New Smoking Gun Further Ties NSA to Omnipotent “Equation Group” Hackers
March 11th, 2015Via: Ars Technica:
Researchers from Moscow-based Kaspersky Lab have uncovered more evidence tying the US National Security Agency to a nearly omnipotent group of hackers who operated undetected for at least 14 years.
The Kaspersky researchers once again stopped short of saying the hacking collective they dubbed Equation Group was the handiwork of the NSA, saying only that the operation had to have been sponsored by a nation-state with nearly unlimited resources to dedicate to the project. Still, they heaped new findings on top of a mountain of existing evidence that already strongly implicated the spy agency. The strongest new tie to the NSA was the string “BACKSNARF_AB25” discovered only a few days ago embedded in a newly found sample of the Equation Group espionage platform dubbed “EquationDrug.” “BACKSNARF,” according to page 19 of this undated NSA presentation, was the name of a project tied to the NSA’s Tailored Access Operations.
“BACKSNARF” joins a host of other programming “artifacts” that tied Equation Group malware to the NSA. They include “Grok,” “STRAITACID,” and “STRAITSHOOTER.” Just as jewel thieves take pains to prevent their fingerprints from being found at their crime scenes, malware developers endeavor to scrub usernames, computer IDs, and other text clues from the code they produce. While the presence of the “BACKSNARF” artifact isn’t conclusive proof it was part of the NSA project by that name, the chances that there were two unrelated projects with nation-state funding seems infinitesimally small.
Of course, there is nothing preventing a group from developing malware and leaving clues in it that point to a different source. The reasoning behind why you’d do such a thing is more complex, but not so undesirable that you’d never do it.
Commentators are being awfully complicit by just taking this stuff at face value, and not considering the other possibilities. The BACKSNARF string may be evidence of an NSA project; or the amazing coincidence of two unrelated projects with identical names purely by chance…. but in between those two options there is always deliberately misleading misinformation. If I was developing malware, I would totally leave somebody else’s fingerprints in it, apparently by accident…
Hmm…
S.P.E.C.T.R.E.?