Hacker News Reader

Comment by moyix | Hacker News Reader

Equation Group is the name given by AV vendors to a group of attacks thought to be carried out by NSA. This is, apparently, a dump of internal files (mostly exploits and command & control scripts) that someone got ahold of. They're now apparently trying to auction them off.

If it's a fake, it's a very good one – the code words match up to things we've seen in the Snowden leaks, e.g. Jetplow (https://www.schneier.com/blog/archives/2014/01/jetplow_nsa_e...). Matthieu Suiche has a good initial writeup here:

https://medium.com/@msuiche/shadow-brokers-nsa-exploits-of-t...

View on HN

It should be noted that it is only suspected that the Equation Group is related to the NSA. I only bring this up not because I don't think it is but rather to emphasize that it has not been proven yet.

If this leak is real, it points to one of two things. Either it isn't the NSA and is a company or some quasi-governmental group - owing to the fact that any of this shit the NSA makes would be on JWICS terminals and absolutely not accessible to the internet, or it means there's a leak from the NSA that dumped these files and has decided to sell them. I'd lean more towards the former.

The command and control ("listening posts" in intelligence community parlance) for even NSA implants has to be on the public internet so the victims can phone home. This stuff could be from one of those servers.

Is that necessarily true for NSA et al.? I don't see why the target couldn't just send the data towards an arbitrary destination, and that data be collected by NSA via a passive tap. Commands could be sent using a QUANTUM-style technique (packet injection with spoofed origin)

Snowden did tweet what looked like an AES key last week.

It was a sha2 (or rather, a 64-byte length hex string). I wondered myself if it wasn't the secret key to some encrypted file.

For the curious, the Equation Group Wikipedia article has a section dedicated to Possible links to Stuxnet and the NSA: https://en.wikipedia.org/wiki/Equation_Group#Possible_links_....

If nothing else, I found this compelling*

> In addition, timestamps in the malware seem to indicate that the programmers worked overwhelmingly Monday–Friday in what would correspond to a 08:00–17:00 workday in an Eastern United States timezone.

*assuming you trust the timestamps.

Interesting. Appreciated.

Reply on news.ycombinator.com