Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/12/2017
03:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Shadow Brokers Calls It Quits After Failing To Get Buyers For NSA Exploits

But group says it is still willing to dump its collection of Linux and Windows tools if it gets 10,000 bitcoins.

Just days after offering for sale a database of Windows exploits allegedly purloined from an outfit thought to be affiliated with the National Security Agency (NSA), the infamous ShadowBrokers hacking crew has apparently decided to call it quits.

As a parting gift, they released an archive of nearly five-dozen Windows hacking tools for free Thursday in an apparent last ditch effort to convince potential buyers of the authenticity of their goods.

They also promised to come out of hiding and still release a collection of Linux and Windows exploits in their possession to anyone willing to pay the equivalent of slightly more than $8 million (10,000 bitcoins at current rates) for it.

In a parting note on the group’s website, the Shadow Brokers claimed the decision to go dark had to do entirely with money, or rather the fact they hadn’t made as much of it as expected from their hacking wares.

The language in the note appeared almost deliberately contrived to make it seem as if members of the group are non-native English speakers. “Despite theories, it always being about bitcoins for TheShadowBrokers,” the note claimed. “Free dumps and bullshit political talk was being for marketing attention.”

The farewell note expressed the group’s disappointment with their lack of success in finding buyers for attack tools they had tried to auction off last year and admonished people for not believing in the Shadow Brokers.

“TheShadowBrokers is going dark, making exit,” because continuing poses too much risk. “TheShadowBrokers is deleting accounts and moving on so don’t be trying communications.”

The Shadow Brokers burst into the limelight last August when it leaked information on multiple attacks tools and exploits that it claimed were stolen from The Equation Group, an outfit, which many believe is affiliated with the NSA. Some believe the group obtained the data from a rogue insider.

In releasing the data, the Shadow Brokers claimed they had an even bigger and better collection of similar attack tools that the NSA had allegedly used over the years for breaking into and intercepting data on adversary systems. They put the tools on auction for tens of millions of dollars last summer and then canceled the auction a few months later after failing to get any interest.

Since then the Shadow Brokers, who many believe have Russian connections, have attempted to sell their goods piecemeal in the cyber underground.  In November the group released data pertaining to a tool allegedly used by the Equation Group for breaking into Sun Solaris systems in addition to list of IP addresses and domains associated with servers used to stage and distribute exploits. Earlier this week, they leaked more information, this time on a slew of exploits and toolkits for breaking into Windows system, which they said they would sell to anyone willing to pay 750 bitcoins.

The data releases, like the first one in August appeared designed to convince people that the data the Shadow Brokers has in its possession is authentic.

Andra Zaharia security evangelist with Heimdal Security, which Thursday updated an earlier alert on the Windows exploit release with news of the Shadow Brokers’ quitting, offers two potential reasons for the move.

“One theory is that The Shadow Brokers were a cover up for another operation, and another could be that, in spite of past poor results in sales, [the latest] offer could have helped them reach their goal in terms of bitcoin revenue,” she says.

For the moment the company is unable to confirm what the true motive might be, she adds. The 58 Windows hacking tools released for free by the Shadow Brokers as a parting gift are all detectable by Kaspersky anti virus, she said.

 “We have not yet tested all the tools, but we would be surprised if more tools didn't detect the tools as malicious,” Zaharia says.

For the moment at least, Hemidal has not been able to confirm if the hacking tools that were released publically this week was the same as the ones put up on sale by the group, she adds.

Related Content:

 

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Row3n
50%
50%
Row3n,
User Rank: Strategist
1/16/2017 | 12:19:52 AM
HI
I hope that this means that people aren't as vicious as we originally though. Although I would assume that some people looking to strike it rich might be keen to explore the potential behind the products to exploit the finance industry. So many implications though! Wouldn't the company be obligated to report who they sell this stuff too since it's so widely known what the programs are used for?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10287
PUBLISHED: 2020-07-15
The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple production systems running these exact default cre...
CVE-2020-10288
PUBLISHED: 2020-07-15
IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever you like. As long as the field isn't empty it will be accepted.
CVE-2020-15780
PUBLISHED: 2020-07-15
An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.
CVE-2019-17639
PUBLISHED: 2020-07-15
In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This...
CVE-2019-20908
PUBLISHED: 2020-07-15
An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032.