Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/20/2016
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Report: ShadowBrokers Obtained Stolen NSA Info Via Rogue Insider

Flashpoint researchers have 'medium confidence' that rogue insider, not just outside hacker, was involved in ShadowBrokers' August and December data dumps.

A new report from threat intelligence firm Flashpoint suggests attackers from ShadowBrokers did not hack into the NSA to obtain details about internal exploit tools. Flashpoint researchers now believe ShadowBrokers received stolen information from a rogue NSA insider. This is the first evidence indicating stolen details came from someone within the NSA and not a third-party hack.

In August 2016, the ShadowBrokers claimed to possess - and offered to sell - stolen information from the "Equation Group." Security experts widely believe "the Equation Group" to be the NSA - although Kaspersky Lab, which originally exposed the Equation Group in 2015, never confirmed this, because it doesn't verify attribution. Researchers discovered a code similarity in August that led them to believe tools leaked by ShadowBrokers were related to Equation Group malware.

Experts theorized ShadowBrokers hacked into the NSA, pulled information, and shared it, says Ronnie Tokazowski, senior malware analyst at Flashpoint. Some people thought there might have been a rogue contractor, but there was little to no evidence supporting the idea.

Now, it seems Shadow Brokers has resurfaced after a quiet period following the August incident. Last week, it leaked more information and a newly uncovered website indicates it's attempting to sell hacking tools to individual buyers online.

The group may have also inadvertently shared the level of access it has.

Based on the most recent data dump, "it looks like it was an insider who did it," says Tokazowski. 

While the company is unsure how the documents were exfiltrated, it seems documents were copied from an internal system or code repository. They weren't directly accessed via external remote hacking or discovered on an external staging server.

"Based off the file structure and how it's written, instead of the ShadowBrokers hacking in, it looks like an internal code repository the author or ShadowBrokers had access to," Tokazowski continues. "We're looking at how the files were written and how stuff is laid out."

Tokazowski says he believes an insider was involved in both this latest data dump and the earlier one this summer. 

There are several questions surrounding the latest leak, namely the motivation behind it.

"If it is an insider, the timing is strange," Tokazowski notes. The tools offered for sale in this latest dump include documentation scripts from 2005 through 2013, focused on Linux and Unix-based Computer Network Exploitation (CNE) operations.

While ShadowBrokers changed the data and timestamps to prevent expert analysts, Flashpoint estimates the information was obtained in July 2013. If that's the case, why wait until 2016 to sell? If the group wanted to generate a profit, they would have sold the exploits in 2013, when the data was most valuable.

This incident could still be financially motivated. The insider is currently selling the entire batch of data for 1,000 Bitcoin (about $800,000 USD); individual tools are going for 10-100 Bitcoin (about $8,000-$80,000 USD). However, if the sale is successful, "everyone and their brother will want to see where the money goes," says Tokazowski.

Tokazowski notes the NSA insider may have been inspired by Edward Snowden, who leaked data in 2013. The individual may have "chickened out" on selling the information and held onto it until now.

Who does he think is behind the December leak? "I think it was an insider, someone who had access to those systems," he emphasizes. "It really looks like this ties back to an insider, as opposed to someone who hacked the NSA."

Insider employees with access to sensitive data can be tremendously dangerous to an organization, as Snowden demonstrated. Tokazowski says businesses will have to be on the lookout for these individuals: people who operate independently, who may carry USB sticks or CDs loaded with sensitive information.

There are different rules organizations can employ to disable USB access or prevent CDs from being written, making it more difficult for malicious insiders to share sensitive data. However, it's difficult to entirely prevent this type of crime.

"If you put in protection, someone who is passionate enough will attempt to bypass those," he cautions.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31547
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unprivileged users through the iteration of crafted AbuseFilter rules.
CVE-2021-31548
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked could bypass AbuseFilter and have their edits completed.
CVE-2021-31549
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form allowed for the disclosure of suppressed MediaWiki usernames to unprivileged users.
CVE-2021-31550
PUBLISHED: 2021-04-22
An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, a malicious actor could introduce XSS payloads into various layers.
CVE-2021-31551
PUBLISHED: 2021-04-22
An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related query parameters allowed for XSS on certain PageForms-managed MediaWiki pages.