This Linux Backdoor Went (Almost) Undetected for 10 Years
upstart writes:
This Linux backdoor went undetected for 10 years:
Bvp47 - a Top-tier Backdoor of US NSA Equation GroupNew details have emerged regarding a previously undetected Linux backdoor that is believed to have been created by the notorious Equation Group which has ties to the US National Security Agency (NSA).
According to a new report from the cybersecurity firm Pangu, security researchers from its Advanced Cyber Security Research team first found the malware behind the backdoor back in 2013 while conducting a "forensic investigation of a host in a key domestic department". At that time, the team decided to name the malware Bvp47 due to the fact that the most common string in the sample was "Bvp" and 0x47 was the numerical value used in its encryption algorithm.
[...] Now that Bvp47's Linux backdoor has finally come to light, security researchers will likely conduct further analysis on it and we could see more evidence that it was used in other past attacks as well.
An Anonymous Coward writes:
In a certain month of 2013, during an in-depth forensic investigation of a host in a key domestic department, researchers from the Pangu Lab extracted a set of advanced backdoors on the Linux platform, which used advanced covert channel behavior based on TCP SYN packets, code obfuscation, system hiding, and self-destruction design. In case of failure to fully decrypt, It is further found that this backdoor needs the check code bound to the host to run normally. Then the researchers cracked the check code and successfully ran the backdoor. Judging from some behavioral functions, this is a top-tier APT backdoor, but further investigation requires the attacker's asymmetric encrypted private key to activate the remote control function. Based on the most common string "Bvp" in the sample and the numerical value 0x47 used in the encryption algorithm, the team named the corresponding malicious code "Bvp47" at the time.
In 2016 and 2017, "The Shadow Brokers" published two batches of hacking files claimed to be used by "The Equation Group". In these hacking files, researchers form Pangu Lab found the private key that can be used to remotely trigger the backdoor Bvp47. Therefor, It can be concluded that Bvp47 is a hacker tool belonging to "The Equation Group".
Through further research, the researchers found that the multiple procedures and attack operation manuals disclosed by "The Shadow Broker" are completely consistent with the only identifier used in the NSA network attack platform operation manual [References 3 and 4] exposed by CIA analyst Snowden in the "Prism" incident in 2013.
Original Submission #1 Original Submission #2
Read more of this story at SoylentNews.