AMDR
FULL MEMBER
- Joined
- Sep 28, 2014
- Messages
- 1,109
- Reaction score
- 16
- Country
- Location
If we did retaliate, they wouldn't know the true extent of the attack. Below is just one example.
From :
Equation Group: The Crown Creator of Cyber-Espionage | Kaspersky Lab
Cyber Firm: The NSA Is Out-Hacking the Chinese and the Russians - Defense One
"On Sunday, Kaspersky Lab, a research firm headquartered in Moscow, published an analysis implying the “Equation Group” is the same entity behind the so-called Stuxnet worm. That malware is believed to be a joint NSA-Israeli invention that sabotaged Iran’s nuclear centrifuges in 2009 or 2010.
Code developed by the possibly-20-year-old group can reprogram popular hard drives in a way that is virtually impossible for almost any person or machine to see. While surveying an Islamic Jihadist discussion forum, the team took pains to infect only specific targets by checking their usernames and network addresses, according to the new analysis."
" WHAT MAKES THE EQUATION GROUP UNIQUE?
Ultimate persistence and invisibility
GReAT has been able to recover two modules which allow reprogramming of the hard drive firmware of more than a dozen of the popular HDD brands. This is perhaps the most powerful tool in the Equation group’s arsenal and the first known malware capable of infecting the hard drives.
By reprogramming the hard drive firmware (i.e. rewriting the hard drive’s operating system), the group achieves two purposes:
From :
Equation Group: The Crown Creator of Cyber-Espionage | Kaspersky Lab
Cyber Firm: The NSA Is Out-Hacking the Chinese and the Russians - Defense One
"On Sunday, Kaspersky Lab, a research firm headquartered in Moscow, published an analysis implying the “Equation Group” is the same entity behind the so-called Stuxnet worm. That malware is believed to be a joint NSA-Israeli invention that sabotaged Iran’s nuclear centrifuges in 2009 or 2010.
Code developed by the possibly-20-year-old group can reprogram popular hard drives in a way that is virtually impossible for almost any person or machine to see. While surveying an Islamic Jihadist discussion forum, the team took pains to infect only specific targets by checking their usernames and network addresses, according to the new analysis."
" WHAT MAKES THE EQUATION GROUP UNIQUE?
Ultimate persistence and invisibility
GReAT has been able to recover two modules which allow reprogramming of the hard drive firmware of more than a dozen of the popular HDD brands. This is perhaps the most powerful tool in the Equation group’s arsenal and the first known malware capable of infecting the hard drives.
By reprogramming the hard drive firmware (i.e. rewriting the hard drive’s operating system), the group achieves two purposes:
- An extreme level of persistence that helps to survive disk formatting and OS reinstallation. If the malware gets into the firmware, it is available to “resurrect” itself forever. It may prevent the deletion of a certain disk sector or substitute it with a malicious one during system boot.
“Another dangerous thing is that once the hard drive gets infected with this malicious payload, it is impossible to scan its firmware. To put it simply: for most hard drives there are functions to write into the hardware firmware area, but there are no functions to read it back. It means that we are practically blind, and cannot detect hard drives that have been infected by this malware” – warns Costin Raiu, Director of the Global Research and Analysis Team at Kaspersky Lab. - The ability to create an invisible, persistent area hidden inside the hard drive. It is used to save exfiltrated information which can be later retrieved by the attackers. Also, in some cases it may help the group to crack the encryption: “Taking into account the fact that their GrayFish implant is active from the very boot of the system, they have the ability to capture the encryption password and save it into this hidden area,” explains Costin Raiu."