This is the sort of event that should -- though it obviously won't -- lead to a policy debate about the wisdom of locating cyberdefense and cyberwar within the same hallwaus.

This is thus far the largest scale example that if you sell security and surveillance, at most one of those product lines isn't a fraud.

I imagine due to heavy and intentional compartmentalization this doesn't happen.

Perhaps it depends on the nature of the exploit. For example, I consider the weakening of Dual_EC_DRBG devilishly good: because of the chosen P and Q they knew it was weak but also were the only ones who had the key. They would definitely not tell anyone about that.

That seems to be best explanation. Two different groups with IAD being smaller one. The IAD also faces many issues with regs, red tape, Congessional mandate to use COTS garbage, lack of liability enforcement, etc. It all adds up to them getting less effective over time.

They still do some good stuff when they put their pros on it. Their Inline Media Encryptor is great. I just cloned it and expanded in one of my designs. Just compare its security features to any encrypted USB disk. You'll see high-security vs mainstream security difference.

Expect to get a lot of updates in the next weeks.

(They could return the previous high bidder's bid at the point where they are outbid, could they not?).

- First of all you force him to drop the banana

- then, second, you eat the banana, thus disarming him.

- You have now rendered him ’elpless.

http://rump2010.cr.yp.to/c659ebaf681758e01ccf824fd58f3c42.pd...

Of course, the seller could always be pretending. Given the seeming authenticity of the leak however, it's doubtful they're western—unless they're operating very illegally and trying to cover their tracks.

However, their command of English is almost certainly pretty good, seeing how they use somewhat fancy words ("closing remarks") appropriately and clearly know English idiom well ("When we feel is time to end" - using "feel" in that phrase is sufficiently peculiar to English that I wouldn't expect it from anyone who thinks in another language and translates in their head more or less mechanically). This makes it harder to rule out that the "free" file consists of exploits they collected on the market and doctored to give them a more NSAish veneer.

> Q: What is in auction files? A: Is secret.

> Q: When does auction end? A: Unknown. When we feel is time to end.

A native speaker would say "it's secret" or "it's a secret", or "when we feel it's time [to end it]".

Granted, the text seems a bit like someone imitating a Russian who speaks broken English from the movies. It may well be misdirection. It's possible that non-native speakers from other languages also make this mistake, but I have seen it commonly with Slavic speakers.

This is typical of mandarin chinese; the verbs 觉得 and 感觉 are "feel" in a literal sense, but mean "think (something)".

If one language uses a metaphor, odds are some other languages do too.

> You wanted to know who I am, Zero Cool? Well, let me explain the New World Order. Governments and corporations need people like you and me. We are Samurai... the Keyboard Cowboys... and all those other people out there who have no idea what's going on are the cattle... Moooo.

Anyway, they painted a huge target on their back if this is real NSA stuff. I can't see how they would cash-out any significant bitcoin amount ($100k+) without being traced.

For complete anonymization, they need a little patience.

In the near future, they can buy ZCash.

In the distant future, they can probably move the money into a MimbleWimble based sidechain.

OK, now you're just making up words...

Btw, if you're in Germany, you might still have a chance to get an anonymous prepaid SIM in the next weeks before the carriers adapt to the legal change - you can use that, too.

http://shop.tescomobile.com/pay-monthly/sim-only/Tesco+Mobil...

With roaming in the EU becoming free mid-2017, and Brexit not coming into effect til 2019, the whole EU will still be well covered by anonymous prepaid.

Just like they sent a takedown to every site hosting content from the shadowbreakers, they might just send a SWAT team to every Tor node your data ran through, and try to track you.

And that's in addition to whatever TAO has in their reportoire.

The lack of definite articles and linking verbs is particularly suggestive of a Slavic background. Here's another telling signature:

We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group.

So instead of using the standard "linking verb + gerund" construction that modern English provides to indicate continual (or background) activity they're using the simple present tenses of these verbs the way Slavic languages do, via the imperfective forms of these verbs.

And also:

If you want reverse, write many words, make big name for self, get many customers, you send bitcoin.

You bid against Equation Group, win and find out or bid pump price up, piss them off, everyone wins.

You like reward, you take risk, maybe win, maybe not, no guarantees.

The use of commas to link independent clauses (instead of coordinating conjunctions, like English) also happens to be very characteristic of Russian.

Also I am guessing in a group of computer literate people, from Eastern Europe, they couldn't find one person with a better handle on English grammar and phraseology.

If anything stands out from the writing to me it's that it sounds like a scam.

BTW, it should be "the files".

[1] http://www.cio.com/article/3107946/nsa-hacked-top-cyber-weap...

Unless they changed the address, they've only received a total of 0.08003067 BTC at the time of this comment.

https://blockchain.info/address/19BY2XCgbDe6WtTVbTyzM9eR3LYr...

I mean, even with a perfectly honest auctioneer, dollar auctions (where one person wins but more than one person pays) are one of those games where the only way to win is not to play. Now add to that the fact that there's no reason to trust the auctioneer.

I can see perhaps Iran in a desperate attempt to exact revenge for their centrifuge plant being hacked, throwing few hundred thousands at them, just on small chance this would yield something.

Also, i wonder if computer scientists feel anything like the scientists after creating and deploying the atomic bomb... "Now I am become Death, the destroyer of worlds."

Referring to the source code of some of the major components. Any python source was stripped of comments, which is surely interesting, but not as interesting as the source of the binaries.

Anyone know of more info on why this would be left in? A simple oversight? False-flag propaganda?

Where would I look for more information on fingerprinting binaries? I.e. perhaps identifying compiler and even build environment.

Thanks!

https://securelist.com/blog/research/69203/inside-the-equati...

False flag is possible, but it's not unreasonable to think that these were uncaught mistakes, just ones that have no functional effect. The Mandiant APT1 report shows a similar pattern of bread crumbs, though in that case they felt more intentional (ego flourishes) to me.

As to your final question, that field is reverse engineering. If you're looking for tools, IDA Pro is a very powerful disassembler.

[0] https://www.google.com/url?q=https://securelist.com/files/20...