So if I want the USA out of my system, all I have to do is create some dummy exes, dlls and regkeys on my system?
W-what if you use Linux? :B
[deleted]
Nazar: Analyzing malware that was uncovered in leaked NSA files
11–20 of 34 posts
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#12So if I want the USA out of my system, all I have to do is create some dummy exes, dlls and regkeys on my system?
Kinda hard to get them out of your system if you run Windows which is made by a company located in the USA and that sends data constantly to their servers, some of which are based in the states.
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#13Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#14Earlier quoted context omitted.
Seems like it. In other viruses (and I'm sure the NSA does this too), your system might actually be scanned for other known viruses and removed. In the NSA's case, these could be enemy threat actors.
It used to be standard operating practice as an attacker to close the holes through which you yourself gained access to prevent others from taking your prize. Ironically the most secure and cheapest thing a company could do was get compromised by a competent attacker who only wanted to launder small amounts of data or CPU cycles through your network, and in exchange keeps your servers all patched and up to date for y…
So be an e-aphid and let the kindly e-ants farm you?
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#15Looks like an interns summer project, of course figuring out what is real malware and what is designed to look like malware can be very tricky almost magical, when secret court orders can be slapped on tech manufacturers.
Anyway, why have a shutdown facility unless they also have a remote wake up (WOL) embeded in a switch or some other network device? Editing files, maybe messing up some program code by inserting backdoors could be useful, lets face it, who checks the program code they have written from ten years ago or the libraries they import and use? The UDP also suggests the network is compromised so it seems like Nazar is just part of a bigger suite of exploits. I've always been amazed that when I attempt to lockdown my systems so I can account for every packet of data going in or out, I still get hacked, beit bios pwd changed, hd pwd set, its clear there is an element of hardware hacking taking place, and its not like anyone ever really checks their firmware is genuine do they? You dont even get a hash signature from a manufacturer for the jellybeans running the firmware that doesnt change, so I'm amazed anyone really trusts their smart phones, laptops, tv's, switches, printers, cctv, alarm systems etc etc. Coupled with wifi gesture control, some people can even see you scratching your head, picking your nose and then scratching your arse. But hey carry on, modern religions are a wonderful thing but sometimes the old ways are best.
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#16I believe the use of open source tools to accomplish their tasks is interesting.
Using "living off the land" open source tools also hinders researchers when trying to attribute an attack to a certain country.
I found malware that was installed remotely on to millions of Android users under the government "Life Line" program that also used readily available open-source code found on GitHub.
The malware used an open sourced virtualization shared object library (.so) named "VirtulApp" and also an open source software development kit called "TalkingData"
Both code sources were found on GitHub.
The malware in question hides its icon from the users screen but can be found under Settings/Apps but shows an icon for a well-known "Antivirus/Cleaner" app that has been removed from the Google Play store many times. The malware also shares much of the cleaner app's SDK's and excessive permissions.
The malicious app also contains several encrypted files in its assests directory that are decrypted into executable java .jar files to expand it's functionality.
Kaspersky Labs names this particular malware variant "Necro"
5a5ab39960d3b96be2b8bbea99477e6f
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#17The cultural significance of the name is pretty ironic: https://en.wikipedia.org/wiki/Nazar_(amulet)
Researchers usually pick a name when they have started looking at a collection of samples, and don't really have knowledge of what is going on or who the threat actor is yet. The authors call it خضر, a guardian angel type from the Quran that shares secret knowledge.
It is also the Arabic for the adjective green (plural) and the name comes from Arabic as well, and a prophet some i even heard some suggest is Buddha, in addition to other more obvious Wikipedia suggestions.
That aside, this is what drives me nuts about threat Intel: we use enough googlable Persian words and give enough hints we know Persian in our code and opsec and people have a full dossier that confirms we're Iranians? I assume there is more depth to their claims but you have to work for the reporting company to know it which makes the whole subset of the industry dubious if you ask me (but we know no one is, lol).
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#18I believe the use of open source tools to accomplish their tasks is interesting. Using "living off the land" open source tools also hinders researchers when trying to attribute an attack to a certain country. I found malware that was installed remotely on to millions of Android users under the government "Life Line" program that also used readily available open-source code found on GitHub. The malware used an open so…
> I believe the use of open source tools to accomplish their tasks is interesting. Using "living off the land" open source tools also hinders researchers when trying to attribute an attack to a certain country.
That is one conclusion. But, given that there seems to be a significant amount of code that's custom (the filesystem module), I'm not sure what that would accomplish. If that too was opensource and there was a tiny amount of glue code, then it would make some sense. Leave the most suspicious hooks(like all input device monitoring) to well known tools.
Based on the report, it is more likely that whoever group created it didn't have much knowledge. Using the Shutdown Alarm and pissing all over the system just to accomplish such a tiny task is difficult to justify, and that's what drew undue attention.
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#19So if I want the USA out of my system, all I have to do is create some dummy exes, dlls and regkeys on my system?
I wonder what kind of system you can create without having any specific country dependency at all. Certainly the breakdown in influence for say your standard PC will be hard to avoid any USA input, no matter the OS due to code submissions/contributions and then that's presuming honest location actors. Let alone binary blobs for drivers. So hardware and OS, you will be pushed to avoid any USA influence. After all USB,…
It's all about the hardware now, building out your own components isn't going to be easy, get a microprocessor that was build pre-1998 or try an open source hardware solution but who wants to do that..
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#20Earlier quoted context omitted.
Researchers usually pick a name when they have started looking at a collection of samples, and don't really have knowledge of what is going on or who the threat actor is yet. The authors call it خضر, a guardian angel type from the Quran that shares secret knowledge.
It is also the Arabic for the adjective green (plural) and the name comes from Arabic as well, and a prophet some i even heard some suggest is Buddha, in addition to other more obvious Wikipedia suggestions. That aside, this is what drives me nuts about threat Intel: we use enough googlable Persian words and give enough hints we know Persian in our code and opsec and people have a full dossier that confirms we're Ira…
I think you're thinking of khidr(?)