Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/20/2016
02:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Report: ShadowBrokers Obtained Stolen NSA Info Via Rogue Insider

Flashpoint researchers have 'medium confidence' that rogue insider, not just outside hacker, was involved in ShadowBrokers' August and December data dumps.

A new report from threat intelligence firm Flashpoint suggests attackers from ShadowBrokers did not hack into the NSA to obtain details about internal exploit tools. Flashpoint researchers now believe ShadowBrokers received stolen information from a rogue NSA insider. This is the first evidence indicating stolen details came from someone within the NSA and not a third-party hack.

In August 2016, the ShadowBrokers claimed to possess - and offered to sell - stolen information from the "Equation Group." Security experts widely believe "the Equation Group" to be the NSA - although Kaspersky Lab, which originally exposed the Equation Group in 2015, never confirmed this, because it doesn't verify attribution. Researchers discovered a code similarity in August that led them to believe tools leaked by ShadowBrokers were related to Equation Group malware.

Experts theorized ShadowBrokers hacked into the NSA, pulled information, and shared it, says Ronnie Tokazowski, senior malware analyst at Flashpoint. Some people thought there might have been a rogue contractor, but there was little to no evidence supporting the idea.

Now, it seems Shadow Brokers has resurfaced after a quiet period following the August incident. Last week, it leaked more information and a newly uncovered website indicates it's attempting to sell hacking tools to individual buyers online.

The group may have also inadvertently shared the level of access it has.

Based on the most recent data dump, "it looks like it was an insider who did it," says Tokazowski. 

While the company is unsure how the documents were exfiltrated, it seems documents were copied from an internal system or code repository. They weren't directly accessed via external remote hacking or discovered on an external staging server.

"Based off the file structure and how it's written, instead of the ShadowBrokers hacking in, it looks like an internal code repository the author or ShadowBrokers had access to," Tokazowski continues. "We're looking at how the files were written and how stuff is laid out."

Tokazowski says he believes an insider was involved in both this latest data dump and the earlier one this summer. 

There are several questions surrounding the latest leak, namely the motivation behind it.

"If it is an insider, the timing is strange," Tokazowski notes. The tools offered for sale in this latest dump include documentation scripts from 2005 through 2013, focused on Linux and Unix-based Computer Network Exploitation (CNE) operations.

While ShadowBrokers changed the data and timestamps to prevent expert analysts, Flashpoint estimates the information was obtained in July 2013. If that's the case, why wait until 2016 to sell? If the group wanted to generate a profit, they would have sold the exploits in 2013, when the data was most valuable.

This incident could still be financially motivated. The insider is currently selling the entire batch of data for 1,000 Bitcoin (about $800,000 USD); individual tools are going for 10-100 Bitcoin (about $8,000-$80,000 USD). However, if the sale is successful, "everyone and their brother will want to see where the money goes," says Tokazowski.

Tokazowski notes the NSA insider may have been inspired by Edward Snowden, who leaked data in 2013. The individual may have "chickened out" on selling the information and held onto it until now.

Who does he think is behind the December leak? "I think it was an insider, someone who had access to those systems," he emphasizes. "It really looks like this ties back to an insider, as opposed to someone who hacked the NSA."

Insider employees with access to sensitive data can be tremendously dangerous to an organization, as Snowden demonstrated. Tokazowski says businesses will have to be on the lookout for these individuals: people who operate independently, who may carry USB sticks or CDs loaded with sensitive information.

There are different rules organizations can employ to disable USB access or prevent CDs from being written, making it more difficult for malicious insiders to share sensitive data. However, it's difficult to entirely prevent this type of crime.

"If you put in protection, someone who is passionate enough will attempt to bypass those," he cautions.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13623
PUBLISHED: 2019-07-17
In NSA Ghidra through 9.0.4, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis r...
CVE-2019-13624
PUBLISHED: 2019-07-17
In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command.
CVE-2019-13625
PUBLISHED: 2019-07-17
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.
CVE-2019-3571
PUBLISHED: 2019-07-16
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.
CVE-2019-6160
PUBLISHED: 2019-07-16
A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.