raincious
2015-02-17 22:34:22 +08:00
全部报告已经看完。
绝对是重磅新闻啊。这工具链太强了，可以在大部分环境下实现攻击，哪怕是一台物理隔绝的计算机，也能够通过任何受感染的U盘进行指令控制。而且杀毒软件根本无法检查，我个人猜想甚至它们有能力控制杀毒软件本身。
要注意最后一代已经在硬盘Firmware中重新编程之后，已经完全有能力接管系统的启动了。虽然报告上主要分析的是Windows，但同时也说有证据证明OSX也能够被入侵，甚至iPhone也不安全。
一旦Windows从启动开始就被接管打上了Path，那接下来要做什么只取决于入侵者的意图了。
顿时觉得计算机系统很不安全有没有。
要点：
> DoubleFantasy (the internal Kaspersky Lab name) for the validation of their victims.
> EquationDrug’s core modules, designed for hooking deep into the OS, do not
contain a trusted digital signature and cannot be run directly on modern operating
systems.
>GRAYFISH is the most modern and sophisticated malware implant from
the Equation group. It is designed to provide an effective (almost “invisible”)
persistence mechanism, hidden storage and malicious command execution
inside the Windows operating system.
> GrayFish was developed between 2008 and 2013 and is
compatible with all modern versions of Microsoft’s operating systems,
> Fanny is a computer worm created by the Equation group in 2008 and distributed
throughout the Middle East and Asia. Fanny used
two zero-day exploits, which were later uncovered during the discovery of Stuxnet.
> The GRAYFISH bootkit starts from the VBR, loads the operating
system and hijacks the loading of the first driver in the kernel. Next, it loads all
the other malware stages from the registry, making it almost completely invisible
in terms of footprint.
> Finally, in terms of advanced features, GRAYFISH and EQUATIONDRUG include
perhaps the most sophisticated persistence mechanism we’ve ever seen: re-flashing
the HDD firmware. Due to the complexity of this process and the knowledge and
resources required to implement something like it, the mechanism appears to be out
of the reach of most advanced threat groups in the world except the EQUATION group.