‘Shadow Brokers’ Leak Raises Question of whether the N.S.A. was Hacked
nytimes.com
nytimes.com
The documentation is fairly shitty and poorly formatted, and the Python I looked at is abysmal (though it's not uncommon for infosec experts to be shitty scripters).
So, they probably got into something akin to a "forward operating base", or perhaps a compromised server where an incompetent implanter accidentally left all of this stuff lying around, but not an actual compromise of NSA's network. There also doesn't look to be anything in here that wasn't already known from the Snowden leaks, other than some specific technical details and context clues from people writing the documentation.
https://motherboard.vice.com/read/what-we-know-about-the-exp...
But this is just some technical documentation about project codenames we already know a lot about.
#################
# Survey #
#################
# Set up forward tunnel to TCP/443 on the target, and reverse tunnel for NOPEN.
-tunnel
l 443 $TARGETIP 443
r $RHP1 127.0.0.1 $RHP1
#perform touch to gather info and set env for exploit
./eligiblecandidate.py -t https://127.0.0.1:443 touch
The only somewhat interesting thing is the exploit code for ex-0-days, but I believe vendors are mostly patched against everything discussed in the Snowden leaks. Someone correct me if I'm wrong.
Even still, "poorly written" is mostly big talk.
This. Custom code (likely adapted from some other script the author saw or wrote in the past) made for a 1-time job for one server doesn't have to be efficient/good because it doesn't have to scale. Getting it written, making it do what it needs and getting as entrenched in the target as possible ASAP is far more important than writing "good" and/or legible code.
Even with NSA's considerable budget operating and defending against Russia, China and several dozen other unfriendly and friendly countries is no easy task.
I don't get his reasoning why it necessarily has to be HUMINT. State actors from other countries can find 0-day exploits presumably. Don't think it was that outrageous they could have hacked into a c2 server.
People who do the work at NSA (assuming it is) are not necessarily super-wizzards or automatically better equipped at defending against an attack. They were most likely average developers from the DC area who happen to have clearance and work for Uncle Sam. Because of compartmentalization, those who specialize in attackig specific targets (firewalls) might not necessarily have the knowledge to secure a server well.
Also, right after the Equation leak, NSA.gov site was shut down for over 24 hrs and it came back online today.
Very strange.
Shadow Brokers: The insider theory
https://medium.com/p/shadowbrokers-the-insider-theory-ded733...
If it is an insider though, that would seem to have important implications all of its own.
HNer might say you put your point across like Trump or Glen Beck - I'm not saying it. If it were true, you'd be a weasel to suggest one thing while disassociating yourself from the said suggestion[1], which means you could be a coward who is afraid of people judging you for holding such a disagreeable opinion while dog-whistling to the minority who do not share the same distaste. I'm not saying this is what you are, I think it is an idea that should be considered when reading your comments.
The person you're responding to is obviously trying to imply something about the strength of their belief: That it's not ironclad and it's an interesting coincidence.
That you're drawing an analogy between the poster and Glenn Beck is extremely cringeworthy. Leave him back where he belongs, in 2012.
>Auction Instructions
>We auction best files to highest bidder. Auction files better than stuxnet. Auction files better than free files we already give you. The party which sends most bitcoins to address: 19BY2XCgbDe6WtTVbTyzM9eR3LYr6VitWK before bidding stops is winner, we tell how to decrypt. Very important!!! When you send bitcoin you add additional output to transaction. You add OP_Return output. In Op_Return output you put your (bidder) contact info. We suggest use bitmessage or I2P-bote email address. No other information will be disclosed by us publicly. Do not believe unsigned messages. We will contact winner with decryption instructions. Winner can do with files as they please, we not release files to public.
Took a quick look at files:
> TOOLS/Apache/httpd-2.0.52-9.ent.i386.rpm
Heh RHEL4! Nothing points to a 3 letter US govt agency like an outdated RHEL version. Even for 2013 (based on file date) RHEL4 was ancient. RHEL7 beta for example, came out that year.
Also another striking thing about it, there are no swear or l33t-speak words in there. I know if I had to write ASN.1-based SNMP firmware hacks for obscure Juniper switches, that code would be drowning in curse words.
Seeing this kind of stuff is fun too:
ar rules update filename `/tmp/.b` type ar url http://topsec.com.cn
class ELCAExploit(HTTPSExploit):
name = "ELIGIBLECANDIDATE"
version = "v1.1.0.1"
desc="What is the sound of a single thread blocking?"
modes = ["nopen"][1] http://rebrn.com/re/the-nsa-has-been-hacked-and-the-hackers-...
[2] https://www.riskbasedsecurity.com/2016/08/the-shadow-brokers...
1. e.g. https://en.wikipedia.org/wiki/Clipper_chip or weak export-grade crypto
Also, a known backdoor not very useful for them.
I don't see where they're going with that. Anyone care to elaborate?
Russia wants to collapse confidence in the US: both external confidence from the US's allies as well as internal confidence.
I'm sure Russia would love many of the things Trump has espoused to come to pass: The US reducing support of the Ukraine and NATO and Japan and maybe even South Korea are all aligned with Russian interests. Trump's policy on Syria (insofar as I can understand it) seems well aligned with Russia's too.
But more broadly, Russia loves to cause chaos in the US democratic system. Anything that can make the US population consider their system corrupt removes any moral legitimacy the US has overseas, with strengthens Russia's hand.
Read the but in this story[1] about the Turkish Incirlik base. Be very aware that Russia would love to break any kind of Turkish/US alignment, and would love a weak Turkey. Ignore the Trump angle if it annoys you.
Sowing chaos is the game here.
[1] http://www.thedailybeast.com/articles/2016/08/06/how-russia-...
http://www.vox.com/2016/7/27/12271042/donald-trump-russia-pu...
> All of this raises one big question: What the hell is going on with Trump and Russia? The answer appears to be twofold. First, the Kremlin appears to be interfering in the US election in a way likely to help Trump become president. (...)
> Second, Trump is deeply, weirdly pro-Russian. Trump’s proposed foreign policy would, intentionally or no, aid Vladimir Putin in ways the Russian dictator could only dream about before Trump. Trump has repeatedly expressed wild admiration for Putin personally; his campaign staff and businesses have extensive ties to Russian interests. (Just yesterday, the New York Times reported the existence of a handwritten ledger documenting $12.7 million in payments to Trump's campaign manager, Paul Manafort, from Ukraine's pro-Russian deposed president, Viktor Yanukovych).
Trump has been known to make statements like, "Russia, if you’re listening, I hope you’re able to find the 30,000 emails that are missing [from Hillary Clinton's email server]. I think you will probably be rewarded mightily by our press."
The article also reviews the evidence pointing to that Russia might be interfering in the election or helping Trump in some way.
All irrelevant. If its the Russian's its tit-for-tat reactions to pressure Russia is experiencing as a result of certain policy choices its made these past years:
https://www.theguardian.com/world/2014/mar/20/obama-extends-...
http://foreignpolicy.com/2014/03/20/u-s-freezes-assets-of-ru...
The story isn't as simple as "Trump is pro-Russian." If that were the case, then Cold War era presidents could be described as Pro-Russian.
Trump hires Manafort because he has Russian ties?
Or
Trump hires Manafort because he's connected to the Republican establishment?
Trump could have any number of choices among the Republican establishment, but he also has a number of business interests in Russia, so a Republican with Russian ties is possibly more attractive to him than a Republican without because he unifies Trump's political and business goals.
This isn't Trump using private information to his personal advantage. This is complicity within the entire Republican Party establishment.
It's more likely that the Republican party itself has ties to Russia. Manafort was probably a compromise between the Republican establishment and the Trump campaign when he won the nomination, seeing as he let Lewandowski go and Manafort was tasked with moderating Trump's image. It also was Manafort who allegedly pressured Trump into supporting Ryan.
Trump is probably not using the Presidency to get preferential business treatment in Russia. There are much much much much easier ways to get edge, even in Russia. If he is, it's a goal that is way out there on the periphery, likely not something on which he would base his choice of campaign chairman.
I think it'd be really interesting to see a neutral comparison of Clinton-Trump-Putin policy positions. IMO, it's not self-evident that Trump, a free market capitalist, would be closer to Putin, a former Soviet operative. I also don't think it's implicit that Putin's policy positions are automatically worth avoiding just because he's associated with them.
Also, even if Trump and Putin have similar beliefs, wouldn't Putin have an interest in putting in the person that is less like him? It seems that Putin's interest would be in a weak United States, which would give Russia more room to re-emerge as a world power. In this case, based on his belief that his policy positions are conducive to the health of a country, Putin would want a dissimilar leader to run the US.
this isn't about ideology. it's Trump and not Clinton who is talking about backing out of NATO.
But I think it is important to note that economic policies are clearly secondary considerations for both Trump and Putin.
One specific policy I think they share is on Syria. I think Trump's current thinking is to back the Assard forces against ISIS (although I'm not entirely sure about that?). This is exactly Putins position: he wants the Mediterranean port Syria gives him, and will make sure Assad stays to keep it.
(To be fair, there aren't really any great choices in Syria anymore, so just because both Trump and Putin make the same one doesn't automatically make it bad. But Assard is a pretty bad guy, even on the scale of middle eastern dictators, so Clinton's choice to insist he leaves power is also a reasonable position)
Syria isn't the same though. It's more like civil war cases like Rwanda or the former Yugoslavia.
If there are external groups trying to influence this election, they are not limited to the Russian government. They aren't even limited to governments.
Russia is just the bogeyman du jour of American news media. Many other more capable enemies are completely unreported.
The bogeyman figure is conveniently utilized to spin many stories. E.g. The DNC hack. In this case it's being used to smear Trump's campaign.
The fact is there no substantial evidence Trump is a Russian sympathizer. There is also no evidence that Russia is a Trump sympathizer.
The US has not changed its foreign policy agenda since WW2. There is beautiful continuity from Truman, to Eisenhower, to Kennedy, to Johnson, to Nixon, to Ford, to Carter, to Reagan, to HW Bush, to Clinton, to Bush, to Obama. It's highly unlikely that the next presidential election will have a noticeable effect on our policy towards Russia.
https://www.wired.com/2016/07/heres-know-russia-dnc-hack/
https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
Maybe Rich wasn't the source, but I don't think it can be reasonably denied that Assange was making some kind of implication there. His motives are undefined.
Since this whole discussion is obviously and thoroughly tainted by personal bias (because the information is so fuzzy that it's just about believing the entities that you trust more), I'll just lay out my cards and say that I don't believe that Russian state actors hacked the DNC (though I'm ready to admit it if real evidence is produced, which I understand is probably not possible).
I think it's a cover story because the powers-that-be don't want the average citizen to know how easy it is to compromise the security of very important institutions, whether they be political organizations or major corporations, lest that citizen decide to take up some targets of their own. I believe the same thing happened with the Sony hack that was blamed on North Korea.
It behooves IDS vendors to make people think that nation-states are regularly trying to invade their systems and it's free publicity to come out and corroborate the mainstream narrative, so they play along/feed into it and say "Yeah it was definitely the Russians even though there's no way we'd actually know that since our software wasn't installed until after-the-fact". This is especially blatant with the follow-on firms that just wanted to cash in on the available PR by saying "uh, yeah, we detected that too".
There is precedent for security vendors falsely claiming that nation states are responsible for some attack when it actually wasn't.
However, in this case top security vendors in direct (and sometimes aggressive competition) with each other are in total agreement, as is every public statement from the intelligence community.
Now, of course, it is in the US government's interest to paint Russia in a bad light, so claims alone aren't enough here. But look at the actual investigative trail ThreatConnect and CrowdStrike presented, and compare it to the past ~5 years of activity from what are almost definitely the same actors, and it's hard to believe they're anything other than a Russia-affiliated group.
That was settled a long time ago by multiple independent, reputable security companies. It doesn't mean they were the source of the leak though.
It is fine if you want to believe their narrative. It was constructed to be believable and at this point it's just an independent judgment call on which sources are credible and which scenario seems more plausible (hacking DNC mail server by a nation-state's cyberwarfare apparatus v. internal whistleblower copying data). No hard feelings.
It is likely that Hillary Clinton will be the next president of the United States. Would it not be valuable for Russia to have knowledge of her party? Do you think the CIA would be interested to have inside knowledge of United Russia?
That kind of information loses most of its value when it is made public. Hence, when an entity with such information releases it, it is usually a safe bet that their goal is to influence public opinion about the party or, if there is information about criminal acts in the information, get someone indicted.
because it's an election year?
It's obvious that Hillary is better for Russia. I think Putin just likes or admires Trump in an entirely personal way. Having Putin all starstruck could be a good thing.
Please save the Donald Trump talking points for a more appropriate forum.
http://www.politifact.com/truth-o-meter/statements/2016/jun/...
Please, continue to assume Putin is a stereotypical cartoon villain. One would think users of a site like HN would have at least passing knowledge of Occam's Razor...
You don't get to the highest levels of power by being a normal person nor by having other people who you like, respect, and admire, particularly not in a country with a long tradition of autocratic rule. I think that people who are assuming Putin is just another old Joe are projecting their own thought processes onto him, which in a way is admirable - I would love to believe the best in people too - but is at odds with both the culture and history of the country he rules and with the workings of power across all cultures.
I mean, these are the guys who used a radiological weapon to kill a dissident in a foreign country. They do not mess around. That must have a chilling effect on companies in or reachable by Russia.
Better to reserve the Russian sympathizer narrative for situations when it would vastly increase readership. A Kaspersky take-down benefits nobody's pocket.
https://news.ycombinator.com/item?id=12290623
https://news.ycombinator.com/item?id=12297530
https://news.ycombinator.com/item?id=12292703
https://news.ycombinator.com/item?id=12300947
HN's moderation practice around this sort of thing is well established: once a major story has had a major thread, the test for new submissions becomes "does this article add significant new information?" If yes, then the post is a new story in its own right and it makes sense to have a new discussion. If not, we treat it as a repost and downweight it.
We came up with this after the Great Snowden Flood of 2013, and it has held up well in practice. It allows for long-running stories to have repeated discussion while protecting the front page from being overwhelmed by follow-up posts that don't add anything new. The latter is important because major stories attract lots of copycat articles.