[deleted]
Nazar: Analyzing malware that was uncovered in leaked NSA files
21–30 of 34 posts
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#22Earlier quoted context omitted.
It used to be standard operating practice as an attacker to close the holes through which you yourself gained access to prevent others from taking your prize. Ironically the most secure and cheapest thing a company could do was get compromised by a competent attacker who only wanted to launder small amounts of data or CPU cycles through your network, and in exchange keeps your servers all patched and up to date for y…
So be an e-aphid and let the kindly e-ants farm you?
e-symbiosis! e-harmony!
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#23Earlier quoted context omitted.
W-what if you use Linux? :B
use Wine.
I'm sure the Linux kernel would never be compromised by state actors, even if a retired US Army general was on the board of directors[1] of the most popular Linux distro, or that the US' most infosec oriented intel agency didn't come up with the main method for RBAC with it[2]. Or that hardware and the numerous bits of firmware that control it would ever get back-doored by any state actor!
"OpenBSD co-founder Theo de Raadt, cited as a top el8 target, angrily refused to discuss the compromise in late July of a file server maintained by the open-source, Unix-based operating-system project. On Aug. 1, a dangerous Trojan horse program was discovered amid the code for OpenBSD, which is used by thousands of organizations and renowned for its security.
While de Raadt wouldn't comment on whether there were any suspects in the case, the lead article in the latest el8 newsletter, published in early July, contains an obvious smoking gun. The article begins with several lines of screen-display from what appears to be an OpenBSD.org system. The "w-command" output suggests that attackers had access to one of de Raadt's accounts."[3]
[1]https://www.redhat.com/en/about/press-releases/shelton
[2]https://www.nsa.gov/what-we-do/research/selinux/documentatio...
[3]https://www.cc.gatech.edu/computing/acmnews/msg00221.html
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#24> Territorial Dispute
def path_normalize(path):
try:
path = re.sub('%(.+)%', (lambda m: ('%{0}%'.format(m.group(1)) if (m.group(1) not in datastore.ENV_VARS) else datastore.ENV_VARS[m.group(1)])), path)
except:
tedilog.error(...)
return path
return re.sub(r'%(.+)%', lambda m: datastore.ENV_VARS.get(m.group(1), m.group(0)), path)Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#25Earlier quoted context omitted.
Researchers usually pick a name when they have started looking at a collection of samples, and don't really have knowledge of what is going on or who the threat actor is yet. The authors call it خضر, a guardian angel type from the Quran that shares secret knowledge.
It is also the Arabic for the adjective green (plural) and the name comes from Arabic as well, and a prophet some i even heard some suggest is Buddha, in addition to other more obvious Wikipedia suggestions. That aside, this is what drives me nuts about threat Intel: we use enough googlable Persian words and give enough hints we know Persian in our code and opsec and people have a full dossier that confirms we're Ira…
Did you forget the whole "there was some Russian in the metadata so it must have come from Russia" conclusion of CrowdStrike?
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#26Earlier quoted context omitted.
Researchers usually pick a name when they have started looking at a collection of samples, and don't really have knowledge of what is going on or who the threat actor is yet. The authors call it خضر, a guardian angel type from the Quran that shares secret knowledge.
It is also the Arabic for the adjective green (plural) and the name comes from Arabic as well, and a prophet some i even heard some suggest is Buddha, in addition to other more obvious Wikipedia suggestions. That aside, this is what drives me nuts about threat Intel: we use enough googlable Persian words and give enough hints we know Persian in our code and opsec and people have a full dossier that confirms we're Ira…
you forgot the most common meaning : vegetables :) you know hackers can be silly sometimes
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#27> Territorial Dispute def path_normalize(path): try: path = re.sub('%(.+)%', (lambda m: ('%{0}%'.format(m.group(1)) if (m.group(1) not in datastore.ENV_VARS) else datastore.ENV_VARS[m.group(1)])), path) except: tedilog.error(...) return path What a terrible way to write return re.sub(r'%(.+)%', lambda m: datastore.ENV_VARS.get(m.group(1), m.group(0)), path)
[deleted]
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#28Earlier quoted context omitted.
It is also the Arabic for the adjective green (plural) and the name comes from Arabic as well, and a prophet some i even heard some suggest is Buddha, in addition to other more obvious Wikipedia suggestions. That aside, this is what drives me nuts about threat Intel: we use enough googlable Persian words and give enough hints we know Persian in our code and opsec and people have a full dossier that confirms we're Ira…
you forgot the most common meaning : vegetables :) you know hackers can be silly sometimes
That explains why it's being used for the root directory.
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#29> Territorial Dispute def path_normalize(path): try: path = re.sub('%(.+)%', (lambda m: ('%{0}%'.format(m.group(1)) if (m.group(1) not in datastore.ENV_VARS) else datastore.ENV_VARS[m.group(1)])), path) except: tedilog.error(...) return path What a terrible way to write return re.sub(r'%(.+)%', lambda m: datastore.ENV_VARS.get(m.group(1), m.group(0)), path)
Does yours catch the exception?
Re: Nazar: Analyzing malware that was uncovered in leaked NSA files
#30> Territorial Dispute def path_normalize(path): try: path = re.sub('%(.+)%', (lambda m: ('%{0}%'.format(m.group(1)) if (m.group(1) not in datastore.ENV_VARS) else datastore.ENV_VARS[m.group(1)])), path) except: tedilog.error(...) return path What a terrible way to write return re.sub(r'%(.+)%', lambda m: datastore.ENV_VARS.get(m.group(1), m.group(0)), path)
Does yours catch the exception?
Apparently I didn’t include the parts that don’t need to be changed. (Actually, with the correct input type, this piece of code shouldn’t raise any exception period other than BaseExcept like KeyboardInterrupt, which usually shouldn’t be caught like this either. So I would omit the try...except myself.)