News for hackers. Stuff that matters.

A comment on Lifting the Shadows of the NSA’s Equation Group.

Re:Lifting the Shadows of the NSA’s Equation Group by JabavuAdams on Monday August 15, 2016 @06:42PM (#12294068)
I had to look up "Equation Group". A couple of articles mention that various malware tied to Equation Group includes timestamps indicating programmers working 8-5, Mon to Fri, in Eastern US timezones.

Anyone know of more info on why this would be left in? A simple oversight? False-flag propaganda?

Where would I look for more information on fingerprinting binaries? I.e. perhaps identifying compiler and even build environment.

Thanks!

[ Parent | on HN ]
Re:Lifting the Shadows of the NSA’s Equation Group by MajesticHobo on Monday August 15, 2016 @08:12PM (#12294570)
> Can we trust this information? The answer is: not fully, because the link timestamp can be altered by the developer in a way that’s not always possible to spot. However, certain indicators such as matching the year on the timestamp with the support of technology popular in that year leads us to believe that the timestamps were, at the very least, not wholly replaced. Looking at this from the other side, the easiest option for the developer is to wipe the timestamp completely, replacing it with zeroes. This was not found in the case of EquationDrug.

https://securelist.com/blog/research/69203/inside-the-equati...

[ Parent | on HN ]
Re:Lifting the Shadows of the NSA’s Equation Group by tbihl on Tuesday August 16, 2016 @01:09AM (#12295657)
Equation group is the advanced malware outfit that is suspected to be NSA. The name was given by the group at kaspersky who put the report together. A brief summary is found in the linked PDF [0].

False flag is possible, but it's not unreasonable to think that these were uncaught mistakes, just ones that have no functional effect. The Mandiant APT1 report shows a similar pattern of bread crumbs, though in that case they felt more intentional (ego flourishes) to me.

As to your final question, that field is reverse engineering. If you're looking for tools, IDA Pro is a very powerful disassembler.

[0] https://www.google.com/url?q=https://securelist.com/files/20...

[ Parent | on HN ]