Among the sample files released by the group are exploits that target equipment sold by companies including Cisco, Juniper, Fortigate and Topsec, a Chinese network security firm, according to Matt Suiche, founder of UAE-based incident response and forensics startup Comae Technologies. Suiche says those exploits attack older versions of the equipment and don’t use “zero-days”—previously undiscovered flaws in target software or hardware. But he believes they had nonetheless remained unpublished until now and hadn’t been included in public collections of exploits like the tool Metasploit.
All of that weighs against any theory that the leaked data is a mere scam to score a few quick bitcoins. “To create [all this evidence] from scratch, it’s very unlikely but not impossible,” says Suiche. “It seems pretty legitimate to me, and I’m not the only one.”
On the other hand, the Shadow Brokers group certainly doesn’t seem to be running its auction in a very professional fashion. They require bidders to send cryptocurrency blindly to their bitcoin address, with no hope of getting their coins back if they don’t submit the winning bid. “Sorry lose bidding war lose bitcoin and files. Lose Lose. Bid to win!” the message reads. But it also promises a “consolation prize” to all bidders and adds that if bids reach the ludicrous sum of one million bitcoins, they’ll publicly release another trove of high quality data.
“Why I trust you?” reads another question in their FAQ. “No trust, risk. You like reward, you take risk, maybe win, maybe not, no guarantees.”
The Shadow Brokers’ page ends with a long message to “wealthy elites,” arguing that the tactics of hackers like Equation Group could put their control of global politics at risk, and suggesting that they too should bid on the stolen files. “We want make sure Wealthy Elite recognizes the danger cyber weapons, this message, our auction, poses to their wealth and control,” the Shadow Brokers’ message reads.
The haphazard auction and political message present a jarring disconnect: Any hackers capable of compromising the Equation Group or another NSA hacker team would likely have to be extremely sophisticated; the Equation Group, after all, went not only uncompromised, but undetected for 14 years, a remarkable track record of stealth and operational security for a team believed to have attacked targets from Russia to Belgium to Lebanon. Anyone capable of finding NSA hackers’ infrastructure, not to mention penetrating it, would likely have to possess government-level resources and talent.
That disconnect has led security researchers to speculate that the leak is some sort of deceptive operation meant to confuse anyone trying to get to the bottom of the supposed compromise. Some researchers are already speculating that the leak is somehow connected to the alleged Russian hack of the Democratic National Committee, an operation that was also obscured by the perpetrators’ attempt to make it appear to be the act of a lone Romanian hacker.
For now, it’s likely too early to pin it on any of the usual cyberintrusion suspects. But the splashy leak, real or fraudulent, is sure to at least have gotten the NSA’s attention—and likely that of a few dozen other intelligence agencies, too.
(tagged: #ANT #CatalogueClaudio #GuarnieriEdward #SnowdenEquation #GroupNSAShadow #BrokersTailored #Access Operations)