,
23 tweets,
12 min read
Read on Twitter
In the Equation Group dump is a module known as "m12000000", or TADAQUEOUS, which does not have a Listening Post (LP) attached to it.
"It can only be loaded and unloaded through this interface, not controlled, and it will spit an error message."
laanwj.github.io/2016/09/01/tad…
"It can only be loaded and unloaded through this interface, not controlled, and it will spit an error message."
laanwj.github.io/2016/09/01/tad…
What apparently TADAQUEOUS does is cripple or disable IPsec, or Internet Protocol Security.
"Most of the symbols are not standard Linux symbols but specific to the TOS/Fortinet implementation."
laanwj.github.io/2016/09/01/tad…
"Most of the symbols are not standard Linux symbols but specific to the TOS/Fortinet implementation."
laanwj.github.io/2016/09/01/tad…
"I read this to mean that the hardware or software of the system running IPsec was compromised, causing it to send valid protocol ESP packets, but creating those in such a way that these could be decrypted without knowing the ESP session keys (from IKE)".
laanwj.github.io/2016/09/01/tad…
laanwj.github.io/2016/09/01/tad…
For background on why TADAQUEOUS may be important, see the thread I did on The Shadow Brokers yesterday:
On February 16, 2015, Kaspersky Lab published "Equation Group: The Crown Creator of Cyber-Espionage" on their website, where they described the Equation Group as a "threat actor".
kaspersky.com/about/press-re…
kaspersky.com/about/press-re…
As a side reference, Ruslan Stoyanov of the Kaspersky Lab, the head of computer incident response investigations, was later arrested back in January 2017.
Shortly after Kaspersky Lab outed the Equation Group as existing, the Central Intelligence Agency discussed this on an online forum.
wikileaks.org/ciav7p1/cms/pa…
wikileaks.org/ciav7p1/cms/pa…
Now one of the files exfiltrated from The Equation Group, eqgrp-free-file[dot]tar[dot]xz was released by the Shadow Brokers. In it, there is a text file titled "listing".
github.com/nneonneo/eqgrp…
github.com/nneonneo/eqgrp…
In this text document is a series of file locations and calendar dates, where something has happened. Look, I'm good with computers but I'm no programmer, so I don't actually know what the rest of this stuff is. However...
github.com/nneonneo/eqgrp…
github.com/nneonneo/eqgrp…
By searching for "m12000000", it reveals the existence of TADAQUEOUS, of which there are 20 instances. They each have specific dates assigned to them.
github.com/nneonneo/eqgrp…
github.com/nneonneo/eqgrp…
What follows is theory, conjecture, et cetera.
In the sense that the events on the dates absolutely did happen, but whether TADAQUEOUS's dates have anything to do with it is the conjecture / theory part.
In the sense that the events on the dates absolutely did happen, but whether TADAQUEOUS's dates have anything to do with it is the conjecture / theory part.
April 9, 2010.
This was the day after the United States and Russia signed the New Strategic Arms Reduction Treaty (START) in Prague.
geneva.usmission.gov/2010/04/08/sec…
This was the day after the United States and Russia signed the New Strategic Arms Reduction Treaty (START) in Prague.
geneva.usmission.gov/2010/04/08/sec…
August 2, 2011.
On August 1, Clinton swore in Gary Locke as Ambassador to China.
On August 2, Clinton met with Syrian opposition activists.
2009-2017.state.gov/secretary/2009…
prnewswire.com/news-releases/…
On August 1, Clinton swore in Gary Locke as Ambassador to China.
On August 2, Clinton met with Syrian opposition activists.
2009-2017.state.gov/secretary/2009…
prnewswire.com/news-releases/…
As noted, it affects Fortinet.
"In order to ensure her e-mails were private, Clinton's system appeared to use a commercial encryption product from Fortinet."
bloomberg.com/news/articles/…
bloomberg.com/news/articles/…
Fortinet is also listed as a hardware partner of Platte River Networks.
platteriver.com/about/partners/
platteriver.com/about/partners/
It was back in June 2013 when Hillary Clinton transferred her server.
On June 23, 2013 the Pagliano Server at the Chappaqua residence was shut down and then transported to Secaucus, NJ, where it was ran by Equinix. It stayed there until October 3, 2015.
static01.nyt.com/packages/pdf/p…
On June 23, 2013 the Pagliano Server at the Chappaqua residence was shut down and then transported to Secaucus, NJ, where it was ran by Equinix. It stayed there until October 3, 2015.
static01.nyt.com/packages/pdf/p…
Also of reference is that Edward Snowden had already fled the United States to Hong Kong on May 20, 2013.
That's it, that's the end of the thread for now.
