about secret services actions? So idiot is me still?

Idiots like me are able to discuss without offences.

 

[Godboy]

When is the last time you heard about secret services actions?

I think you mean the "NSA", not the "Secret Service", and the answer is... today in this thread and the article in the OP.

So idiot is me still?

Yes.

 

[waltky]

Exposure of Alleged NSA Hacking Tools May Be Warning to US...

Snowden: Exposure of Alleged NSA Tools May Be Warning to US
Aug 16, 2016 — National Security Agency leaker Edward Snowden says the exposure of malicious software allegedly linked to his former employer may be a message from Moscow, adding a layer of intrigue to a leak that has set the information security world abuzz.

Technical experts have spent the past day or so picking apart a suite of tools purported to have been stolen from the Equation Group, a powerful squad of hackers which some have tied to the NSA. The tools materialized as part of an unusual electronic auction set up by a group calling itself "Shadow Brokers," which has promised to leak more data to whoever puts in a winning bid. In a series of messages posted to Twitter, Snowden suggested the leak was the fruit of a Russian attack on an NSA malware server and could be aimed at heading off U.S. retaliation over allegations that the Kremlin was trying interfere in America's electoral process.

"Circumstantial evidence and conventional wisdom indicates Russian responsibility," Snowden said. "This leak is likely a warning that someone can prove U.S. responsibility for any attacks that originated from this malware server. That could have significant foreign policy consequences. Particularly if any of those operations targeted U.S. allies. Particularly if any of those operations targeted elections."

Snowden did not immediately return messages seeking additional comment. The NSA did not immediately return emails seeking comment on his claim. Messages sent to an address registered by the Shadow Brokers were not returned. The Equation Group was exposed last year by antivirus firm Kaspersky Lab, which described it at the time as a "God of cyberespionage." Many have since speculated that the NSA is behind the group, although attribution in the field of cyberespionage is a notoriously tricky issue.

Snowden: Exposure of Alleged NSA Tools May Be Warning to US | Military.com

 

[waltky]

Whether mistake or deliberate, it's out there now...

Exclusive: Probe of leaked U.S. NSA hacking tools examines operative's 'mistake'
Thu Sep 22, 2016 | A U.S. investigation into a leak of hacking tools used by the National Security Agency is focusing on a theory that one of its operatives carelessly left them available on a remote computer and Russian hackers found them, four people with direct knowledge of the probe told Reuters.

The tools, which enable hackers to exploit software flaws in computer and communications systems from vendors such as Cisco Systems and Fortinet Inc, were dumped onto public websites last month by a group calling itself Shadow Brokers. The public release of the tools coincided with U.S. officials saying they had concluded that Russia or its proxies were responsible for hacking political party organizations in the run-up to the Nov. 8 presidential election. On Thursday, lawmakers accused Russia of being responsible. Various explanations have been floated by officials in Washington as to how the tools were stolen. Some feared it was the work of a leaker similar to former agency contractor Edward Snowden, while others suspected the Russians might have hacked into NSA headquarters in Fort Meade, Maryland. But officials heading the FBI-led investigation now discount both of those scenarios, the people said in separate interviews.

NSA officials have told investigators that an employee or contractor made the mistake about three years ago during an operation that used the tools, the people said. That person acknowledged the error shortly afterward, they said. But the NSA did not inform the companies of the danger when it first discovered the exposure of the tools, the sources said. Since the public release of the tools, the companies involved have issued patches in the systems to protect them. Investigators have not ruled out the possibility that the former NSA person, who has since departed the agency for other reasons, left the tools exposed deliberately. Another possibility, two of the sources said, is that more than one person at the headquarters or a remote location made similar mistakes or compounded each other's missteps. Representatives of the NSA, the Federal Bureau of Investigation and the office of the Director of National Intelligence all declined to comment.

After the discovery, the NSA tuned its sensors to detect use of any of the tools by other parties, especially foreign adversaries with strong cyber espionage operations, such as China and Russia. That could have helped identify rival powers’ hacking targets, potentially leading them to be defended better. It might also have allowed U.S officials to see deeper into rival hacking operations while enabling the NSA itself to continue using the tools for its own operations. Because the sensors did not detect foreign spies or criminals using the tools on U.S. or allied targets, the NSA did not feel obligated to immediately warn the U.S. manufacturers, an official and one other person familiar with the matter said. In this case, as in more commonplace discoveries of security flaws, U.S. officials weigh what intelligence they could gather by keeping the flaws secret against the risk to U.S. companies and individuals if adversaries find the same flaws. Critics of the Obama administration's policies for making those decisions have cited the Shadow Brokers dump as evidence that the balance has tipped too far toward intelligence gathering.

The investigators have not determined conclusively that the Shadow Brokers group is affiliated with the Russian government, but that is the presumption, said one of the people familiar with the probe and a fifth person. One reason for suspecting government instead of criminal involvement, officials said, is that the hackers revealed the NSA tools rather than immediately selling them. The publication of the code, on the heels of leaks of emails by Democratic Party officials and preceding leaks of emails by former U.S. Secretary of State Colin Powell, could be part of a pattern of spreading harmful and occasionally false information to further the Russian agenda, said Jim Lewis, a cybersecurity expert at the Center for Strategic and International Studies. "The dumping is a tactic they've been developing for the last five years or so," Lewis said. "They try it, and if we don't respond they go a little further next time."

Exclusive: Probe of leaked U.S. NSA hacking tools examines operative's 'mistake'