Highlights so far are a 0-day in windows from NT-->2012 which reliably exploits over the SMBv2 port and a bunch of other stuff. (https://twitter.com/hackerfantastic/status/85291588665052774...)
Astounded that it took so long to fix and that it passed on through generations of Windows version.
Almost certain similar can be said of other low level "bugs".
How about OpenSSH or sendmail or Apache httpd (on any UNIX platform) ?
Are you suggesting that other operating systems have better security or just that they're all terrible?
I sure hope you're not suggesting that Linux and its dozens of critical CVEs each year is better.
Clearly you're talking about running the internet on BSDs, right?
ShadowBrokers is releasing these exploits to make a loud noise. FreeBSD exploits probably won't be covered on CNN.
I'm curious what the implication is here. Why would a TOP SECRET power point slide be packaged together with malware on an attack server? It's either really sloppy OPSEC by NSA TAO (or random hired contractor) or may just be a collection of files put together by an intel agency/'criminal' hacker group from various sources to embarrass NSA.
1. Another leaker who isn't Snowden
2. A third party who has gained access to the insides of the NSA
I don't see why we're apparently ignoring 2 in this thread. The Snowden leaks made it very, very clear that essentially nothing is unhackable. And it's not like the USA has a monopoly on hacking skill. What else do we know about the NSA? That they perform the largest WireSharking in history, they literally parse most of the internet with a giant collection of programs which I will assume are written in C or C++ for the sake of performance (though a lot of Perl seems to crop up for analysis purposes too).
What are the chances that the NSA have managed to build a huge network with hugely complex interfacing to the entire internet, and huge amounts of software, without opening themselves up to attack by equally sophisticated attackers? I'd say close to zero.
That's the most obvious one to me. I thought everyone assumed it until I saw some of these comment threads. If it's Russian, it probably goes back to Kaspersky tracking the Equation Group. They put together about everything about how they operated. Giving Russian intelligence this information combined with trip-wires or tip-offs on live activity by NSA hackers would let Russian hackers attempt to own their boxes. They could just work from there.
Alternatively, it could be result of long-running infiltrations that U.S. government has been talking about for decades. At various points, U.S. TLA's said China is throwing piles of spies at us in a numbers game whereas Russia was using (I think it was) 4x more than during height of the Cold War. We also know they're easy to infiltrate and have terrible security since Snowden did and showed exactly that. Plus Manning just pulling everything they had from an Army private's account in Middle East. The leaks could've come from infiltrators, too.
So, we have infiltrators, hackers via Kaspersky data (or similar), or insiders that for whatever reason want to humiliate them. Whatever Shadow Brokers say about themselves is just propaganda. They're one of the above with probably typical motivations of agents in those categories.
Now that we've seen more than just tools and exploits leaked (powerpoints, other documents), that doesn't seem plausible anymore.
Not sure if these are related, but the latest round makes pretty clear that there's been either a new leaker or a serious attack.
The NSA uses Windows like everyone else. There are multiple Windows 0day RCEs in this dump, which may not be all of it by far. All it'd take is to find a single Windows server that isn't properly airgapped - and the NSA TAO can't possibly be airgapped given that its job is to hack people over the internet - and you have a foothold.
The incentives for these intelligence agencies are all wrong and I think even if this particular dump isn't traced to a direct compromise of their network, it's bound to happen eventually. They've been operating on the assumption that all nation states work in secret, so even if they get totally hacked by their adversaries the White House will never find out. However, their chain of command would definitely notice if they stopped sending intercepted intel up to them. This means they're strongly incentivised to horde exploits even if they're sure their enemies know the very same exploits and even if they're sure they can't defend themselves.
The Shadow Brokers appear to have at a stroke invalidated the assumption of universal secrecy. These are people who have access to the NSAs most sensitive internal tools and documents, and are simply ... burning it all.
Bingo! Well, a mix of Windows, Linux (esp Red Hat), and Solaris (optionally with trusted extensions). All low-assurance operating systems with history of 0-days plus current ones for at least Windows and Linux. It's not like they didn't know it was coming. High-assurance field, including pioneers in INFOSEC, warned them over and over.
Bad news is they have methods today that work better that they could build on. They recently canceled them in favor of a new program with something like a 90-day evaluation. Something short. I remember reading the protection profiles to find the assurance argument required is EAL1: one so low we thought they'd cancel it. Things will only get worse.
we are already aware of a guy who was arrested for having terabytes of classified info, who worked for TAO. i'm not sure how it would have gotten from martin to the (presumably russian) shadow brokers -- maybe he was paid, maybe he was hacked -- but it doesn't seem like a staggering leap to make.
certain politicians aside, exposing TS networks to the internet is not only difficult inside an organization that 'lives in the dark', it will get you severely reprimanded if not fired from your very well paying job, and possibly scuttle your ability to remain cleared and continue your career. classified networks are designed from above so that as much as possible this isn't an issue, and i'm certain it's only intensified since snowden.
i'm not saying by any means it's an impossibility that they were hacked, but i don't see any reason at all to favor that conclusion. like i said, martin worked for TAO, the source of everything the shadow brokers have released. why would you come to the conclusion that they were hacked vs an already known, very likely source candidate?
It would be insiders who oppose what's going on Snowden-style or plants from a foreign, intelligence service.
That was an interesting error already, but this implies either a ludicrous screwup (how would you even package those together?) or some much deeper compromise.
Bitcoin being a sewer rat, and the banking system being a bubble boy, I knew a day would come when the bubble boy would be exposed to something bitcoin had grown immune to, get sick, and possibly die. I didn't know his protective bubble was already gone. I thought these banks all communicated on leased lines and weren't exposed to the public internet.
Is there any indication that a criminal hacker gang couldn't have compromised this or other SWIFT service bureau's or banks in a similar manner?
Which fiat bank will be the first Mt Gox?
I don't know where this myth is coming from that Bitcoin is immune to state-level actors. If a relatively large government really wanted to manipulate the Bitcoin network, they could either just buy some thousand Bitcoin and spam the network with transactions or buy enough hardware to get over 50% hashing power. Especially China only needs to take down the 2 or 3 top miners and can cut the mining power in half within a day.
Bitcoin is simply not interesting enough at the moment to get manipulated by state-level actors. But that doesn't mean that it's impossible, regardless what Bitcoin advocates want you to believe.
What if they created Bitcoin?
We've all read about the CIA running drugs to raise cash for black ops... why not take it a step further and create your own currency?
My personal theory is it was an intel agency, or a criminal group.
Keep in mind Truecrypt was also written by criminals: https://magazine.atavist.com/he-always-had-a-dark-side
Currently there is no power to be gained in wiping out bitcoin when half of the constituents have never even heard of it. Never mind the cost.
I would assume the only reason we haven't done it has nothing to do with the cost, its simply that bitcoin is just not interesting enough to them (yet). I can't imagine that some USGOV and probably >1 non-us-gov have plans already and could rapidly build out an ASIC farm, if asked to do so (and funded, of course).
China's legal system already contains provisions which could be summarized as "all your data belongs to us".
Marginal loss on each transaction + "spamming transactions" = essentially paying people to run their machines at 100% for a while for you, which to the tune of "some thousand bitcoin" would be money to their ears
> just [..] buy enough hardware to get over 50% hashing power
> Especially China only needs to take down the 2 or 3 top miners and can cut the mining power in half within a day
If that is true (and I'm not convinced that it is) you don't think those '2 or 3' entities aren't large and financially self-interested enough to work to secure themselves, divest their resources, or so on?
I highly doubt any sort of subversive action could be taken sub-rosa to the tune of 51% of a network of paraniod individuals who'd either fork or move out given any whiff of subversion, especially by state actors.
If the network is unusable for 6 months or so because confirmations take dozens of blocks or need very high fees, what do you think would happen? Everybody just waits for it to blow over and continues like nothing happened? The costs don't matter if the control over the monetary system is at stake. Defend now or the $/€/¥/£/etc will lose value anyways. Not that I expect it to come this far but don't underestimate the monetary power of large states. Bitcoins often quoted market cap is only a very, very small blip on their radar right now.
Okay, you are right. They would most likely confiscate the miners' hardware and will mine with that. So they kill two birds with one stone.
> If that is true (and I'm not convinced that it is) you don't think those '2 or 3' entities aren't large and financially self-interested enough to work to secure themselves, divest their resources, or so on?
China regularly takes down party members for "corruption" (more likely not enough corruption). So if not even party members are safe, how could anybody be safe that threatens the power of the whole government?
The anarcho-capitalists who think that Bitcoin exists outside of government control and will be able to replace national currencies are wrong. China can at any point order the top miners to shut down their pools. Bitcoin is simply not relevant enough to be attacked by more than the local police that is underfunded for those endeavors anyways.
Always remember this old XKCD: https://xkcd.com/538/
If there is X hashing power and you need X/2 to control the network, then reducing X by 50% means that you only need X*0,5/2 to control the network.
The difficulty is only adapted every 2010 blocks which equals around 2 weeks but if you suddenly cut the hashing power in half, this will take up to around 4 weeks and slow the network down immensely.
Double entry accounting, auditing, charge backs and correction protocols are all normal, standard and expected in even the smallest credit unions and the amount of dollars spent on these things at the larger financial institutions is staggering. That is essentially the job of a bank. To back stop that we have insurance and regulatory bodies working to prevent and mitigate losses. Again, this is normal and expected.
The thing those of us who have worked in banks find so funny about Bitcoin isn't that it solves some issues that banks don't know about or does something clever. Its how unprofessional the whole thing is. It doesn't account for hardly any of the real world problems of the banking system.
> Which fiat bank will be the first Mt Gox?
Depends on what you mean? A bank that is brought down by theft by its employees? That was such a big problem in the early banking world that banks competed on the edifices and security theater to prove it didn't happen at their bank...150 years ago or more.
My quick skim shows they're gaining information about transactions in Middle East and Panama. One is essentially a hotbed of competing interests among imperialists and terrorism. The U.S. invaded two countries over there. There's proxy war going on in another. Far as Panama, it's one of leading spots for rich people, threatening or just tax-dodging, to set up offshore accounts, companies, and so on. They use it to hide their transactions. FinCEN has been fighting for access to tax haven data for years. No surprise NSA is monitoring illegal, money moving given targets of interests might be involved in it in that specific place.
My comment was about the security house of cards surrounding the fiat banking system.
Even if they made it illegal, I still wouldn't trust them as they'd try to do something to get an edge on negotiations. That something would be illegal activity they outsourced to mercenary organizations or partnered with nations with spy organizations with some benefit promised back to them. For example, nearly all of Europe has intelligence sharing agreements per Snowden leaks with the very agency (NSA) they're publicly griping about. Only 3 didn't in whatever deal that was: Switzerland, Iceland, and one other I can't remember.
The point of the banking system is not necessarily high security, it's the legal frameworks and process flexibility to identify and prosecute fraud and reverse the effect of fraud of detected in time
This dump is a few years old. Seems very believable that the NSA compromised their network before 2013 in the way the slides suggest. Plus if their "internal Security Unit" was worth a damn they would have known about this already, rather than finding out about it from this dump.
Overall that press release is a little embarrassing, and screams to the tech illiteracy of their senior management. Nobody would publish a press release like this so quickly if they understood the problem scopes in play here (e.g. their Cisco firewalls themselves could have implants!).
We've also known since last year that at least three separate hacks by three separate thieves stole millions of dollars from multiple banks after compromising the SWIFT network.
All 11,000 financial institutions connected to the network should just switch to sending their 15 million messages per day using iPhones. Problem solved.
iPhones are in U.S. jurisdiction. That's a bad idea. Instead, they should send P2P or through SWIFT-like intermediary with signed messages GPG-style over TLS-style links via dedicated lines or Internet lines with high-speed port knocking. It all can be done with highly-secure tech. The tech for bottom of stack from secure CPU's to secure kernels even exists already. SWIFT or some other setup just has to buy it with that pile of money they have.
Windows Embedded 2009 (based on XP) is receiving security updates until 2019.
So, I still don't trust them. This looks like the same shit management in banking and "security" industries come up with all the time. You know, the stuff used in dozens of companies that got bypassed by so-called "APT's" that sent emails with infected PDF's and Excel documents. Really "advanced" attacks it takes. Haha. Trick is, you need both the security features and assurance they're secure. Most of industry focuses on former where my type focuses on latter as much as possible. ;)
Microsoft's PAW definition covers related topics, https://technet.microsoft.com/en-us/windows-server-docs/secu...
" The I/O Controller runs an isolated instance of Security
Enhanced Linux and has a separate TPM for measurements and identity anchoring."
Yeah, that's not trustworthy. It might get attacked less than competing systems but SELinux isn't a good TCB. The NSA themselves rate it like most of the rest at EAL4+: resistant to "inadvertant" or "casual" attempts to breach security. You want that trusted component to be running something stronger, preferably with low odds of 0-days. A minimal version of OpenBSD is a cheap start as their networking and Ethernet stacks probably had most review. Next best is a separation kernel enforcing policy with small TCB & user-mode stacks. There's commercial ones they can buy or FOSS ones to build on. Memory-safe language like Ada/SPARK or Rust for their trusted code. Paid or FOSS options for that, too.
The point being the hackers are going to look for ways to send in malicious data or cause unusual executions to get code into memory. Whatever they're using should stop that or isolate the damage with high confidence. Most don't, though. Even well-thought ones like this product.
EDIT: Thanks for the tip-off, though, as I occasionally send recommendations to security vendors. Might email them or use them as an example for high-security people of what kind of thing to build or market.
Back then SWIFT had two processing centers, one in EU and one in US. Traffic was replicated to both for resiliency. Later they opened up a new center in Switzerland to be able to keep European data in Europe.
Cloudflare leak in Feb... sounded like the world was ending here.
The freakout wasn't due to the incident itself (although obviously everyone was unimpressed the leak happened), it was the fallout: the leaked data was archived in various caches. Google's indexes of the web are the biggest.
Hate to break the news to you about the new administration...
 "Please resist commenting about being downvoted. It never does any good, and it makes boring reading."
Not really. SWIFT maintains multiple datacenters outside the US so that transactions between 2 non-US actors don't touch US-based computers and are therefore not (easily, officially) accessible by the US government.