Mysterious Group Hacks The
NSA
15
August, 2016
How
much you pay for enemies cyber weapons? Not malware you find in
networks. Both sides, RAT + LP, full state sponsor tool set? We find
cyber weapons made by creators of stuxnet, duqu, flame. Kaspersky
calls Equation Group. We follow Equation Group traffic. We find
Equation Group source range. We hack Equation Group. We find many
many Equation Group cyber weapons. You see pictures. We give you some
Equation Group files free, you see. This is good proof no? You
enjoy!!! You break many things. You find many intrusions. You write
many words. But not all, we are auction the best files.
In
February 2015, Ars Technical dubbed The Equation Group "the most
advanced hacking operation ever uncovered." According to
Kasperky, the "Equation Group" is a threat actor that
surpasses anything known in terms of complexity and sophistication of
techniques, and that has been active for almost two decades."
While Kaspersky Lab stopped short of saying it’s the NSA, its
researchers laid out extensive evidence pointing to the American spy
agency, including a long series of codenames used by the Equation
Group and found in top secret NSA documentsreleased by Edward
Snowden. The Equation Group, according to Kaspersky Lab, targeted the
same victims as the group behind Stuxnet, which is widely believed to
have been a joint US-Israeli operation targeting Iran’s nuclear
program, and also used two of the same zero-day exploits.
The
global "victims" of the Equation Group are laid out in the
map below: it is no
secret that the group is not particularly
enthused by either Iran or Russia.
The
latest hack revealed over the weekend has nothing to do with the
Democratic Party or George Soros, and instead a mysterious hacker
group by the name “The Shadow Brokers” claims to have hacked the
Equation Group - a government cyberattack hacking group associated
with the NSA, and released a bunch of the organization's hacking
tools. The hackers are also asking for 1 million bitcoin (around $568
million) in an auction to release more files.
“Attention
government sponsors of cyber warfare and those who profit from
it!!!!” the hackers wrote in a manifesto posted on Pastebin, on
GitHub, and on a dedicated Tumblr.
It
is this secretive hacker collective that the "Shadow Brokers"
claimed to have hacked, and allegely stole some of its hacking tools.
They publicized the dump on Saturday, tweeting a link to the
manifesto to a series of media companies.
According
to Motherboard, the dumped files mostly contain installation scripts,
configurations for command and control servers, and exploits targeted
to specific routers and firewalls. The names of some of the tools
correspond with names used in Snowden documents, such as “BANANAGLEE”
or “EPICBANANA.” The hackers have released 60% of the files they
claimed to have taken from the Equation Group. The Shadow Brokers
said they would release the remaining data to the highest bidder in a
Bitcoin auction (they’ve received three bids so far). If they
received an extraordinary 1,000,000 Bitcoins, worth roughly $560
million, they would release all the files.
A
review of the files revealed what appear to be vulnerabilities and
exploits for some widely-used firewalls — network security
technologies that aim to block digital snoops from entering. Suiche
posted a handy rundown of the products affected. He said at the very
least the exploits for the Cisco products included “real code”
designed specifically to take control of the firewalls. “It’s not
automatically generated or something like that.”
Alongside
those alleged exploits were implants — malware that is covertly
dropped on the network once the firewall and other security
mechanisms have been bypassed. There were also some scripts and basic
instructions for the malware’s usage.
While
it was initially unclear if the data is legitimate, some security
experts agree that it likely is.
“The
code in the dump seems legitimate, especially the Cisco exploits …
and those exploits were not public before,” said Matt Suiche,
founder of UAE based cybersecurity start-up Comae Technologies. “The
content seems legit.”
“If
this is a hoax, the perpetrators put a huge amount of effort in,”
the security researcher known as The Grugq told Motherboard. “The
proof files look pretty legit, and they are exactly the sorts of
exploits you would expect a group that targets communications
infrastructure to deploy and use.” Claudio Guarnieri, an
independent security researcher who’s investigated other hacking
operations by the Western intelligence agencies, said that the files
might be from a hacked NSA server used in an operation. He also
cautioned that this is a preliminary analysis and that more analysis
is needed.
The
most recent file is dated June 2013, though the hackers could have
tampered with the dates. Dmitri Alperovitch, the co-founder of
security firm CrowdStrike, theorized that “the leakers were
probably sitting on this information for years, waiting for the most
opportune time to release.” CrowdStrike is best known for
immediately 'concluding' that all recent hacks of Democratic-linked
servers have been under the guidance of the Kremlin.
A
Kaspersky Lab researcher declined to comment. Another Kaspersky Lab
researcher noted on Twitter that there is “nothing” in the dumped
files that links them to the Equation Group, but some of their names
are from the ANT Catalog, an NSA hacking toolset published by Der
Spiegel in late 2013. It’s worth noting that while the files dumped
by The Shadow Brokers might not have a direct connection with the
Equation Group, they could come from a different operation that those
seen by Kaspersky Lab.
The
Shadow Broker claimed to have gotten the files by following Equation
Group “traffic,” hacking the group and finding its “cyber
weapons.” (The hackers did not respond to a request for comment,
and neither did the NSA.)
As
Motherboard concludes, while the motives behind this dump are
unclear, if legitimate, this could be one of the most shocking hacks
ever.
As
of Monday afternoon, the Bitcoin wallet where the hackers accept
auction offers has received three offers so far; it has a long way to
go to reach 1 million. If this hack is confirmed to be indeed of an
NSA-related organization, we assume much more leaks will follow, even
if the payment will ultimately take place behind the scenes.
As
for the origins of the new "mysterious" hacker group,
speculation is already rife that Russians are (again) behind it.
However, as Forbes notes, whatever the alleged hack’s origins, the
NSA does have something to worry about: Someone is out to embarrass
the agency and might have the tools to do just that at a particularly
heated time in US politics. The agency should, of course, have a
response plan. Snowden managed what the Shadow Brokers are shooting
for on a far greater scale.
Group claims to hack NSA-tied hackers, posts exploits as proof
Extraordinary
claim gets attention of security experts everywhere
Hacking group offers ‘stolen NSA cyber-weapons’ in bitcoin auction
© Benoit
Tessier / Reuters
RT,
15 August, 2016
A
hacking collective calling itself ‘Shadow Brokers’ claims to have
hacked an NSA affiliate and obtained a set of US government spying
and surveillance tools – which it is now willing to auction off for
at least half a billion dollars in Bitcoin.
Over
the weekend the so-called Shadow Brokers collective
released “samples” of
the files the group said belonged to the Equation Group, which is
believed to be a National Security Agency's (NSA) affiliate.
The
Equation Group, a collection of hackers, has previously been accused
by the Kaspersky Lab of using techniques and tools very similar to
those of the NSA. In 2015 Kaspersky Lab called the group “a
threat actor that surpasses anything known in terms of complexity and
sophistication of techniques, and that has been active for almost two
decades.”
While
the authenticity of the files that were released on August 13 on
Github is yet to be confirmed, the Shadow Brokers promised to release
the “best
files” to
the top bidder in a Bitcoin auction. The collective seeks to raise
1,000,000 bitcoins, worth roughly $560 million.
“We
follow Equation Group traffic. We find Equation Group source range.
We hack Equation Group. We find many many Equation Group cyber
weapons,” the
hacker collective wrote in a post on Tumblr that has since been taken
down. “We
give you some Equation Group files free, you see. This is good proof
no? You enjoy!!! You break many things. You find many intrusions. You
write many words. But not all, we are auction the best files.”
The
files released for free over the weekend, to which Github has since
disabled access, appear to be from late 2013, after the famous Edward
Snowden revelations. The first set included a number of tools, which
according to various experts are might indeed be capable of hacking
network gear such as routers and firewalls made by Cisco, Juniper,
and Fortinet.
After
Github moved to censor the released source codes, WikiLeaks announced
that it “had
already obtained the archive of NSA cyber weapons released earlier
today and will release our own pristine copy in due course.”
The
latest cyber threat to US national secrets comes in the footsteps of
a series of disclosures of emails and documents belonging to the
Democratic Party. While cybersecurity experts and the Democrats have
accused Russia of hacking into the Democratic National Committee, a
hacker calling himself Guccifer 2.0 has surfaced to claim
responsibility for the recent hacks that shook the US political
elite.
While
the NSA is yet to comment on the latest leak, experts agree dthat the
new set of files should be taken seriously.
“It’s
at minimum very interesting; at maximum, hugely damaging,” CEO
of the security firm Immunity Dave Aitel and a former NSA research
scientist told FP . “It’ll
blow some operations if those haven’t already been blown.”
“I
think it’s hard to say at this stage whether the files are genuine,
but they are an elaborate hoax if not, by someone who has spent a lot
of time going through Snowden documents to sprinkle codenames into
the files,” a
security researcher, calling himself Pwn All The Things told Business
Insider.
Dmitri
Alperovitch, CTO of security firm CrowdStrike in a series of tweets,
said that the latest leak will further jeopardize the US elections.
“No
doubt that further leaks will continue and contribute to the chaos of
this already way too weird election. I think there is plenty of
reasons to be concerned that the election itself would be
manipulated,” Alperovitch
tweeted. “The
claim from a credible hacking source of such manipulation could be
enough to cast shadow on the legitimacy of elected president.”
"The
data appears to be relatively old; some of the programs have already
been known for years," and
are unlikely "to
cause any significant operational damage," researcher
Claudio Guarnieri told Reuters. Meanwhile, Matt Suiche, founder
of UAE-based security startup Comae Technologies, concluded the
tools looked like they "could
be used."
Who
Hacked Hillary? Ex-NSA Official Analyzes Email Leaks
William
Binney is a former highly-placed intelligence official with the
United States National Security Agency, and discusses here potential
hackers of the DNC and Hillary Clinton's email servers.
No comments:
Post a Comment
Note: only a member of this blog may post a comment.