The Equation Group: The Crown Creator of Cyber-Espionage

[D.O.A.]

http://www.kaspersky.com/about/news/virus/2015/Equation-Group-The-Crown-Creator-of-Cyber-Espionage
tl;dr it's the US government.

A long list of almost superhuman technical feats illustrate Equation Group's extraordinary skill, painstaking work, and unlimited resources. They include:

• The use of virtual file systems, a feature also found in the highly sophisticated Regin malware. Recently published documents provided by Ed Snowden indicate that the NSA used Regin to infect the partly state-owned Belgian firm Belgacom.
• The stashing of malicious files in multiple branches of an infected computer's registry. By encrypting all malicious files and storing them in multiple branches of a computer's Windows registry, the infection was impossible to detect using antivirus software.
• Redirects that sent iPhone users to unique exploit Web pages. In addition, infected machines reporting to Equation Group command servers identified themselves as Macs, an indication that the group successfully compromised both iOS and OS X devices.
• The use of more than 300 Internet domains and 100 servers to host a sprawling command and control infrastructure.
• USB stick-based reconnaissance malware to map air-gapped networks, which are so sensitive that they aren't connected to the Internet. Both Stuxnet and the related Flame malware platform also had the ability to bridge airgaps.
• An unusual if not truly novel way of bypassing code-signing restrictions in modern versions of Windows, which require that all third-party software interfacing with the operating system kernel be digitally signed by a recognized certificate authority. To circumvent this restriction, Equation Group malware exploited a known vulnerability in an already signed driver for CloneCD to achieve kernel-level code execution.

Taken together, the accomplishments led Kaspersky researchers to conclude that Equation Group is probably the most sophisticated computer attack group in the world, with technical skill and resources that rival the groups that developed Stuxnet and the Flame espionage malware.

"It seems to me Equation Group are the ones with the coolest toys," Costin Raiu, director of Kaspersky Lab's global research and analysis team, told Ars. "Every now and then they share them with the Stuxnet group and the Flame group, but they are originally available only to the Equation Group people. Equation Group are definitely the masters, and they are giving the others, maybe, bread crumbs. From time to time they are giving them some goodies to integrate into Stuxnet and Flame."

also

The NSA has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba, Samsung, Micron and other manufacturers, giving the agency the means to eavesdrop on the majority of the world's computers

 

[A Nameless Ghoul]

Very interesting.

 

[McM]

USB stick-based reconnaissance malware to map air-gapped networks, which are so sensitive that they aren't connected to the Internet. Both Stuxnet and the related Flame malware platform also had the ability to bridge airgaps.

What means 'airgap' in this context?

And the last link is 'suspicious'.

 

[D.O.A.]

What means 'airgap' in this context?

And the last link is 'suspicious'.

airgap is like a network in complete isolation from public ones.

An air gap is the maximum protection between a system and other device/system - apart from actually turning it off. Two disconnected systems or devices designate security levels as low side (unclassified) and high side (classified). To move data, it often must to be saved in some type of transportable medium. Moving data from low to high side is simple, whereas moving classified data from a high to low side security device requires a strict procedure prior to performing the transfer, due to the data's classified nature.

The usual configuration of an air gap is a sneakernet, in which alternate storage, like flash drives or CDs, must be used to transfer data to and from the isolated device, rather than simply moving data across shared drives and networks.

A system or device may require certain limitations, such as:

• Totally banning local wireless communications
• Preventing electromagnetic (EM) leakage by placing the system/device in a Faraday cage to block wireless transmissions

Systems that implement air gap security include nuclear power plant controls, military networks and computerized medical equipment.

 

[McM]

airgap is like a network in complete isolation from public ones.

Thanks, it's what I thought, but wanted to be sure.

 

[McM]

tl;dr and military warning!

http://warontherocks.com/2015/02/bridging-the-air-gap-the-coming-third-offset/