Daily Archives: February 17, 2015

NSA MCW 2015 Fashion Show
Here #39;s our creative fashion show performance that won us 1st place at this year #39;s YFS Multicultural Week.

By: NSA York U

Continued here:
NSA MCW 2015 Fashion Show - Video

RecentR TV (09.02.15) Die Verschwrung hinter NSA, Snowden und den Koch-Brdern
Bereits vor der Entstehung der amerikanischen Behrde fr Fernmeldeaufklrung NSA lieferten westliche Konzerne alle ntige Technologie in den Osten um die Sowjets zu einer ansehnlichen...

By: Alexander Benesch

Read more:
RecentR TV (09.02.15) Die Verschwrung hinter NSA, Snowden und den Koch-Brdern - Video

Fighting Back! New Bill Takes On NSA Code-Breaking Facility
http://www.undergroundworldnews.com On Wednesday, Tennessee legislators filed legislation to directly take on NSA spying by withholding vital state resources and material support from any...

By: Dahboo777

Visit link:
Fighting Back! New Bill Takes On NSA Code-Breaking Facility - Video

The U.S. National Security Agency(NSA) has been planting surveillance software deep within hard drives made by top manufacturers, allowing it to eavesdrop on almost every computer in the world, according to Kaspersky Lab, aMoscow-based software security company that announced its findings Monday.

Kaspersky did not explicitly name from which country or intelligence agency the spying software was found, but former operatives from the NSA confirmed that the findings correlated with NSA activity, Reuters reported.

The NSAs spyware lies within drives manufactured by Western Digital and Seagate, who deny that they had any knowledge of such programs. Samsung and Toshiba drives also contained the code, but both declined to comment.

Kaspersky said that PCs in 30 different countries were infected by the most advanced hacking operation ever uncovered, with the most in Iran, Russia, Pakistan, Afghanistan and China. The NSA has a number of ways in which it can obtain the drives source code, which it requires to embed the spyware. The NSAs methods include posing as software companies or asking for it directly, Reuters reported. The government can also request it for a security audit from manufacturers who wish to sell hard drives to the Department of Defense, and then use it to infect the manufacturers products.

The NSA also would intercept mailed items, such as CDs or USB drives, to infect them, according to a report from Ars Technica. The infections also affect iPhones and other Apple products.

The NSA is targeting a number of organizations, including government and military offices, telecommunication, energy and media companies as well as nuclear research facilities and Islamic activists. Institutions with infected hard drives should be able to detect the NSA spyware using technical details that Kaspersky published Monday.

Those details could impair the NSAs surveillance programs, which were already affected by the revelations made by former NSA contractor Edward Snowden. The disclosures have already slowed sales of U.S. technology products internationally, especially in China.

Originally posted here:
NSA Has Planted Surveillance Software Deep Within Hard Drives Since 2001: Kaspersky

CANCUN, MexicoThe last two years have been filled with revelations about NSA surveillance activities and the sophisticated spy tools the agency uses to take control of everything from individual systems to entire networks. Now it looks like researchers at Kaspersky Lab may have uncovered some of these NSA tools in the wild on customer machines, providing an extensive new look at the spy agencys technical capabilities. Among the tools uncovered is a worm that appears to have direct connections to Stuxnet, the digital weapon that was launched repeatedly against centrifuges in Iran beginning in late 2007 in order to sabotage them. In fact, researchers say the newly uncovered worm may have served as a kind of test run for Stuxnet, allowing the attackers to map a way to targeted machines in Iran that were air-gapped from the internet.

For nearly a year, the researchers have been gradually collecting components that belong to several highly sophisticated digital spy platforms that they say have been in use and development since 2001, possibly even as early as 1996, based on when some command servers for the malware were registered. They say the suite of surveillance platforms, which they call EquationLaser, EquationDrug and GrayFish, make this the most complex and sophisticated spy system uncovered to date, surpassing even the recently exposed Regin platform believed to have been created by Britains GCHQ spy agency and used to infiltrate computers belonging to the European Union and a Belgian telecom called Belgacom, among others.

The new platforms, which appear to have been developed in succession with each one surpassing the previous in sophistication, can give the attackers complete and persistent control of infected systems for years, allowing them to siphon data and monitor activities while using complex encryption schemes and other sophisticated methods to avoid detection. The platforms also include an innovative module, the likes of which Kaspersky has never seen before, that re-flashes or reprograms a hard drives firmware with malicious code to turn the computer into a slave of the attackers. The researchers, who gave WIRED an advance look at their findings and spoke about them today at the Kaspersky Security Analyst Summit in Mexico, have dubbed the attackers the Equation Group and consider them the most advanced threat actor theyve seen to date.

The researchers have published an initial paper on their findings and plan to publish more technical details over the next few days, but theres still a lot they dont know about the Equation Groups activities.

As we uncover more of these cyber espionage operations we realize how little we understand about the true capabilities of these threat actors, Costin Raiu, head of Kasperskys Global Research and Analysis Team told WIRED.

Although the researchers have no solid evidence that the NSA is behind the tools and decline to make any attribution to that effect, there is circumstantial evidence that points to this conclusion. A keywordGROKfound in a keylogger component appears in an NSA spy tool catalog leaked to journalists in 2013. The 53-page document detailswith pictures, diagrams and secret codenamesan array of complex devices and capabilities available to intelligence operatives. The capabilities of several tools in the catalog identified by the codenames UNITEDRAKE, STRAITBAZZARE, VALIDATOR and SLICKERVICAR appear to match the tools Kaspersky found. These codenames dont appear in the components from the Equation Group, but Kaspersky did find UR in EquationDrug, suggesting a possible connection to UNITEDRAKE (United Rake). Kaspersky also found other codenames in the components that arent in the NSA catalog but share the same naming conventionsthey include SKYHOOKCHOW, STEALTHFIGHTER, DRINKPARSLEY, STRAITACID, LUTEUSOBSTOS, STRAITSHOOTER, and DESERTWINTER.

Other evidence possibly pointing to the NSA is the fact that five victims in Iran who were infected with Equation Group components were also key victims of Stuxnet, which was reportedly created and launched by the U.S. and Israel.

Kaspersky wouldnt identify the Iranian victims hit by the Equation tools, but the five key Stuxnet victims have been previously identified as five companies in Iran, all contractors in the business of building and installing industrial control systems for various clients. Stuxnet targeted industrial control systems used to control centrifuges at a uranium-enrichment plant near Natanz, Iran. The companiesNeda Industrial Group, Kala Electric, Behpajooh, CGJ (believed to be Control Gostar Jahed) and Foolad Technicwere infected with Stuxnet in the hope that contractors would carry it into the enrichment plant on an infected USB stick. This link between the Equation Group and Stuxnet raises the possibility that the Equation tools were part of the Stuxnet attack, perhaps to gather intelligence for it.

But the newly uncovered worm created by the Equation Group, which the researchers are calling Fanny after the name of one of its files, has an equally intriguing connection to Stuxnet.

It uses two of the same zero-day exploits that Stuxnet used, including the infamous .LNK zero-day exploit that helped Stuxnet spread to air-gapped machines at Natanzmachines that arent connected to the internet. The .LNK exploit in Fanny has a dual purposeit allows attackers to send code to air-gapped machines via an infected USB stick but also lets them surreptitiously collect intelligence about these systems and transmit it back to the attackers. Fanny does this by storing the intelligence in a hidden file on the USB stick; when the stick is then inserted into a machine connected to the internet, the data intelligence gets transferred to the attackers. EquationDrug also makes use of the .LNK exploit. A component called SF loads it onto USB sticks along with a trojan to infect machines.

See the rest here:
Suite of Sophisticated Nation-State Attack Tools Found With Connection to Stuxnet