NSA tools release to Dark Web Date 2014 (likely earlier imho)

Kaspersky tools removal update. But keep reading – it gets better:


Now for the punchline – They’ve documented that Kaspersky, a Russian company close to Putin, was hacked by Israel. Kaspersky security researchers have confirmed the NSA hacking tools existence when they discovered it in the spring of 2014. The article;


In a statement, the company (Kaspersky) said it stumbled on the (NSA) code a year earlier than the recent newspaper reports had it (ed: Comey stated summer 2015), in 2014. It said logs showed that the consumer version of Kaspersky’s popular product had been analyzing questionable software from a U.S. computer and found a zip file that was flagged as malicious.

And it further states, again from the article:

Kaspersky’s Equation Group report was one of its most celebrated findings, since it indicated that the group could infect firmware on most computers. That gave the NSA almost undetectable presence.

Kaspersky later responded via email to a question by Reuters to confirm that the company had first discovered the so-called Equation Group programs in the spring of 2014.

So a Russian antivirus software found a zip file with NSA hacking tools in 2014. Hacking tools that target Microsoft and other business software, again, in the Spring of 2014. Confirmed by Israeli Security researchers who hacked Kaspersky.

Now, what they found was a compressed, portable, easily emailed or traded via email even as nobody else had the signatures to detect. A zip file.

A zip file.

For those unfamiliar with the industry, by the time an exploit is being traded in a 7 z it’s long been in the wild. That is the commodity phase of the economic curve.

The economics of the dark web have been researched and are well documented (hint: look at DEFCON and Blackhat presos from a few years back.)

If you are a reporter or security researcher – keep digging. Basic economics say it had to have been being traded early 2013 for high bids with a quick pricing decline as is typical with shrink wrap software.

It remained unpatched. Every company using common business software was, and probably still is, an open book. A trivial metasploit script and your movies, your directional drilling tech, your seismic data, patents, medical history, your porn habit, email, fb, you name it, was and probably still is wide open.

Bottom line: My opinin is the timeline of the NSA hacking tools being released is 2013. If not earlier. (But I’ll stick with my mid-2013 estimated release to the wildebeasts estimate.) NSA let them into the wild as discovered by Russians (current media puts this at 2014) who were then hacked by our allies Israel. Israel then reported this to the US.

And we did nothing. Think about it.

Just add that up and you get Russia hacking US companies and associations using our own tools paid for by YOU. NSA hacking tools discovered and reported to the US by our allies in Israel. 2014 or earlier.

What did NOT happen was responsible reporting to vendors like Microsoft who only patched it when the Shadow Brokers released it on github in 2017.  Thus from 2014 (or earlier), our allies, our foes, and our own security agencies did nothing to protect US intellectual property, infrastructure, companies, jobs, and people.

Noodle that one.

…. this story will continue to unfold. And if you are an investigative journalist, maybe ask around the community politely regarding who’s zoo had the code and when.

Update;  http://www.theregister.co.uk/2017/10/25/kaspersky_nsa_keygen_backdoor_office/

Triangulate Shooter Location with Mobile App – Possible?

Text exchange with a friend about how to defend crowds from threats like the shooter in Las Vegas.

[redacted section]

Yup, saving the world, or trying to, one bear at a time.

Triangulating on a sound with data from thousands of willing opt-in smart phones is possible. Pitch, yaw, acceleration, relative volume compared to those in proximity to normalize. Calculate position from last known good if towers go out.

Mesh grid relative to each other if no service. Share UDP 5353 and change multicast DNS into a “people finder”.

The app, when turned on, would send a cascade of data flowing in with lots of noise. The analysis is the same thing anyone who has done log analysis with an ELK stack is familiar with. Have a buffer of say 10 seconds backwards until triggered.

With a few datasets from simulations (like having 30 people in a room and see if the app can figure out who blew the dog whistle.

Sensor based smart phone triangulation is one way we could defend ourselves in an attack on any soft target.

Note: the concept is somewhat related to what we are building at somarobotics.com. However I’m putting it out there because I’d love to see someone build a system to automatically respond and help.

tragedy in las vegas – a city that changed my life years ago

Nothing can explain away the tragedy that happened last night in Las Vegas. A terrorist act by a cowardly American white male terrorist. And nothing SHOULD explain it away. It’s inexcusable in every way.

A wise person recently told me that “POTUS is not the problem. He is a symptom of the problem.” I believe they make a valid point that we have major issues that have been building for years. And we need to STOP IT.

Now is a time to support the families.

But very shortly, we need to have some serious dialog …. and the burden of finding the right balance of legislation falls 100% on the gun lobby itself.

On a positive note, this is how I think of Las Vegas. Still.

Lake Las Vegas

PS: There are no links in this post because there are much smarter people than me working together with the victims right now and I have no desire to distract.