Shadow brokers dump more NSA data
medium.com
medium.com
Any idea what this is ?
Edit: this article [1] provides more information stating that the list is the NSA's list of staging servers, compromised machines that they use to launch attacks from. Apparently the list is 9 years old.
[1]: http://www.networkworld.com/article/3137065/security/shadow-...
After googling parts of the file, I found a news report that claims they actually put some of the addresses there in SHODAN and actually did get into machines actually infected with NSA cyberwarfare software.
Assuming it's real, and not someone "framing" the US by releasing a list of their own relays.
edit: Posted at same time as speeder, what he said.
Try imagining yourself as a young sysadmin who stumbled across an entire dump of Equation Group while investigating an infection. You realize the value of such a thing, but have no underground contacts to use to fence it. You can't walk into a Chinese embassy and try to sell it, they might kill or report you. So now you have to try to get rid of the thing and maximize your return while not sacrificing complete anonymity. You don't want NSA on your ass for the rest of your life. How would you proceed?
The messages are getting a bit more desperate. They went from the $1,000,000BTC in the first message (which SB says was interpreted incorrectly), to a public release if 10,000BTC was crowdfunded, and now they want a cool $million.
One of the Q&A questions answers the "why trust us to deliver?" argument. They say this is about reputation. No delivery=no reputation. Imagine the kind of deals SB could make in the future with SB PGP key signing stuff if they delivered on this transaction. You would catapult yourself to the worlds most famous cyber arms dealer in one day.
Reminds me a bit of Trainspotters or the guy in Neuromancer who steals the mechanical talking head and fences it to The Finn. People who come across extremely valuable items with no way to easily sell. It rarely ends well.
Of course this could be all misdirection, but I'm leaning towards the much more interesting notion that this is legit. I just hope we hear about how it ends. It would be pretty boring if they quietly sold the data to some foreign service and we never learned anything more about one of the most interesting chapters in recent cyber warfare history.
wow I did not know they have a sense of humor
looks like they have a good grip on 20th century vernacular English satire
It is really hard to do that manually
Yes, it apparently is, we have a lot of personal tells.
My idiot buzzer went off at the start, but by this time it had melted the resin casing. There's nothing of value in that blog post, not even analysis or interesting ideas.
-thegrugq
They may not actually be native English speakers, but it would be hard to tell because the affected, consciously bad English overrides unconsciously bad English. I suppose maybe a linguist could comb through it all for subtler stuff like sentence structure.
"Amerikanskis" alone is a pretty serious tip-off. "amerìkānskī" comes up as a Cyrillic adjective for American-style, but I can't find any non-parody instances of people converting it into a pseudo-English noun.
A Russian wouldn't use "Amerikanski" as a pejorative, we have "pindosy" for that. And we'd never use "SCOTUS", for variety of reasons.
This styling looks intentional to me, and doesn't seem to be Russian.
It's not the first use of the word, but all of the other examples I can find are very similar English-language jokes/insults.
So a Russian with a deep background in linguistics intentionally bastardized something so it looks like an English speaker trying to sound Russian. Clever.
An actual English speaker wouldn't even know the root word existed.
So, for many small Russian cats, we have the following:
'Kitten' -> 'Kittenski' -> 'Kittenskis'
1. https://en.wiktionary.org/wiki/-ski
2. http://www.campaignlive.co.uk/article/170244/nestle-comes-faux-russian-relaunches-ski
3. https://en.wikipedia.org/wiki/Eye_dialectWell, then I suppose that, if they are Russian, they are doing a great work.
> How bad do you want it to get? When you are ready to make the bleeding stop, payus, so we can move onto the next game. The game where you try to catch us cashing out! Swag us out!
it sounds intentional. "Swag us out" is pretty colloquial.
It's clever because someone will not usually be writing in this manner. The only good identifiers are "Amerikanskis" and "USSA" which could unintentionally slip into conversation on Facebook or Twitter and which are unique enough.
'amerìkānskī' is an existing word, but it's an adjective describing American-style things. Converting it (via English rules) into a mocking noun for Americans appears novel, and I can only find a few instances of people using it as a joke on forum threads.
Plenty unique, then, but not something the writer would likely stumble into using ever again.
s03.informatik.uni-bremin.de -> uni-bremen
I've seen boxes inside organizations where the orgs own domain was typoed.
Heh, must be fun to be able to own any auto-updating Huawei device.
eg: toddandclair Premise connection is deemed obviously a misdirect, yet Guccifer 2.0's blatantly Soviet era metadata and Cyrillic type is not? I mean, if anything, at least with the Premise connection, they made it 'seem' like a mistake.
And the phishing email in Podesta's inbox, when multiple people already had his password/access to his inbox. So the conclusion is it was the Russians that leaked? Wouldn't it make sense to use Podesta's emails to increase the attack surface size for more targets?? Why would you want to relinquish that access when there was a good chance Hillary would get into power? And then all these other people with access, why couldn't they have leaked it? Hillary's campaign's attrition rate and cynicism was high even within ring of closest advisers. All you have to do is read the human side of the emails to know there are many, many, many, much more likely sources for the leak.
Imagine you're working in IT or InfoSec for the Russian (or any other state/national) government. You see attacks coming in from IP addresses in another country -- maybe they were successful and you're investigating a compromised host. You find these IP addresses in the logs, do some investigating and find the host that attacked you is running a vulnerable version of sendmail (for example). So you compromise the host as well and, once you get in, you find the previously released exploits and such sitting in a user's home directory.
I don't think this scenario is that outlandish.
Or there's this hypothesis: http://arstechnica.com/security/2016/08/hints-suggest-an-ins...
Which makes a hell of a lot more sense than assuming any of the aforementioned (not least any of the smaller subset of said unlikely scenarios leading to PUTIN).
Most of the discussion seems to follow the track of "this is a state actor burning old TAO information to embarrass and send a message to the US". The ludicrous aspects of it ('Shadow Brokers', fake accent, scam auction) amount to some plausible deniability and not much else. So there might be the pattern you're mentioning, but it hardly applies in this case because this isn't even meant to pass as real vigilantism.
https://www.theguardian.com/world/2016/oct/26/kremlin-puppet...
https://en.wikipedia.org/wiki/Vladislav_Surkov#Personal_advi...