Report: ShadowBrokers Obtained Stolen NSA Info Via Rogue Insider

A new report from threat intelligence firm Flashpoint suggests attackers from ShadowBrokers did not hack into the NSA to obtain details about internal exploit tools. Flashpoint researchers now believe ShadowBrokers received stolen information from a rogue NSA insider. This is the first evidence indicating stolen details came from someone within the NSA and not a third-party hack.

In August 2016, the ShadowBrokers claimed to possess - and offered to sell - stolen information from the "Equation Group." Security experts widely believe "the Equation Group" to be the NSA - although Kaspersky Lab, which originally exposed the Equation Group in 2015, never confirmed this, because it doesn't verify attribution. Researchers discovered a code similarity in August that led them to believe tools leaked by ShadowBrokers were related to Equation Group malware.

Experts theorized ShadowBrokers hacked into the NSA, pulled information, and shared it, says Ronnie Tokazowski, senior malware analyst at Flashpoint. Some people thought there might have been a rogue contractor, but there was little to no evidence supporting the idea.

Now, it seems Shadow Brokers has resurfaced after a quiet period following the August incident. Last week, it leaked more information and a newly uncovered website indicates it's attempting to sell hacking tools to individual buyers online.

The group may have also inadvertently shared the level of access it has.

Based on the most recent data dump, "it looks like it was an insider who did it," says Tokazowski. 

While the company is unsure how the documents were exfiltrated, it seems documents were copied from an internal system or code repository. They weren't directly accessed via external remote hacking or discovered on an external staging server.

"Based off the file structure and how it's written, instead of the ShadowBrokers hacking in, it looks like an internal code repository the author or ShadowBrokers had access to," Tokazowski continues. "We're looking at how the files were written and how stuff is laid out."

Tokazowski says he believes an insider was involved in both this latest data dump and the earlier one this summer. 

There are several questions surrounding the latest leak, namely the motivation behind it.

"If it is an insider, the timing is strange," Tokazowski notes. The tools offered for sale in this latest dump include documentation scripts from 2005 through 2013, focused on Linux and Unix-based Computer Network Exploitation (CNE) operations.

While ShadowBrokers changed the data and timestamps to prevent expert analysts, Flashpoint estimates the information was obtained in July 2013. If that's the case, why wait until 2016 to sell? If the group wanted to generate a profit, they would have sold the exploits in 2013, when the data was most valuable.

This incident could still be financially motivated. The insider is currently selling the entire batch of data for 1,000 Bitcoin (about $800,000 USD); individual tools are going for 10-100 Bitcoin (about $8,000-$80,000 USD). However, if the sale is successful, "everyone and their brother will want to see where the money goes," says Tokazowski.

Tokazowski notes the NSA insider may have been inspired by Edward Snowden, who leaked data in 2013. The individual may have "chickened out" on selling the information and held onto it until now.

Who does he think is behind the December leak? "I think it was an insider, someone who had access to those systems," he emphasizes. "It really looks like this ties back to an insider, as opposed to someone who hacked the NSA."

Insider employees with access to sensitive data can be tremendously dangerous to an organization, as Snowden demonstrated. Tokazowski says businesses will have to be on the lookout for these individuals: people who operate independently, who may carry USB sticks or CDs loaded with sensitive information.

There are different rules organizations can employ to disable USB access or prevent CDs from being written, making it more difficult for malicious insiders to share sensitive data. However, it's difficult to entirely prevent this type of crime.

"If you put in protection, someone who is passionate enough will attempt to bypass those," he cautions.

Related Content: