NSA-linked Bvp47 Linux backdoor widely undetected for 10 years | Hacker News Reader

NSA-linked Bvp47 Linux backdoor widely undetected for 10 years

bleepingcomputer.com

35 pointsthinkmassive10 comments

Terminology nitpick: This isn't a backdoor. This is an APT. (Otherwise, we need a new term for "code with an intentional security hole", which isn't what's happening here).

Agree, I looked and looked for anything that would make it a backdoor.

The press release: https://www.pangulab.cn/en/post/the_bvp47_a_top-tier_backdoo... The report: https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_...

This is an analysis of a file they obtained in 2013, which has elements that were revealed in the Shadow Brokers files. The list of victims is from those files, too, from 2017.

There's almost never an indication how the backdoor is installed. Is there an internet exploitable vulnerability in the TCP/IP stack?

Most home routers these days have firewalls enabled and no amount of NSA technical wizardry is going to get past those.

Can't they have backdoors by design? For example, open source printers are not a thing because of the backdoors and security measures required in order to sell your printer on the market.

Out of curiosity, what backdoors are you referring to?

Probably referring to tracking dots, eg:

https://en.m.wikipedia.org/wiki/Machine_Identification_Code

I can’t tell if you’re being sarcastic with that second paragraph but obviously getting past extremely complicated firewalls is a pretty key skill set of a signals intelligence agency and the one that comes built into your home router isn’t going to provide any meaningful protection against a well resourced and persistent attacker

The title is ambiguious: "Bvp47 Linux backdoor" means "a virus called Bvp47 is a Linux backdoor", not "Linux has a backdoor which is named Bvp47"

The "backdoor" is refered from the pangulab report[1] but I think it actually means "virus" in common sense. (Maybe security people speek different technical jargons than linux users?)

[1] https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_...

>> In the case of the Bvp47 Linux backdoor, Pangu Lab researchers say that it was used on targets in the telecom, military, higher-education, economic, and science sectors

So basically NSA spies also on scientists and their research.

Reply on news.ycombinator.com