{PDF} Bvp47 Top-tier Backdoor of US NSA Equation Group: Technical Details

In a certain month of 2013, during an in-depth forensic investigation of a host in a key domestic depart- ment, researchers from the Pangu Lab extracted a set of advanced backdoors on the Linux platform, which used advanced covert channel behavior based on TCP SYN packets, code obfuscation, system hiding, and self-destruction design. In case of failure to fully decrypt, It is further found that this backdoor needs the check code bound to the host to run normally. Then the researchers cracked the check code and suc- cessfully ran the backdoor. Judging from some behavioral functions, this is a top-tier APT backdoor, but further investigation requires the attacker’s asymmetric encrypted private key to activate the remote con- trol function. Based on the most common string “Bvp” in the sample and the numerical value 0x47 used in the encryption algorithm, the team named the corresponding malicious code “Bvp47″ at the time.
In 2016 and 2017, ?The Shadow Brokers? published two batches of hacking files claimed to be used by ?The Equation Group?. In these hacking files, researchers form Pangu Lab found the private key that can be used to remotely trigger the backdoor Bvp47. Therefor, It can be concluded that Bvp47 is a hacker tool belonging to ” The Equation Group”.
Through further research, the researchers found that the multiple procedures and attack operation manu- als disclosed by “The Shadow Broker” are completely consistent with the only identifier used in the NSA network attack platform operation manual [References 3 and 4] exposed by CIA analyst Snowden in the “Prism” incident in 2013.