'Shadow Brokers' claim to be selling NSA malware in what could be historic hack

[TheSanityAnnex]

http://foreignpolicy.com/2016/08/15/shadow-brokers-claim-to-be-selling-nsa-malware-in-what-could-be-historic-hack/

[TheSanityAnnex]

https://www.yahoo.com/tech/snowden-exposure-alleged-nsa-tools-143130561.html

PARIS (AP) — The exposure of malicious software purportedly linked to the National Security Agency is likely a message from Moscow, former intelligence worker Edward Snowden said Tuesday, adding a layer of intrigue to a leak that has set the information security world abuzz.



Technical experts have spent the past day or so picking apart a suite of tools allegedly stolen from the Equation Group , a powerful squad of hackers which some have tied to the NSA. The tools materialized as part of an internet electronic auction set up by a group calling itself "Shadow Brokers," which has promised to leak more data to whoever puts in a winning bid.


In a series of messages posted to Twitter , Snowden suggested the leak was the fruit of a Russian attack on an NSA-controlled server and could be aimed at heading off U.S. retaliation over allegations that the Kremlin is interfering in the U.S. electoral process.
"Circumstantial evidence and conventional wisdom indicates Russian responsibility," Snowden said. "This leak is likely a warning that someone can prove U.S. responsibility for any attacks that originated from this malware server. That could have significant foreign policy consequences. Particularly if any of those operations targeted U.S. allies. Particularly if any of those operations targeted elections."



Snowden didn't return messages seeking additional comment. The NSA didn't return emails seeking comment on his claim. Messages sent to an address registered by the Shadow Brokers were also not returned.
Allegations of Russian subversion have been hotly debated following the hack of the Democratic National Committee, an operation which Democratic politicians, security companies and several outside experts have blamed on the Kremlin. Russian officials have dismissed the claims as paranoid or ridiculous, so the message delivered by Snowden — who resides at an undisclosed location in Moscow under the protection of the Russian government — struck many as significant.


Academic Thomas Rid, whose book "Rise of the Machines" traces the earliest known Kremlin-linked computer hacking campaign in the U.S., said Snowden's declaration would likely be interpreted as "shrewd messaging" from Russian intelligence.
Matt Suiche, the founder of United Arab Emirates-based cybersecurity startup Comae Technologies, said he and others looking through the data were convinced it came from the NSA.
"There's zero debate so far," he said in a telephone interview.

[hater]

Odumbo said everyone spies and hacks each other. Sometimes ppl.want to know what the other leader had for breakfast (odummys actual quote :lmao)

But but when we get hacked its not fair :cry

Pussies

[TheSanityAnnex]

Looks to be another Edward Snowden insider...lol the previous "message from Moscow" claim.

http://mobile.reuters.com/article/idUSKCN10X01P

[hater]

The NSA was listening to Merkels phone sex for years and yet :cry the Russians are meanies :cry they are hacking us :cry poor us :cry

:lmao

[TheSanityAnnex]

I'm really starting to think all these hacks have been an inside job.

[ElNono]

Thanks Obummer?

[Winehole23]

Schneier: NSA hoards vulnerabilities instead of fixing them.

why?

it prioritizes surveillance over security.


Over the past few years, different parts of the US government have repeatedly assured us that the NSA does not hoard "zero days" * the term used by security experts for vulnerabilities unknown to software vendors. After we learned (https://www.washingtonpost.com/world/national-security/us-spy-agencies-mounted-231-offensive-cyber-operations-in-2011-documents-show/2013/08/30/d090a6ae-119e-11e3-b4cb-fd7ce041d814_story.html) from the Snowden documents that the NSA purchases zero-day vulnerabilities from cyberweapons arms manufacturers, the Obama administration announced, in early 2014, that the NSA must disclose flaws (http://www.nytimes.com/2014/04/13/us/politics/obama-lets-nsa-exploit-some-internet-flaws-officials-say.html) in common software so they can be patched (unless there is "a clear national security or law enforcement" use).


Later that year, National Security Council cybersecurity coordinator and special adviser to the president on cybersecurity issues Michael Daniel insisted (https://www.wired.com/2014/11/michael-daniel-no-zero-day-stockpile/) that US doesn't stockpile zero-days (except for the same narrow exemption). An official statement from the White House in 2014 said (https://www.schneier.com/blog/archives/2016/08/%3Ca%20href=%22https:/www.whitehouse.gov/blog/2014/04/28/heartbleed-understanding-when-we-disclose-cyber-vulnerabilities%22) the same thing.


The Shadow Brokers data shows this is not true. The NSA hoards vulnerabilities.

https://www.schneier.com/blog/archives/2016/08/the_nsa_is_hoar.html

[Winehole23]

If there are any vulnerabilities that -- according to the standards established by the White House and the NSA -- should have been disclosed and fixed, it's these. That they have not been during the three-plus years that the NSA knew about and exploited them -- despite Joyce's insistence that they're not very important -- demonstrates that the Vulnerable Equities Process is badly broken.


We need to fix this. This is exactly the sort of thing a congressional investigation is for. This whole process needs a lot more transparency, oversight, and accountability. It needs guiding principles that prioritize security over surveillance. A good place to start are the recommendations by Ari Schwartz and Rob Knake in their report (http://belfercenter.ksg.harvard.edu/publication/26725/governments_role_in_vulnerability_disclosure.html) : these include a clearly defined and more public process, more oversight by Congress and other independent bodies, and a strong bias toward fixing vulnerabilities instead of exploiting them.


And as long as I'm dreaming, we really need to separate our nation's intelligence-gathering mission from our computer security mission: we should break up the NSA (http://www.wired.com/2014/08/save-the-net-bruce-schneier/). The agency's mission should be limited to nation state espionage. Individual investigation should be part of the FBI, cyberwar capabilities should be within US Cyber Command, and critical infrastructure defense should be part of DHS's mission.

[Winehole23]

the NSA screwed up:


Various explanations have been floated by officials in Washington as to how the tools were stolen. Some feared it was the work of a leaker similar to former agency contractor Edward Snowden, while others suspected the Russians might have hacked into NSA headquarters in Fort Meade, Maryland.


But officials heading the FBI-led investigation now discount both of those scenarios, the people said in separate interviews.


NSA officials have told investigators that an employee or contractor made the mistake about three years ago during an operation that used the tools, the people said.


That person acknowledged the error shortly afterward, they said. But the NSA did not inform the companies of the danger when it first discovered the exposure of the tools, the sources said.

http://www.reuters.com/article/us-cyber-nsa-tools-idUSKCN11S2MF

[Winehole23]

https://www.washingtonpost.com/world/national-security/government-contractor-arrested-for-stealing-top-secret-data/2016/10/05/99eeb62a-8b19-11e6-875e-2c1bfe943b66_story.html?wpisrc=al_alert-national

[Winehole23]

In the six weeks since federal agents raided a suburban Maryland home and arrested Harold T. Martin III (http://www.nytimes.com/2016/10/06/us/nsa-leak-booz-allen-hamilton.html) on suspicion of stealing classified information from the National Security Agency (http://topics.nytimes.com/top/reference/timestopics/organizations/n/national_security_agency/index.html?inline=nyt-org), another organization has quietly prepared to face the fallout: Booz Allen Hamilton, Mr. Martin’s employer.

Booz Allen, a consulting firm (http://www.boozallen.com/) that earns billions of dollars by working for American intelligence agencies, has been called the world’s most profitable spy organization (http://www.bloomberg.com/news/articles/2013-06-20/booz-allen-the-worlds-most-profitable-spy-organization). News this week of Mr. Martin’s arrest in August could renew scrutiny of the firm’s operations and, more broadly, the lucrative contracting business that American intelligence now relies on to run its vast, global surveillance operations.


Mr. Martin’s arrest is the second time in three years that a Booz Allen contractor has been accused of stealing potentially damaging material from the N.S.A. The company also employed Edward J. Snowden, who spirited out a cache of documents that, in 2013, exposed the extent of American surveillance programs in the United States and around the world.


Booz Allen is one of a handful of defense and intelligence contractors that blur the line between the government’s intelligence work and private enterprise.http://www.nytimes.com/2016/10/07/us/booz-allen-hamilton-nsa.html

[Winehole23]

Selling NSA scripts on ZeroNet?


There are, based on my count, twenty one (21) scripts/manuals for operations contained in this dump. They cover too many operations for a mistake, and they are too comprehensive for a mistake.https://medium.com/@thegrugq/the-great-cyber-game-commentary-2-33c9b79ca8ac#.j6xjttb3a

[Winehole23]

If the sale was real and you bought the tools individually, you’d be paying about 1400 BTC (a bit under USD$ 1.1 million, at this hour’s exchange rate.) The entire dump for just 1000 BTC is a real bargain (only USD$780k), it pays to buy warez in bulk!

[boutons_deux]

Hacker Steals 900 GB of Cellebrite Data

The hackers have been hacked. Motherboard has obtained 900 GB of data related to Cellebrite, one of the most popular companies in the mobile phone hacking industry. The cache includes customer information, databases, and a vast amount of technical data regarding Cellebrite's products.

The breach is the latest chapter in a growing trend of hackers taking matters into their own hands, and stealing information from companies that specialize in surveillance or hacking technologies.

Cellebrite is an Israeli company whose main product, a typically laptop-sized device called the Universal Forensic Extraction Device (UFED), can rip data from thousands of different models of mobile phones. That data can include SMS messages, emails, call logs, and much more, as long as the UFED user is in physical possession of the phone.

Cellebrite is popular with US federal (https://motherboard.vice.com/read/meet-cellebrite-the-israeli-company-reportedly-cracking-iphones-for-the-fbi) and state law enforcement (https://motherboard.vice.com/read/us-state-police-have-spent-millions-on-israeli-phone-cracking-tech-cellebrite), and, according to the hacked data, possibly also with authoritarian regimes (https://motherboard.vice.com/read/cellebrite-sold-phone-hacking-tech-to-repressive-regimes-data-suggests) such as Russia, the United Arab Emirates, and Turkey.

The hacker, however, remained vague as to the true extent of what they had done to Cellebrite's systems.
“I can't say too much about what has been done,” the hacker told Motherboard. “It's one thing to slap them, it's a very different thing to take pictures of [their] balls hanging out.”


http://motherboard.vice.com/read/hacker-steals-900-gb-of-cellebrite-data

:lol And you rightwing assholes blame Dems for getting hacked?

Repug sitting ducks were hacked, too.

[Winehole23]

what does this have to do with Shadow Brokers?