Hacker News Reader

Comment by dopamean | Hacker News Reader

It should be noted that it is only suspected that the Equation Group is related to the NSA. I only bring this up not because I don't think it is but rather to emphasize that it has not been proven yet.

View on HN

For the curious, the Equation Group Wikipedia article has a section dedicated to Possible links to Stuxnet and the NSA: https://en.wikipedia.org/wiki/Equation_Group#Possible_links_....

If nothing else, I found this compelling*

> In addition, timestamps in the malware seem to indicate that the programmers worked overwhelmingly Monday–Friday in what would correspond to a 08:00–17:00 workday in an Eastern United States timezone.

*assuming you trust the timestamps.

If this leak is real, it points to one of two things. Either it isn't the NSA and is a company or some quasi-governmental group - owing to the fact that any of this shit the NSA makes would be on JWICS terminals and absolutely not accessible to the internet, or it means there's a leak from the NSA that dumped these files and has decided to sell them. I'd lean more towards the former.

The command and control ("listening posts" in intelligence community parlance) for even NSA implants has to be on the public internet so the victims can phone home. This stuff could be from one of those servers.

Is that necessarily true for NSA et al.? I don't see why the target couldn't just send the data towards an arbitrary destination, and that data be collected by NSA via a passive tap. Commands could be sent using a QUANTUM-style technique (packet injection with spoofed origin)

Snowden did tweet what looked like an AES key last week.

It was a sha2 (or rather, a 64-byte length hex string). I wondered myself if it wasn't the secret key to some encrypted file.

Reply on news.ycombinator.com