Threat Intelligence
8/16/2016
04:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

'Strong Connection' Between Files Leaked By ShadowBrokers & The Equation Group

Researchers from Kaspersky Lab, which exposed the so-called Equation Group two years ago, say several hundred of the hacking tools leaked online have ties to the nation-state gang.

The team of researchers at Kaspersky Lab who initially exposed the so-called Equation Group in 2015 today confirmed that several hundred of the purported tools leaked online have ties to that sophisticated hacker group.

The researchers found that a rare deployment of RC5/RC6 encryption in the files dumped online this week by the so-called "ShadowBrokers" matches that of the Equation Group. Kaspersky Lab has never confirmed Equation Group is the NSA -- it does not confirm attribution of groups -- but security experts say the two are one in the same.

ShadowBrokers claimed to have in its possession stolen Equation Group tools and files, which it has offered for sale online. Security experts for the past couple of days have been debating the authenticity of the leak, as well as just who may be behind it -- not to mention just how and when the National Security Agency (NSA) could have been breached.

"This code similarity makes us believe with a high degree of confidence that the tools from the ShadowBrokers leak are related to the malware from the Equation Group. While the ShadowBrokers claimed the data was related to the Equation Group, they did not provide any technical evidence of these claims. The highly specific crypto implementation above confirms these allegations," the Kaspersky Lab researchers wrote in a blog post today.

More than 300 of the files dumped by ShadowBrokers use the RC6 crypto implementation associated with the Equation Group. "There are more than 300 files in the Shadowbrokers’ archive which implement this specific variation of RC6 in 24 different forms. The chances of all these being faked or engineered is highly unlikely," the researchers said. 

Former NSA analyst Blake Darche, who has been studying the leak, says the tools appear to be legitimate. Darche, CTO and co-founder of Area 1, says the backdoors and exploits in the dump include a tool called SecondDate that runs on Cisco PIX631 firewalls.

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
lorraine89
50%
50%
lorraine89,
User Rank: Ninja
10/27/2016 | 9:28:21 AM
Cyber security
Social media sites have become the safe haven for cyber security blows altogether for the fact that users on such sites pay pretty much least attention towards data security measures. Therefore, it is essential to never compromise our online security. I use PureVPN to secure my account from the perils of data theft and to avoid any form of hacking attempt. 
Kelly Jackson Higgins
0%
100%
Kelly Jackson Higgins,
User Rank: Strategist
8/17/2016 | 10:18:50 AM
Re: Russian warning?
Not sure what Snowden really knows here, but the timing indeed is suspect and not likely coincidental. Stay tuned for a follow-up story from me on this. 
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
8/17/2016 | 7:26:18 AM
Russian warning?
Edward Snowden now believes that this could be a warning by Russian state sponsored hackers to not start pointing fingers over the DNC hack, because it would be able to use these tools to prove that the U.S. was involved in other, unknown hacks.

What do you guys think about that?
5 Reasons the Cybersecurity Labor Shortfall Won't End Soon
Steve Morgan, Founder & CEO, Cybersecurity Ventures,  12/11/2017
BlueBorne Attack Highlights Flaws in Linux, IoT Security
Kelly Sheridan, Associate Editor, Dark Reading,  12/14/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.