Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/20/2016
02:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Report: ShadowBrokers Obtained Stolen NSA Info Via Rogue Insider

Flashpoint researchers have 'medium confidence' that rogue insider, not just outside hacker, was involved in ShadowBrokers' August and December data dumps.

A new report from threat intelligence firm Flashpoint suggests attackers from ShadowBrokers did not hack into the NSA to obtain details about internal exploit tools. Flashpoint researchers now believe ShadowBrokers received stolen information from a rogue NSA insider. This is the first evidence indicating stolen details came from someone within the NSA and not a third-party hack.

In August 2016, the ShadowBrokers claimed to possess - and offered to sell - stolen information from the "Equation Group." Security experts widely believe "the Equation Group" to be the NSA - although Kaspersky Lab, which originally exposed the Equation Group in 2015, never confirmed this, because it doesn't verify attribution. Researchers discovered a code similarity in August that led them to believe tools leaked by ShadowBrokers were related to Equation Group malware.

Experts theorized ShadowBrokers hacked into the NSA, pulled information, and shared it, says Ronnie Tokazowski, senior malware analyst at Flashpoint. Some people thought there might have been a rogue contractor, but there was little to no evidence supporting the idea.

Now, it seems Shadow Brokers has resurfaced after a quiet period following the August incident. Last week, it leaked more information and a newly uncovered website indicates it's attempting to sell hacking tools to individual buyers online.

The group may have also inadvertently shared the level of access it has.

Based on the most recent data dump, "it looks like it was an insider who did it," says Tokazowski. 

While the company is unsure how the documents were exfiltrated, it seems documents were copied from an internal system or code repository. They weren't directly accessed via external remote hacking or discovered on an external staging server.

"Based off the file structure and how it's written, instead of the ShadowBrokers hacking in, it looks like an internal code repository the author or ShadowBrokers had access to," Tokazowski continues. "We're looking at how the files were written and how stuff is laid out."

Tokazowski says he believes an insider was involved in both this latest data dump and the earlier one this summer. 

There are several questions surrounding the latest leak, namely the motivation behind it.

"If it is an insider, the timing is strange," Tokazowski notes. The tools offered for sale in this latest dump include documentation scripts from 2005 through 2013, focused on Linux and Unix-based Computer Network Exploitation (CNE) operations.

While ShadowBrokers changed the data and timestamps to prevent expert analysts, Flashpoint estimates the information was obtained in July 2013. If that's the case, why wait until 2016 to sell? If the group wanted to generate a profit, they would have sold the exploits in 2013, when the data was most valuable.

This incident could still be financially motivated. The insider is currently selling the entire batch of data for 1,000 Bitcoin (about $800,000 USD); individual tools are going for 10-100 Bitcoin (about $8,000-$80,000 USD). However, if the sale is successful, "everyone and their brother will want to see where the money goes," says Tokazowski.

Tokazowski notes the NSA insider may have been inspired by Edward Snowden, who leaked data in 2013. The individual may have "chickened out" on selling the information and held onto it until now.

Who does he think is behind the December leak? "I think it was an insider, someone who had access to those systems," he emphasizes. "It really looks like this ties back to an insider, as opposed to someone who hacked the NSA."

Insider employees with access to sensitive data can be tremendously dangerous to an organization, as Snowden demonstrated. Tokazowski says businesses will have to be on the lookout for these individuals: people who operate independently, who may carry USB sticks or CDs loaded with sensitive information.

There are different rules organizations can employ to disable USB access or prevent CDs from being written, making it more difficult for malicious insiders to share sensitive data. However, it's difficult to entirely prevent this type of crime.

"If you put in protection, someone who is passionate enough will attempt to bypass those," he cautions.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "The security team seem to be taking SiegeWare seriously" 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16770
PUBLISHED: 2019-12-05
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.
CVE-2019-19609
PUBLISHED: 2019-12-05
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
CVE-2019-16768
PUBLISHED: 2019-12-05
Exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation m...
CVE-2012-1105
PUBLISHED: 2019-12-05
An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.
CVE-2019-16769
PUBLISHED: 2019-12-05
Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash...