41–50 of 151 posts
Ha. I was targeted by this auction specifically. The odd thing is whoever is behind this went through the trouble of posting it to the SecureDrop instance behind BerlinLeaks. https://heartsucker.com/blog/children-at-play
You complained about bad grammar in your article, so I feel the need to point out this error in the last sentence.
Ha. I was targeted by this auction specifically. The odd thing is whoever is behind this went through the trouble of posting it to the SecureDrop instance behind BerlinLeaks. https://heartsucker.com/blog/children-at-play
> has no idea what their doing You complained about bad grammar in your article, so I feel the need to point out this error in the last sentence.
Nobody could be both smart enough to hack Equation Group and dumb enough to think that they could just cash out through bitcoin and walk away.
* Whomever is running this auction knows everything that has been mentioned in these threads already, and they're probably a few steps ahead of us all. There are multiple indicators that they know what they're doing from a technical standpoint and that it's very likely that these 'weapons' indeed do what they claim. * On the other hand, there's a lot of reason to believe that these could potentially be faked, since the whole auction is just designed to generate income.
Equation Group is a real group. They do exist, they get paid really well to operate, and a couple things jump out as obviously being bait.
If you were to place a bid, (I plan to bid a couple dozen BTC or so, but I want to see what other people do first) then they say they'd contact you with decrypt information and then you'd have the rest.
The real Equation Group is a group of intelligent individuals, rumored to be a group of several dozen people, and so they realize that they all have to operate under the same standards, and resist being correlated. These guys know that every so-called elite hacker that we know about, we know about them because they fucked up. We know that EG exists because their tradecraft WASNT good enough. The real question is whether or not they wanted us to find out. Bitmessage isnt perfect, i2p isnt perfect, none of these tools are perfect and the entire idea of a group that might not even exist contacting a bidder after they may or may not have bid the highest bid is just ridiculous.
There is reason to believe that if EG actually exists, that there might be subdivisions within whatever larger collective they belong to (NSA, CIA, etc) that seem to learn from approaches that can be correlated to work that EG either wanted us to find, or didn't.
Regardless, these guys know enough to not get in trouble over this. Even if they're NSA contractors, or permanent employees, or some sort of secret operatives from some crazy Intel firm, whatever the case is, they aren't going to make some stupid mistake and ruin this.
I'd give this like a 30% chance of being real. Doesn't seem likely.
To prove this is real, they should've: - Split the leak into multiple chunks, each encrypted with a different key, and each readable/usable on its own - Announce, ahead of time, that a random chunk will be revealed, based on the hash of block #N on the Bitcoin network - On block #N, reveal chunk number block_N_hash % num_chunks . Basically, reveal a provably random chunk in a way that cannot be controlled by the auct…
Also, if they really want to make this as trust-free as possible, they could use ZKCP [0][1] to make the payment stage and the reveal stage atomic - the moment the payment is taken by the auctioneers, the decryption key is revealed (using hash-locked transactions and zero knowledge proofs). This, however, won't work with their penny auction style bids. [0] https://en.bitcoin.it/wiki/Zero_Knowledge_Contingent_Payment…
To prove this is real, they should've: - Split the leak into multiple chunks, each encrypted with a different key, and each readable/usable on its own - Announce, ahead of time, that a random chunk will be revealed, based on the hash of block #N on the Bitcoin network - On block #N, reveal chunk number block_N_hash % num_chunks . Basically, reveal a provably random chunk in a way that cannot be controlled by the auct…
Also, if they really want to make this as trust-free as possible, they could use ZKCP [0][1] to make the payment stage and the reveal stage atomic - the moment the payment is taken by the auctioneers, the decryption key is revealed (using hash-locked transactions and zero knowledge proofs). This, however, won't work with their penny auction style bids. [0] https://en.bitcoin.it/wiki/Zero_Knowledge_Contingent_Payment…
The structure of this auction is amazing! 1. All bids are paid up front, and you never get your money back, even if you aren't the highest bidder. So if people bid $50, $70, and $100, they collect $220. 2. No one can verify what is actualy up for sale before the auction. 3. There is no way for the world to know that they actualy delivered the goods after the auction. 4. There is no way for the highest bidder to know…
A government would handle this by trying to chase down the autioneers. If they wanted the data, they would buy it from Kaspersky, assuming it's real.
The structure of this auction is amazing! 1. All bids are paid up front, and you never get your money back, even if you aren't the highest bidder. So if people bid $50, $70, and $100, they collect $220. 2. No one can verify what is actualy up for sale before the auction. 3. There is no way for the world to know that they actualy delivered the goods after the auction. 4. There is no way for the highest bidder to know…
Or for the highest bidder to even know that they won.
The structure of this auction is amazing! 1. All bids are paid up front, and you never get your money back, even if you aren't the highest bidder. So if people bid $50, $70, and $100, they collect $220. 2. No one can verify what is actualy up for sale before the auction. 3. There is no way for the world to know that they actualy delivered the goods after the auction. 4. There is no way for the highest bidder to know…
This is effectively a "penny auction," which, as you point out, benefits nobody but the auctioneers.
~~A silent penny auction :|~~
Sounds important. What does it all mean?
Equation Group is the name given by AV vendors to a group of attacks thought to be carried out by NSA. This is, apparently, a dump of internal files (mostly exploits and command & control scripts) that someone got ahold of. They're now apparently trying to auction them off. If it's a fake, it's a very good one – the code words match up to things we've seen in the Snowden leaks, e.g. Jetplow ( https://www.schneier.com…