Posted on 02/17/2015 9:02:27 AM PST by dennisw
The targets included government and military institutions, telecommunication companies, banks, energy companies, nuclear researchers, media, and Islamic activists.
The National Security Agency has figured out how to hide spying software deep within hard drives, allowing them to monitor and eavesdrop on the majority of the world's computers - even when they are not connected to the internet.
This 'surpasses anything known in terms of complexity and sophistication of techniques, and that has been active for almost two decades,' said Kaspersky.
'The hardware will be able to infect the computer over and over,' lead Kaspersky researcher Costin Raiu said in an interview.
According to Kaspersky, the spies made a technological breakthrough by figuring out how to lodge malicious software in the obscure code called firmware that launches every time a computer is turned on.
Disk drive firmware is viewed by spies and cybersecurity experts as the second-most valuable real estate on a PC for a hacker, second only to the BIOS code invoked automatically as a computer boots up.
What's more, even the makers of these hard drives are unaware that these spying programs have been installed, with the NSA obtaining their source codes by going so far as to pose as software developers according to former intelligence operatives, or telling the companies the government must do a security audit to make sure their source code is safe.
The group said it found personal computers in 30 countries infected The most infections were seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria
The Moscow-based security software maker Kaspersky Lab said it has found personal computers in 30 countries infected with one or more of the spying programs, with the most infections seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria.
(Excerpt) Read more at dailymail.co.uk ...
Kaspersky’s reconstructions of the spying programs show that they could work in disk drives sold by more than a dozen companies, comprising essentially the entire market. They include Western Digital Corp, Seagate Technology Plc, Toshiba Corp, IBM, Micron Technology Inc and Samsung Electronics Co Ltd.
Western Digital, Seagate and Micron said they had no knowledge of these spying programs. Toshiba and Samsung declined to comment. IBM did not respond to requests for comment.
Getting the source code
Raiu said the authors of the spying programs must have had access to the proprietary source code that directs the actions of the hard drives. That code can serve as a roadmap to vulnerabilities, allowing those who study it to launch attacks much more easily.
‘There is zero chance that someone could rewrite the [hard drive] operating system using public information,’ Raiu said.
Concerns about access to source code flared after a series of high-profile cyberattacks on Google Inc and other U.S. companies in 2009 that were blamed on China. Investigators have said they found evidence that the hackers gained access to source code from several big U.S. tech and defense companies.
It is not clear how the NSA may have obtained the hard drives’ source code. Western Digital spokesman Steve Shattuck said the company ‘has not provided its source code to government agencies.’ The other hard drive makers would not say if they had shared their source code with the NSA.
Seagate spokesman Clive Over said it has ‘secure measures to prevent tampering or reverse engineering of its firmware and other technologies.’ Micron spokesman Daniel Francisco said the company took the security of its products seriously and ‘we are not aware of any instances of foreign code.’
Kaspersky uncovers online spy tools with apparent links to NSA
According to former intelligence operatives, the NSA has multiple ways of obtaining source code from tech companies, including asking directly and posing as a software developer. If a company wants to sell products to the Pentagon or another sensitive U.S. agency, the government can request a security audit to make sure the source code is safe.
‘They don’t admit it, but they do say, “We’re going to do an evaluation, we need the source code,”’ said Vincent Liu, a partner at security consulting firm Bishop Fox and former NSA analyst. ‘It’s usually the NSA doing the evaluation, and it’s a pretty small leap to say they’re going to keep that source code.’
The NSA declined to comment on any allegations in the Kaspersky report. Vines said the agency complies with the law and White House directives to protect the United States and its allies ‘from a wide array of serious threats.’
Kaspersky called the authors of the spying program ‘the Equation group,’ named after their embrace of complex encryption formulas.
The group used a variety of means to spread other spying programs, such as by compromising jihadist websites, infecting USB sticks and CDs, and developing a self-spreading computer worm called Fanny, Kaspersky said.
Fanny was like Stuxnet in that it exploited two of the same undisclosed software flaws, known as ‘zero days,’ which strongly suggested collaboration by the authors, Raiu said. He added that it was ‘quite possible’ that the Equation group used Fanny to scout out targets for Stuxnet in Iran and spread the virus.
Read more:
Just one more reason to go Galt.
NSA says to BenLurkin -— “How do you like me now!”
Interesting that we find this from a UK source reporting on Russian research.
Not a peep from the US based A/V people?
Where is the NYT on this?
If this is true, this is terrible and will hurt US companies and interests around the world.
Kaspersky is world-famous, highly regarded Russian anti-malware software.
It protects my computer.
I love Big Brother.
… allowing them to monitor and eavesdrop on the majority of the world’s computers—even when they are not connected to the internet …Oh brother. Sounds like another attempt to resurrect the tin-foil hat industry.
It reports back to the mothership WHEN you do get on the internets...duh
AFDB, baby!
http://zapatopi.net/afdb/
Kaspersky is state of the art.....if anyone was going to uncover this it was going to be them
I think the author meant that they do the monitoring, but are unable to send the information anywhere. I don’t know what use that would be. They could store it in secret files and send it later, perhaps.
This crazy thing we call computers is getting interesting....
Then that is what should have been said. As written, it says that communication while offline is not only possible but a fait accompli.
How many Freepers remember the good old days when the USSR, not the US government, was the looming threat to our freedoms?
Is O’Brien a Freeper?
The article said ... “It is not clear how the NSA may have obtained the hard drives’ source code. Western Digital spokesman Steve Shattuck said the company ‘has not provided its source code to government agencies.’ The other hard drive makers would not say if they had shared their source code with the NSA.”
— — —
WELL ... a boatload of money from one of these agencies to someone on the inside would “shake loose” the source code! ... :-) ...
I wouldn’t think it would be that hard.
I don’t think so...most storage programs can queue up information until they are connected...
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.