Hacker News Reader

Comment by jgrahamc | Hacker News Reader

There are also additional clues pointing to Regin being a Five Eyes tool: In the QWERTY code, there are numerous references to cricket, a sport that enjoys extreme popularity in the Commonwealth.

Given the relative popularity of cricket in the US vs. the rest of the world, it's more likely that this was written outside the NSA.

View on HN

I know GCHQ contractors (BAE Detica, funded as a part of the "Mastering The Internet" tender) had a hand in at least some of it; it's not unreasonable to guess it might've been that module, as that does link it? (Although of course, that's just a guess, and doesn't really tell us anything particularly new or useful.)

Not that I think nation-state malware is, you know, strictly cricket. (Quite the opposite, I've always said it was an irresponsible and reckless path, all the way back to the 1998 era.)

Update: It seems Australia's DSD was likely a better guess in this particular instance - more to come from the authors soon. (Which leaves that Detica module currently unaccounted for. I don't know what that could be yet.) Of course, they're all Five Eyes, and at least US and UK have both used it, so I wouldn't be too surprised to see CAN/AUS/NZ too.

Leaves us back with the "How do we fix this?" problem. And "how do we find what replaced STRAITBIZARRE"?

In the PDF (who's ever shipped binary as text in a pdf btw?) [1] they argue that it might be related to Australia; who knows...

[1] http://www.spiegel.de/media/media-35668.pdf

Also "source code"...

This is clearly not source code.

I am baffled by the people who decided to disagree with you here. Calling this source code is incredibly dishonest. It's the equivalent of saying "we've published the source code of photoshop" when you've base64-encoded photoshop.exe.

I would love to see the actual source code of regin. What they've actually published is useless to me.

It's probably just reverse engineers being snobs.

Or journalists being journalists.

Or both.

"This is clearly not source code."

that's assembler

By saying they've released "source code" they're claiming to have somehow got hold of extra information (i.e. done some old-fashioned journalism and got hold of C code or whatever, containing comments and symbols and human information about intent). In fact they've just downloaded a publicly available binary and disassembled it.

I'd argue that it's source code at the lowest possible level...

And I'd argue that it is a disassembly of a binary compiled from source code.

Source code has the word "source" in it. Unless the original human wrote it directly in assembly without comments or macros (from his padded cell at the asylum, naturally), it is obviously not source code.

"Source code" is generally code you can put into a compiler and get out object code. The term "source" refers to the fact that it is used as input. This is why, for example, the GPL specifies that you must release the original source code in the preferred format for editing — so that people wouldn't release source code generated by disassembly or a source-to-source transformer.

I suppose it all depends on how you define "source code". For me, source code implies that it was authored by a human or automatically generated to mimic human authorship. Any automated translation step that does not result in executable "object code" or "machine language" is "intermediate code".

It may be usable in the same way as source code, but since it was produced as the output of a program that had an input closer to the source, it cannot be the source.

I imagine the compilation process like a stream. The source is the origin of the flow. All changes made there propagate downstream. Some streams are short, like those with M4-processed assembly. Others are longer, with MSIL or JVM intermediate code. Linked libraries are like tributaries; they have their own sources. The end product is a single river, which fans out into a delta for each supported processor architecture as it nears the sea of end users.

I know you are wrong. logfromblammo explains it well.

But let's hear your arguments, I'm curious.

I don't think it's the sport. I think it's cricket = bug = spy tool.

It is the sport. The references they are referring to in the article include things like LEGSPIN.

A spy tool that chirps every few seconds to announce its presence? There are better insects to reference.

maybe because it jumps as malware usually does

Just as likely to be a tounge in cheek play on the stereotypically British line for something unfair:

"It's just not cricket"

How smart would you have to be to insert references to different cultural aspects other than your own to make it look as if it's from another entity? I think it would take at least the smartness of two average people..

Or they had an Indian programmer in their team.

Or India was the first target.

I think disinformation is one of the pillars in their line of work. For all we care, they could have written references to whatever is popular in North Korea.

Given that a NSA dev team was well aware that the spyware would be discovered and disassembled at some point in time, it was reasonable to intentionally leave behind evidence that points to countries other than the US. I'm not saying that's what happened, but I'd not take the cricket references too serious either.

Using that logic, what would constitute evidence? That's like the senator in favor of the Japanese interment camps saying that the fact that no Japanese Americans had committed a crime was just even more evidence they were planning something.

Edit: More clearly written than my comment: http://lesswrong.com/lw/ih/absence_of_evidence_is_evidence_o...

But basically, people have already come to a conclusion. If the comments said "go <Virginia sports team>", that'd be considered evidence of made in the USA. And if the comments say " go English sports team " then that's evidence of have in the USA, because obviously comments are misleading.

Why not go recursive? They wrote about cricket because they wanted to frame the Americans, who always write misleading comments to frame the Brits.

So I can clearly not choose the drink that is in front of you!

That's what I get for fighting a land war in Asia.

They both did it yo

Reply on news.ycombinator.com