Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equation Group Cyber Weapons Auction

theshadowbrokers.tumblr.com

Post reply on HN
Print view View original

31–40 of 151 posts

Re: Equation Group Cyber Weapons Auction

#31

Post by moyix »

AnkhMorporkian wrote: post #29
dopamean wrote: post #21

Earlier quoted context omitted.

It should be noted that it is only suspected that the Equation Group is related to the NSA. I only bring this up not because I don't think it is but rather to emphasize that it has not been proven yet.

If this leak is real, it points to one of two things. Either it isn't the NSA and is a company or some quasi-governmental group - owing to the fact that any of this shit the NSA makes would be on JWICS terminals and absolutely not accessible to the internet, or it means there's a leak from the NSA that dumped these files and has decided to sell them. I'd lean more towards the former.

The command and control ("listening posts" in intelligence community parlance) for even NSA implants has to be on the public internet so the victims can phone home. This stuff could be from one of those servers.

Re: Equation Group Cyber Weapons Auction

#32

Post by dadver »

softawre wrote: post #20
dadver wrote: post #12

Earlier quoted context omitted.

>Everything about this auction is lined up to incentivize a scam. Yes, however the contents of the free sample seems very real. Without having dug into the binaries it's hard to tell, but it's hard to imagine someone wrote this to scam 1 million BTC out of the net.

With 1 million BTC on the line, you have a hard time imagining that someone would do this? People do work for a lot less..

I'm curious if they (in lack of better English) didn't mean 1 million USD in BTC. 1 million BTC is -a lot of money-, even for a release of Equation Group material.

Re: Equation Group Cyber Weapons Auction

#33

Post by nadaviv »

To prove this is real, they should've:

- Split the leak into multiple chunks, each encrypted with a different key, and each readable/usable on its own

- Announce, ahead of time, that a random chunk will be revealed, based on the hash of block #N on the Bitcoin network

- On block #N, reveal chunk number block_N_hash % num_chunks.

Basically, reveal a provably random chunk in a way that cannot be controlled by the auctioneers, which would ensure that all the chunks are (most likely) real.

Re: Equation Group Cyber Weapons Auction

#34

Post by sctb »

moyix wrote: post #8
omgitstom wrote: post #7

Auction information is here: https://github.com/theshadowbrokers/EQGRP-AUCTION

Yep, I bungled the link. The tumblr has all of the information but it's split into separate posts: https://theshadowbrokers.tumblr.com/

Thanks, we updated the submission.

Re: Equation Group Cyber Weapons Auction

#36

Post by nadaviv »

nadaviv wrote: post #33

To prove this is real, they should've: - Split the leak into multiple chunks, each encrypted with a different key, and each readable/usable on its own - Announce, ahead of time, that a random chunk will be revealed, based on the hash of block #N on the Bitcoin network - On block #N, reveal chunk number block_N_hash % num_chunks . Basically, reveal a provably random chunk in a way that cannot be controlled by the auct…

Also, if they really want to make this as trust-free as possible, they could use ZKCP [0][1] to make the payment stage and the reveal stage atomic - the moment the payment is taken by the auctioneers, the decryption key is revealed (using hash-locked transactions and zero knowledge proofs).

This, however, won't work with their penny auction style bids.

[0] https://en.bitcoin.it/wiki/Zero_Knowledge_Contingent_Payment

[1] https://bitcoincore.org/en/2016/02/26/zero-knowledge-conting...

Re: Equation Group Cyber Weapons Auction

#37

Post by ars »

dadver wrote: post #12
danielvf wrote: post #9

The structure of this auction is amazing! 1. All bids are paid up front, and you never get your money back, even if you aren't the highest bidder. So if people bid $50, $70, and $100, they collect $220. 2. No one can verify what is actualy up for sale before the auction. 3. There is no way for the world to know that they actualy delivered the goods after the auction. 4. There is no way for the highest bidder to know…

>Everything about this auction is lined up to incentivize a scam. Yes, however the contents of the free sample seems very real. Without having dug into the binaries it's hard to tell, but it's hard to imagine someone wrote this to scam 1 million BTC out of the net.

> Yes, however the contents of the free sample seems very real.

The only people who could verify if it's real are the Equation Group themself. For anyone else it's impossible to verify - it's just some names.

So: If it's real the Equation Group will bid - probably a lot. If it's fake no one will bid.

So it'll be easy to tell which it is.

Re: Equation Group Cyber Weapons Auction

#38

Post by JosephRedfern »

softawre wrote: post #20
dadver wrote: post #12

Earlier quoted context omitted.

>Everything about this auction is lined up to incentivize a scam. Yes, however the contents of the free sample seems very real. Without having dug into the binaries it's hard to tell, but it's hard to imagine someone wrote this to scam 1 million BTC out of the net.

With 1 million BTC on the line, you have a hard time imagining that someone would do this? People do work for a lot less..

That's 6.3% of all Bitcoin currently in circulation. A crazy amount.

Re: Equation Group Cyber Weapons Auction

#39

Post by Shank »

I wouldn't call this auction even remotely smart. Bitcoin is public and can be tracked -- if the files are legit, this is a great way to end up on every nation state watchlist in the world. Oh, you're bidding on these files? That's a great signal to every government that you're a big target.

Re: Equation Group Cyber Weapons Auction

#40

Post by kharms »

nadaviv wrote: post #33

To prove this is real, they should've: - Split the leak into multiple chunks, each encrypted with a different key, and each readable/usable on its own - Announce, ahead of time, that a random chunk will be revealed, based on the hash of block #N on the Bitcoin network - On block #N, reveal chunk number block_N_hash % num_chunks . Basically, reveal a provably random chunk in a way that cannot be controlled by the auct…

They would need to reveal several chunks, otherwise they could encrypt the same thing n times.
Post reply on HN