Attacks/Breaches

1/12/2017
03:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Shadow Brokers Calls It Quits After Failing To Get Buyers For NSA Exploits

But group says it is still willing to dump its collection of Linux and Windows tools if it gets 10,000 bitcoins.

Just days after offering for sale a database of Windows exploits allegedly purloined from an outfit thought to be affiliated with the National Security Agency (NSA), the infamous ShadowBrokers hacking crew has apparently decided to call it quits.

As a parting gift, they released an archive of nearly five-dozen Windows hacking tools for free Thursday in an apparent last ditch effort to convince potential buyers of the authenticity of their goods.

They also promised to come out of hiding and still release a collection of Linux and Windows exploits in their possession to anyone willing to pay the equivalent of slightly more than $8 million (10,000 bitcoins at current rates) for it.

In a parting note on the group’s website, the Shadow Brokers claimed the decision to go dark had to do entirely with money, or rather the fact they hadn’t made as much of it as expected from their hacking wares.

The language in the note appeared almost deliberately contrived to make it seem as if members of the group are non-native English speakers. “Despite theories, it always being about bitcoins for TheShadowBrokers,” the note claimed. “Free dumps and bullshit political talk was being for marketing attention.”

The farewell note expressed the group’s disappointment with their lack of success in finding buyers for attack tools they had tried to auction off last year and admonished people for not believing in the Shadow Brokers.

“TheShadowBrokers is going dark, making exit,” because continuing poses too much risk. “TheShadowBrokers is deleting accounts and moving on so don’t be trying communications.”

The Shadow Brokers burst into the limelight last August when it leaked information on multiple attacks tools and exploits that it claimed were stolen from The Equation Group, an outfit, which many believe is affiliated with the NSA. Some believe the group obtained the data from a rogue insider.

In releasing the data, the Shadow Brokers claimed they had an even bigger and better collection of similar attack tools that the NSA had allegedly used over the years for breaking into and intercepting data on adversary systems. They put the tools on auction for tens of millions of dollars last summer and then canceled the auction a few months later after failing to get any interest.

Since then the Shadow Brokers, who many believe have Russian connections, have attempted to sell their goods piecemeal in the cyber underground.  In November the group released data pertaining to a tool allegedly used by the Equation Group for breaking into Sun Solaris systems in addition to list of IP addresses and domains associated with servers used to stage and distribute exploits. Earlier this week, they leaked more information, this time on a slew of exploits and toolkits for breaking into Windows system, which they said they would sell to anyone willing to pay 750 bitcoins.

The data releases, like the first one in August appeared designed to convince people that the data the Shadow Brokers has in its possession is authentic.

Andra Zaharia security evangelist with Heimdal Security, which Thursday updated an earlier alert on the Windows exploit release with news of the Shadow Brokers’ quitting, offers two potential reasons for the move.

“One theory is that The Shadow Brokers were a cover up for another operation, and another could be that, in spite of past poor results in sales, [the latest] offer could have helped them reach their goal in terms of bitcoin revenue,” she says.

For the moment the company is unable to confirm what the true motive might be, she adds. The 58 Windows hacking tools released for free by the Shadow Brokers as a parting gift are all detectable by Kaspersky anti virus, she said.

 “We have not yet tested all the tools, but we would be surprised if more tools didn't detect the tools as malicious,” Zaharia says.

For the moment at least, Hemidal has not been able to confirm if the hacking tools that were released publically this week was the same as the ones put up on sale by the group, she adds.

Related Content:

 

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Row3n
50%
50%
Row3n,
User Rank: Strategist
1/16/2017 | 12:19:52 AM
HI
I hope that this means that people aren't as vicious as we originally though. Although I would assume that some people looking to strike it rich might be keen to explore the potential behind the products to exploit the finance industry. So many implications though! Wouldn't the company be obligated to report who they sell this stuff too since it's so widely known what the programs are used for?
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.