Attacks/Breaches
1/12/2017
03:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Shadow Brokers Calls It Quits After Failing To Get Buyers For NSA Exploits

But group says it is still willing to dump its collection of Linux and Windows tools if it gets 10,000 bitcoins.

Just days after offering for sale a database of Windows exploits allegedly purloined from an outfit thought to be affiliated with the National Security Agency (NSA), the infamous ShadowBrokers hacking crew has apparently decided to call it quits.

As a parting gift, they released an archive of nearly five-dozen Windows hacking tools for free Thursday in an apparent last ditch effort to convince potential buyers of the authenticity of their goods.

They also promised to come out of hiding and still release a collection of Linux and Windows exploits in their possession to anyone willing to pay the equivalent of slightly more than $8 million (10,000 bitcoins at current rates) for it.

In a parting note on the group’s website, the Shadow Brokers claimed the decision to go dark had to do entirely with money, or rather the fact they hadn’t made as much of it as expected from their hacking wares.

The language in the note appeared almost deliberately contrived to make it seem as if members of the group are non-native English speakers. “Despite theories, it always being about bitcoins for TheShadowBrokers,” the note claimed. “Free dumps and bullshit political talk was being for marketing attention.”

The farewell note expressed the group’s disappointment with their lack of success in finding buyers for attack tools they had tried to auction off last year and admonished people for not believing in the Shadow Brokers.

“TheShadowBrokers is going dark, making exit,” because continuing poses too much risk. “TheShadowBrokers is deleting accounts and moving on so don’t be trying communications.”

The Shadow Brokers burst into the limelight last August when it leaked information on multiple attacks tools and exploits that it claimed were stolen from The Equation Group, an outfit, which many believe is affiliated with the NSA. Some believe the group obtained the data from a rogue insider.

In releasing the data, the Shadow Brokers claimed they had an even bigger and better collection of similar attack tools that the NSA had allegedly used over the years for breaking into and intercepting data on adversary systems. They put the tools on auction for tens of millions of dollars last summer and then canceled the auction a few months later after failing to get any interest.

Since then the Shadow Brokers, who many believe have Russian connections, have attempted to sell their goods piecemeal in the cyber underground.  In November the group released data pertaining to a tool allegedly used by the Equation Group for breaking into Sun Solaris systems in addition to list of IP addresses and domains associated with servers used to stage and distribute exploits. Earlier this week, they leaked more information, this time on a slew of exploits and toolkits for breaking into Windows system, which they said they would sell to anyone willing to pay 750 bitcoins.

The data releases, like the first one in August appeared designed to convince people that the data the Shadow Brokers has in its possession is authentic.

Andra Zaharia security evangelist with Heimdal Security, which Thursday updated an earlier alert on the Windows exploit release with news of the Shadow Brokers’ quitting, offers two potential reasons for the move.

“One theory is that The Shadow Brokers were a cover up for another operation, and another could be that, in spite of past poor results in sales, [the latest] offer could have helped them reach their goal in terms of bitcoin revenue,” she says.

For the moment the company is unable to confirm what the true motive might be, she adds. The 58 Windows hacking tools released for free by the Shadow Brokers as a parting gift are all detectable by Kaspersky anti virus, she said.

 “We have not yet tested all the tools, but we would be surprised if more tools didn't detect the tools as malicious,” Zaharia says.

For the moment at least, Hemidal has not been able to confirm if the hacking tools that were released publically this week was the same as the ones put up on sale by the group, she adds.

Related Content:

 

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Row3n
50%
50%
Row3n,
User Rank: Strategist
1/16/2017 | 12:19:52 AM
HI
I hope that this means that people aren't as vicious as we originally though. Although I would assume that some people looking to strike it rich might be keen to explore the potential behind the products to exploit the finance industry. So many implications though! Wouldn't the company be obligated to report who they sell this stuff too since it's so widely known what the programs are used for?
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Jan, check this out! I found an unhackable PC.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.