When someone shares with you something of value, you have an obligation to share it with others.
Thursday, 18 August 2016
It looks increasingly likely that the NSA has been hacked, as experts scrutinise leaked code
Analysis of the cyber weapons that hackers say they extracted
from the top secret National Security Agency has left a key team of outside
experts increasingly certain that the files came from the NSA.
It looks increasingly likely that the NSA has been hacked, as experts scrutinise leaked code
AP 18 August 2016
Analysis of the cyber weapons that hackers say they extracted from the top secret National Security Agency has left a key team of outside experts increasingly certain that the files came from the NSA.
The Russia-based Kaspersky Lab, which has been at the forefront into research of NSA techniques, said it found 347 instances of encryption algorithms in the leaked files that have been seen previously only in NSA-linked computer programming.
A successful hack of the NSA — if that’s what happened — would mark a major defeat for one of the crown jewels of the US government’s defence establishment. The NSA’s hacking unit has been credited with sophisticated cyber weapons, including the code that is credited with crippling the Iranian nuclear programme.
A mysterious group calling itself the Shadow Brokers announced over the weekend that it had penetrated the NSA, stolen sophisticated cyber weapons and digital tools, and opened a global auction for the sale of the still-secret most valuable ones.
The group released 300 megabytes of files to the public for free, and cyber security companies and hackers rushed to examine the coding on the files, which included malware that would allow a controller to get past the most secure of firewalls.
Dave Aitel, a former NSA computer scientist who is chief executive of Immunity Inc, a penetration testing company in Miami Beach, said he found Kaspersky Lab’s assessment credible. He noted that Kaspersky Lab has been the security company most prolific in offering public analysis of software traced back to the NSA.
“They are very reliable. They are very Russian but when it comes to outing an American toolkit, they are reliable,” said Aitel.
In a blog posting late Tuesday, Kaspersky’s global research and analysis team noted that the group “cannot surmise the attacker’s identity or motivation nor where or how this pilfered trove came to be.”
But the team said it had taken a look at the “functional capabilities” of the files released by Shadow Brokers and determined that “several hundred tools from the leak share a strong connection” with previous tools linked to the NSA’s elite hacking unit, Tailored Access Operations, which Kaspersky calls The Equation Group.
That unit came to light in 2013 when Edward Snowden, the former CIA employee and NSA contractor, leaked thousands of documents revealing that the U.S. government spied on dozens of foreign leaders, tapped into fiber optic cables and cracked encryption codes. The NSA hacker team designs the algorithms and malware to monitor digital traffic, penetrate computers and activate anything connected to the internet.
The Kaspersky blog said the leaked cyber tools use two encryption algorithms, called RC5 and RC6, that employ specific setup routines, and in some variants have “only been seen before with Equation Group malware.”
Former NSAcontractor Edward Snowden appears via live video from Moscow at an event in Honolulu. It was Snowden who brought to light the existence of the NSA’s elite hacking unit, Tailored Access Operations. Photo: AP
“Comparing the older, known Equation RC6 code and the code used in most of the binaries from the new leak, we observe that they are functionally identical and share rare specific traits in their implementation,” the blog said, adding that the company has “a high degree of confidence” that the leaked malware comes from the NSA.
Some of the digital tools in the released files contain names like ExtraBacon, Epicbanana and Eligible Bachelor that apparently breach the firewall platforms, for example, of Cisco System’s PIX/ASA, Juniper Network’s Netscreen, and Fortigate made by Fortinet.
Another researcher who spent two days examining the cyber tools leaked by the Shadow Brokers described his findings as “terrifying.”
Brendan Dolan-Gavitt, a computer scientist at New York University’s Tandon School of Engineering, said he’d found coding that breaches seven different firewall systems or platforms made by the major manufacturers.
The coding gives a distant hacker at-will surveillance capabilities.
“Think of it as sitting on a chokepoint. You sit and watch everything that passes through,” he said.
The coding targets a hardware chip, or BIOS — basic input output system — that activates when a computer is turned on. Dolan-Gavitt said the malicious coding cannot be removed by turning a computer on or off.
2 comments:
It looks increasingly likely that the NSA has been hacked, as experts scrutinise leaked code
AP
18 August 2016
Analysis of the cyber weapons that hackers say they extracted from the top secret National Security Agency has left a key team of outside experts increasingly certain that the files came from the NSA.
The Russia-based Kaspersky Lab, which has been at the forefront into research of NSA techniques, said it found 347 instances of encryption algorithms in the leaked files that have been seen previously only in NSA-linked computer programming.
A successful hack of the NSA — if that’s what happened — would mark a major defeat for one of the crown jewels of the US government’s defence establishment. The NSA’s hacking unit has been credited with sophisticated cyber weapons, including the code that is credited with crippling the Iranian nuclear programme.
A mysterious group calling itself the Shadow Brokers announced over the weekend that it had penetrated the NSA, stolen sophisticated cyber weapons and digital tools, and opened a global auction for the sale of the still-secret most valuable ones.
The group released 300 megabytes of files to the public for free, and cyber security companies and hackers rushed to examine the coding on the files, which included malware that would allow a controller to get past the most secure of firewalls.
Dave Aitel, a former NSA computer scientist who is chief executive of Immunity Inc, a penetration testing company in Miami Beach, said he found Kaspersky Lab’s assessment credible. He noted that Kaspersky Lab has been the security company most prolific in offering public analysis of software traced back to the NSA.
“They are very reliable. They are very Russian but when it comes to outing an American toolkit, they are reliable,” said Aitel.
In a blog posting late Tuesday, Kaspersky’s global research and analysis team noted that the group “cannot surmise the attacker’s identity or motivation nor where or how this pilfered trove came to be.”
But the team said it had taken a look at the “functional capabilities” of the files released by Shadow Brokers and determined that “several hundred tools from the leak share a strong connection” with previous tools linked to the NSA’s elite hacking unit, Tailored Access Operations, which Kaspersky calls The Equation Group.
That unit came to light in 2013 when Edward Snowden, the former CIA employee and NSA contractor, leaked thousands of documents revealing that the U.S. government spied on dozens of foreign leaders, tapped into fiber optic cables and cracked encryption codes. The NSA hacker team designs the algorithms and malware to monitor digital traffic, penetrate computers and activate anything connected to the internet.
The Kaspersky blog said the leaked cyber tools use two encryption algorithms, called RC5 and RC6, that employ specific setup routines, and in some variants have “only been seen before with Equation Group malware.”
Former NSAcontractor Edward Snowden appears via live video from Moscow at an event in Honolulu. It was Snowden who brought to light the existence of the NSA’s elite hacking unit, Tailored Access Operations. Photo: AP
“Comparing the older, known Equation RC6 code and the code used in most of the binaries from the new leak, we observe that they are functionally identical and share rare specific traits in their implementation,” the blog said, adding that the company has “a high degree of confidence” that the leaked malware comes from the NSA.
Some of the digital tools in the released files contain names like ExtraBacon, Epicbanana and Eligible Bachelor that apparently breach the firewall platforms, for example, of Cisco System’s PIX/ASA, Juniper Network’s Netscreen, and Fortigate made by Fortinet.
Another researcher who spent two days examining the cyber tools leaked by the Shadow Brokers described his findings as “terrifying.”
Brendan Dolan-Gavitt, a computer scientist at New York University’s Tandon School of Engineering, said he’d found coding that breaches seven different firewall systems or platforms made by the major manufacturers.
The coding gives a distant hacker at-will surveillance capabilities.
“Think of it as sitting on a chokepoint. You sit and watch everything that passes through,” he said.
The coding targets a hardware chip, or BIOS — basic input output system — that activates when a computer is turned on. Dolan-Gavitt said the malicious coding cannot be removed by turning a computer on or off.
Post a Comment