NSA Spying Firmware is in Our Hard Disks

Firmware is a software, or digital instructions, embedded with any hardware components our computers are equipped with. From the motherboard to the storage media we use, there is a firmware in each of them, to function properly.

With the right equipment or an outright cooperation of the hardware manufacturers, they are all hackable.

The NSA is said to have exploited this vulnerability for monitoring our activities online, and for stealing passwords.

Judging from the countries hit mostly by NSA’s firmware based spying, it would not be a surprise if Israel, the Rothschilds and Black Nobility have benefited all of the data, meta or actual content, it had gathered.

So the big question now is: Who actually stole $1 Billion from bank depositors’ account worldwide and dump it into their own accounts?

Who has the strong motivation and the right equipment to launch such a desperate scheme, and without eliciting global law enforcement condemnation..  surprisingly?

Why have the agencies not issued any statements since the ATM hacking was reported two days ago?

Below is the map showing NSA exploit…

20150216_equation_0

Priority targets are said to be the following:

•     Governments and diplomatic institutions
•     Telecommunication
•     Aerospace
•     Energy
•     Nuclear research
•     Oil and gas
•     Military
•     Nanotechnology
•     Islamic activists and scholars
•     Mass media
•     Transportation
•     Financial institutions
•     Companies developing cryptographic technologies

This next  map is the hacking of $1 Billion total todate…

Geographical distribution of targets according to C2 data (image by Kaspersky Lab)

Russian researchers expose breakthrough U.S. spying program

By Joseph Menn

SAN FRANCISCO Mon Feb 16, 2015 5:10pm EST

(Reuters) – The U.S. National Security Agency has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba and other top manufacturers, giving the agency the means to eavesdrop on the majority of the world’s computers, according to cyber researchers and former operatives.

That long-sought and closely guarded ability was part of a cluster of spying programs discovered by Kaspersky Lab, the Moscow-based security software maker that has exposed a series of Western cyberespionage operations.

Kaspersky said it found personal computers in 30 countries infected with one or more of the spying programs, with the most infections seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria. The targets included government and military institutions, telecommunication companies, banks, energy companies, nuclear researchers, media, and Islamic activists, Kaspersky said. (reut.rs/1L5knm0)

The firm declined to publicly name the country behind the spying campaign, but said it was closely linked to Stuxnet, the NSA-led cyberweapon that was used to attack Iran’s uranium enrichment facility. The NSA is the agency responsible for gathering electronic intelligence on behalf of the United States.

A former NSA employee told Reuters that Kaspersky’s analysis was correct, and that people still in the intelligence agency valued these spying programs as highly as Stuxnet. Another former intelligence operative confirmed that the NSA had developed the prized technique of concealing spyware in hard drives, but said he did not know which spy efforts relied on it.

NSA spokeswoman Vanee Vines declined to comment.

Kaspersky published the technical details of its research on Monday, which should help infected institutions detect the spying programs, some of which trace back as far as 2001.

The disclosure could further hurt the NSA’s surveillance abilities, already damaged by massive leaks by former contractor Edward Snowden. Snowden’s revelations have hurt the United States’ relations with some allies and slowed the sales of U.S. technology products abroad.

The exposure of these new spying tools could lead to greater backlash against Western technology, particularly in countries such as China, which is already drafting regulations that would require most bank technology suppliers to proffer copies of their software code for inspection.

Peter Swire, one of five members of U.S. President Barack Obama’s Review Group on Intelligence and Communications Technology, said the Kaspersky report showed that it is essential for the country to consider the possible impact on trade and diplomatic relations before deciding to use its knowledge of software flaws for intelligence gathering.

“There can be serious negative effects on other U.S. interests,” Swire said.

TECHNOLOGICAL BREAKTHROUGH

According to Kaspersky, the spies made a technological breakthrough by figuring out how to lodge malicious software in the obscure code called firmware that launches every time a computer is turned on.

Disk drive firmware is viewed by spies and cybersecurity experts as the second-most valuable real estate on a PC for a hacker, second only to the BIOS code invoked automatically as a computer boots up.

“The hardware will be able to infect the computer over and over,” lead Kaspersky researcher Costin Raiu said in an interview.

Though the leaders of the still-active espionage campaign could have taken control of thousands of PCs, giving them the ability to steal files or eavesdrop on anything they wanted, the spies were selective and only established full remote control over machines belonging to the most desirable foreign targets, according to Raiu. He said Kaspersky found only a few especially high-value computers with the hard-drive infections.

Kaspersky’s reconstructions of the spying programs show that they could work in disk drives sold by more than a dozen companies, comprising essentially the entire market. They include Western Digital Corp, Seagate Technology Plc, Toshiba Corp, IBM, Micron Technology Inc and Samsung Electronics Co Ltd.

Western Digital, Seagate and Micron said they had no knowledge of these spying programs. Toshiba and Samsung declined to comment. IBM did not respond to requests for comment.

GETTING THE SOURCE CODE

Raiu said the authors of the spying programs must have had access to the proprietary source code that directs the actions of the hard drives. That code can serve as a roadmap to vulnerabilities, allowing those who study it to launch attacks much more easily.

“There is zero chance that someone could rewrite the [hard drive] operating system using public information,” Raiu said.

Concerns about access to source code flared after a series of high-profile cyberattacks on Google Inc and other U.S. companies in 2009 that were blamed on China. Investigators have said they found evidence that the hackers gained access to source code from several big U.S. tech and defense companies.

It is not clear how the NSA may have obtained the hard drives’ source code. Western Digital spokesman Steve Shattuck said the company “has not provided its source code to government agencies.” The other hard drive makers would not say if they had shared their source code with the NSA.

Seagate spokesman Clive Over said it has “secure measures to prevent tampering or reverse engineering of its firmware and other technologies.” Micron spokesman Daniel Francisco said the company took the security of its products seriously and “we are not aware of any instances of foreign code.”

According to former intelligence operatives, the NSA has multiple ways of obtaining source code from tech companies, including asking directly and posing as a software developer. If a company wants to sell products to the Pentagon or another sensitive U.S. agency, the government can request a security audit to make sure the source code is safe.

“They don’t admit it, but they do say, ‘We’re going to do an evaluation, we need the source code,'” said Vincent Liu, a partner at security consulting firm Bishop Fox and former NSA analyst. “It’s usually the NSA doing the evaluation, and it’s a pretty small leap to say they’re going to keep that source code.”

Kaspersky called the authors of the spying program “the Equation group,” named after their embrace of complex encryption formulas.

The group used a variety of means to spread other spying programs, such as by compromising jihadist websites, infecting USB sticks and CDs, and developing a self-spreading computer worm called Fanny, Kasperky said.

Fanny was like Stuxnet in that it exploited two of the same undisclosed software flaws, known as “zero days,” which strongly suggested collaboration by the authors, Raiu said. He added that it was “quite possible” that the Equation group used Fanny to scout out targets for Stuxnet in Iran and spread the virus.

(Reporting by Joseph Menn; Editing by Tiffany Wu)

source »

Remote ATM control: Kaspersky Lab details $1bn online bank heist (EXCLUSIVE)

Published time: February 16, 2015 16:51
Edited time: February 16, 2015 20:26

Reuters / Arnd Wiegmann
Reuters / Arnd Wiegmann

 

Internet security company Kaspersky Lab says the banking industry could be experiencing “a new era in cybercrime.” The company has been investigating a $1 billion attack on financial institutions by a sophisticated hacking group.

The IT security firm says the hackers from the Carabanak group used a complex virus system which was later named after them. It is not like the simple Trojan horse malware used to by-pass security systems, but something much more complex and unique, according to documents exclusively seen by RT.

Russian cyber-security company Kaspersky Lab was invited to look into the matter, after an ATM in the Ukrainian capital Kiev started giving out cash randomly without anyone inserting a card or touching any buttons in late 2013.

The attackers did not look to exploit weaknesses in the company’s software. Instead, they took screenshots of computers at 20-second intervals and were able to learn the victims’ internal procedures. They were then able to copy these and impersonate the victim in order to process fraudulent transactions.

Anton Shingarev, Chief of Staff at Kaspersky Lab, said the complex nature of the malware used was unprecedented and it was “the most highly sophisticated criminal attack we have ever seen.”

He added that the cyber-criminals used methods that were used by governments in the past, while each attack took approximately two months and around 10 criminals were working on a daily basis on it.

Kaspersky Lab said that most of the victims were located in Russia, the US, Germany, China and Ukraine. The hacking group targeted 30 banks. One customer lost in the region of $7.3 million because of ATM fraud, while another had $10 million stolen due to hackers entering the person’s online banking page.

The money would then be sent to accounts set up mainly in the US and China.

“They managed to get access to the whole banking system. They managed to remotely control ATM’s and they managed to transfer money from one account to another. Due to the extreme level of complexity, banks did not realize they were coming under attack,” Shingarev told RT.

Worryingly, the criminals were able to bypass advanced control and fraud detection systems, which the financial industry has been reliant on for years for internet security. The hackers went down another route to avoid these security systems by using industry-wide funds transfers (the SWIFT network), which would allow them to update the balances of those holding an account in the bank.

For example, the hackers could alter the data for an account that held $1,000 and add extra funds to make the balance $10,000. The criminals would then withdraw $9,000 bringing the balance back to $1,000. As the customer lost no money, he or she would be none the wiser and not raise any alarm.

The attackers were also not too greedy deliberately limiting the amount stolen from each victim to $10 million. This was to ensure that red flags were not raised and law enforcement agencies did not carry out a thorough investigation.

Geographical distribution of targets according to C2 data (image by Kaspersky Lab)

Geographical distribution of targets according to C2 data (image by Kaspersky Lab)

Kaspersky Lab says that little is known about the criminals, as they have now been detected and the IT security firm cannot reveal any details on them. They did mention that the criminals had been working for around two years and they did leave traces which Kaspersky Lab is now studying.

“It’s like an arms race. Security companies develop better protection and criminals develop better malware to bypass it,” Shingarev added.

The Carbanak malware used by the cyber-criminals proved to be very successful in helping the attackers steal around $1 billion. Kaspersky Lab is worried about the increasing sophistication of attacks.

“Despite increased awareness of cybercrime within the financial services sector, it appears that spear phishing attacks and the old exploits (for which patches have been disseminated) remain effective against larger companies. Attackers always use this minimal effort approach in order to bypass a victim ́s defenses,” a press release from the company stated.

source »

We can help bring down the Cabal and defeat the Depopulation Agenda

Big Pharma is one of the sources of funds for the Cabal. It also serves as the weapon of mass destruction via vaccine tainted with live virus it is suppose to protect us from, and the deadly chemicals use to treat our diseases that they caused through our GMO / pesticide contaminated food supply.

We can avoid using drugs, defeat any viral attack and scaremongering easily by knowing how to build our own comprehensive antiviral system. Find more about it here.

Health & Medicine - Top Blogs  Philippines

One thought on “NSA Spying Firmware is in Our Hard Disks”

We do appreciate sensible comments...

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.