Daily Archives: February 18, 2015

The U.S. intelligence community has found ways to avoid even the strongest of security measures and practices, a new report from Moscow-based Kaspersky Lab suggests, demonstrating a range of technological accomplishments that place the nation's hackers as among the most sophisticated and well resourced in the world.

Hackers who are part of what the cybersecurity researchers call "Equation Group" have been operating under the radar for at least 14years, deploying a range of malware that could infect hard drives in a wayalmost impossible to remove and cold hide code in USB storage devicesto infiltratenetworks kept separate from the Internet for security purposes.

Kaspersky's report did not say the U.S. government wasbehind the group. But it did say the group was closely linked to Stuxnet -- malware widely reported to have been developed by the National Security Agency and Israel that was used in an attack against Iran's uranium enrichment program -- along with other bits of data that appear to align with previous disclosures. Reuters further linked the NSA to the Kaspersky report, citing anonymous former employees of the agency who confirmed Kaspersky's analysis.

NSA spokesperson Vanee Vines said in a statement that the agency was aware of the report, but would not comment publicly on any allegations it raises.

The Kaspersky report shows a highly sophisticated adversarythat has found ways to worm itself into computers with even the strongest of security measures in place. This matches up with what we know about other NSA efforts from documents leaked by former NSA contractor Edward Snowden, which showed efforts to undermine encryption and evade the protections major tech companies used to guard user data.

But the new report paints a more detailed picture of the breadth of the agency's reported offensive cyber arsenal. And unlike other recent revelations about U.S. government snooping, which have largely come from Snowden, the insights from Kaspersky came from examining attacks found in the digital wild. Victims were observed in more than 30 countries, withIran, Russia, Pakistan and Afghanistan having among the highest infection rates, according to the report.

One of the most sophisticatedattacks launched by theEquation Group lodged malware deep into hard drives, according to Kaspersky. It worked by reprogramming the proprietary code, called firmware, built into the hard drives themselves. That allowed for persistent storage hidden inside a target system that could survive the hard drive being reformatted or an operating system being reinstalled, the report says.

The code uncovered by Kaspersky suggests the malware was designed to work ondisk drives of more than a dozen major manufacturers -- including those from Seagate, Western Digital, Toshiba, IBM and Samsung. But the report also notes that this particular technique seemed to be rarely deployed, suggesting that it was used only on the most valuable victims or in unusual circumstances.

The Kaspersky report also said the group found ways to hide malicious files within aWindows operating system database on the targets' computer known as the registry -- encrypting and stashing the files so that they would be impossible to detect using antivirus software.

Equation Group also found ways to infiltratesystemsthat were kept off the Internet for security purposes -- commonly known as "air-gapped" networks. Malware used by the hackers relied on infected USB sticks to map out such networks -- or even remotely deploy code on them, according to the report.

Originally posted here:
The NSA has reportedly found ways to avoid even the strongest security measures

The NSA may be implanting spying software in hard drives from a dozen major manufacturers including Toshiba, Western Digital, IBM, Samsung and Seagate, a report from cybersecurity firm Kaspersky Lab revealed Monday.

Though Kaspersky did not come out and point the finger directly at the National Security Agency -- instead calling out the Equation group, who have been perpetrating high-level attacks for almost 20 years -- but they said that there are "solid links indicating that the Equation group has interacted with" the actors behind Stuxnet, a virus the NSA used to attack Iranian nuclear weapons development in 2012.

A former NSA employee told Reuters that Kaspersky's analysis was correct, and "another former intelligence operative confirmed that the NSA had developed the prized technique of concealing spyware in hard drives."

The Kaspersky paper calls the software "perhaps the most powerful tool" in the Equation group's impressive arsenal, and "the first known malware capable of infecting the hard drives." It reprograms the drives and creates a hidden space where it can save stolen information to be retrieved later.

As CNET's Bridget Carey told CBS News, getting that deep into a piece of firmware (the core software of the drives), is very hard to do and requires the source code from the manufacturer.

One of the companies whose hard drives were infected with the spyware, Western Digital, said that it did not give its source code to the government. "But other sources in cybersecurity say that the government can get this because all it takes is for you to sell a computer to the Pentagon or another agency and they have to say, 'You know what, for security reasons we need that source code,'" Carey explained.

In other words, the government may have only had to ask for what it wanted in order to send spying-capable hard drives all over the world.

2015 CBS Interactive Inc. All Rights Reserved.

See the original post:
Is the NSA putting spyware in hard drives?

Hacking tools linked to U.S. intelligence that burrow inside hard disk drives could also be made by nongovernment hackers.

Over the weekend Russian security company Kaspersky described a suite of extremely sophisticated hacking tools that since 2008 have been used to infiltrate government, military, and corporate computers in 30 countries around the world. Reuters reports that it was the work of the U.S. National Security Agency.

Kasperskys most striking finding was that the toolkit of what it calls the Equation Group could inject malware into the software embedded inside hard disk drives. Not only is that firmware invisible to conventional security software, but malicious code hidden inside it can emerge to take over a computer even after its hard disk has been carefully erased. Costin Raiu, a researcher with Kaspersky, told the New York Times that the technique rendered investigators like him practically blind.

That impressive trick sets a new bar for the sophistication in malware caught in the wild. And it has led to speculation that the NSA had assistance from hard drive manufacturers, for example by getting access to details on how their firmware worked.

But despite suggestions it would be just about impossible for even the NSA to reverse-engineer hard drive firmware without such help, it appears to be well within its reachand that of many others, too. In recent years hackers and researchers with budgets far smaller than the NSAs have reverse-engineered the firmware of hard drives and other devices and demonstrated their own invisible malware.

That raises the prospect that multiple national intelligence agenciesand perhaps even groups without government backingcould be using the technique. Few, if any, security researchers are on the lookout for such attacks because they are essentially invisible.

Anyone looking to get started hacking hard drive firmware would be well advised to start with this page on the subject from prolific hacker Jereom Domburg. In 2013 he gave several talks on his research and showed how it enabled him to remotely take over a server with a hard disk made by Western Digital, a leading manufacturer whose drives were also targeted by Equation Group.

Also in 2013, academic researchers independently went even further and developed several proof-of-concept attacks against a hard disk from a different manufacturer. They showed how a disks firmware could be infected remotely, and made a system to communicate over the Internet with the unerasable malware to send commands and copy data such as encryption keys. This line from the academic papers summary has gained new plausibility after what we learned over the weekend:

The difficulty of implementing such an attack is not limited to the area of government cyber-warfare; rather, it is well within the reach of moderately funded criminals, botnet herders and academic researchers.

At the Black Hat security conference last summer, two researchers described how they had reverse engineered the firmware of USB sticks to hide code inside that can silently take over a computer.

Read the original here:
Not Only the NSA Knows How to Make Unerasable Malware

Security vendor Kaspersky outs a group capable of inserting spying software onto hard drives around the world, while Reuters fingers the NSA as the culprit.

Is the NSA behind a sophsticated way of implanting spyware on hard drives?

The National Security Agency is able to infect hard drives with surveillance software to spy on computers, Reuters said on Tuesday, citing information from cyber researchers and former NSA operatives.

In a new report, Kaspersky revealed the existence of a group dubbed The Equation Group capable of directly accessing the firmware of hard drives from Western Digital, Seagate, Toshiba, IBM, Micron, Samsung and other drive makers. As such, the group has been able to implant spyware on hard drives to conduct surveillance on computers around the world.

In a blog posted on Monday, Kaspersky said this threat has been around for almost 20 years and "surpasses anything known in terms of complexity and sophistication of techniques." The security researcher called the group "unique almost in every aspect of their activities: they use tools that are very complicated and expensive to develop, in order to infect victims, retrieve data and hide activity in an outstandingly professional way, and utilize classic spying techniques to deliver malicious payloads to the victims."

Surveillance software implanted on hard drives is especially dangerous as it becomes active each time the PC boots up and thus can infect the computer over and over again without the user's knowledge. Though this type of spyware could have surfaced on a "majority of the world's computers," Kaspersky cited thousands or possibly tens of thousands of infections across 30 different countries.

Infected parties and industries include government and diplomatic institutions, as well as those involved in telecommunications, aerospace, energy, nuclear research, oil and gas, military and nanotechnology. Also, included are Islamic activists and scholars, mass media, the transportation sector, financial institutions and companies developing encryption technologies.

And who's responsible for this sophisticated spyware?

Kaspersky didn't name names but did say that the group has ties to Stuxnet, a virus used to infect Iran's uranium enrichment facility. The NSA has been accused of planting Stuxnet, leading Reuters to finger the agency as the source behind the hard drive spyware, especially based on outside information.

Kaspersky's analysis was right, a former NSA employee told Reuters, adding that the agency valued this type of spyware as highly as Stuxnet. Another "former intelligence operative" said that the NSA developed this method of embedding spyware in hard drives but said he didn't know which surveillance efforts used it.

Read more here:
NSA planted surveillance software on hard drives, report says