Hacker News Reader

Comment by rodionos | Hacker News Reader

> The Drovorub-server uses a MySQL database to manage the connecting Drovorub-client(s) and Drovorub-agent(s).

This assumes the NSA was able to infiltrate the Drovorub C2 server, I guess.

They have the server software. There's a couple ways they could get it. 1.) They could have hacked the C2 server or a development network, like you are talking about. 2.) The server could be forward deployed to a cloud provider or other infrastructure and law enforcement served a subpoena for a copy of the cloud server. The second seems just as likely as the first.

Or they could have just bought a copy from a compromised developer. Real world spying happens a lot too.

Yeah, there's a lot of other ways they could have gotten it.

Not necessarily. You could probably infer it from a MySQL client in the malware itself and the queries its making to tables and such.

They know specific commands and configurations for the "drobovur-server" which is the "Command and Control (C2) Server." This makes me think they have the actual server software and probably some sort of operational deployment.

That sounds reaaally unlikely. If the malware shipped a mysql client the NSA would definitely be able to pop the mysql server it connects to.

the point wasnt whether or not they could or did. the point was that it could be inferred based on what sql client the malware client was using without ever touching the sever.

It is extraordinarily unlikely that the malware would ship with a mysql client or talk mysql with the C2

If it does, that's an easy claim to prove.

Read the document. They have the server software. They have configuration files for the server, they know how it processes communication, they know how it generates UUID's. They have the server software.

Why RTFA when I can make baseless speculations? :D

This is the NSA doc: https://www.nsa.gov/Portals/70/documents/resources/cybersecu...

link is broken now.

https://web.archive.org/web/20200821171042/https://www.nsa.g...

Reply on news.ycombinator.com