Ed Snowden Explains Why Hackers Published NSA's Hacking Tools
from the you-break-many-things. dept
Yesterday, the news broke that a "mysterious" hacking group had gotten its hands on some NSA hacking tools and was releasing some of the tools as proof (it was also demanding lots of Bitcoin to reveal more). The leak came with a neat little message that feels like it was written by a Hollywood script writer trying to sound Russian.How much you pay for enemies cyber weapons? Not malware you find in networks. Both sides, RAT + LP, full state sponsor tool set? We find cyber weapons made by creators of stuxnet, duqu, flame. Kaspersky calls Equation Group. We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group. We find many many Equation Group cyber weapons. You see pictures. We give you some Equation Group files free, you see. This is good proof no? You enjoy!!! You break many things. You find many intrusions. You write many words. But not all, we are auction the best files.You break many things indeed! (For what it's worth, it appears that GitHub and Tumblr both killed the accounts where whoever hacked this stuff first posted it).
The files that were leaked were mostly installation scripts, but also exploits designed for specific routers and firewalls. And, it's noted, that some of the tools named line up with previously leaked NSA codenames. One other interesting point from the Motherboard link above: the files are a bit dated:
The most recent file is dated June 2013, though the hackers could have tampered with the dates. Dmitri Alperovitch, the co-founder of security firm CrowdStrike, theorized that “the leakers were probably sitting on this information for years, waiting for the most opportune time to release.”Of course, June 2013 is interesting for another reason. That's when Ed Snowden passed on his documents to a small group of reporters and the very first stories based on the Snowden leaks started. So it seems noteworthy that Snowden has put together a bit of a tweetstorm for his take on the hack and release of the hacking tools. To make it easier to read, we've put it all together here:
The hack of an NSA malware staging server is not unprecedented, but the publication of the take is. Here's what you need to know:Sure, it's speculation, but it's pretty informed speculation and it makes a lot of sense. There's still plenty of talk about what to do about the DNC hack, and we've talked about "cybersecurity firms" (who profit from FUD and scare stories) arguing that we should "declare cyberwar" on Russia based on loose attribution. But, as Snowden notes, this hack and partial release could very well be a warning shot that escalation won't end up looking good for the US if they go that route.
NSA traces and targets malware C2 servers in a practice called Counter Computer Network Exploitation, or CCNE. So do our rivals. NSA is often lurking undetected for years on the C2 and ORBs (proxy hops) of state hackers. This is how we follow their operations. This is how we steal their rivals' hacking tools and reverse-engineer them to create "fingerprints" to help us detect them in the future.
Here's where it gets interesting: the NSA is not made of magic. Our rivals do the same thing to us -- and occasionally succeed. Knowing this, NSA's hackers (TAO) are told not to leave their hack tools ("binaries") on the server after an op. But people get lazy.
What's new? NSA malware staging servers getting hacked by a rival is not new. A rival publicly demonstrating they have done so is.
Why did they do it? No one knows, but I suspect this is more diplomacy than intelligence, related to the escalation around the DNC hack. Circumstantial evidence and conventional wisdom indicates Russian responsibility. Here's why that is significant: This leak is likely a warning that someone can prove US responsibility for any attacks that originated from this malware server. That could have significant foreign policy consequences. Particularly if any of those operations targeted US allies. Particularly if any of those operations targeted elections. Accordingly, this may be an effort to influence the calculus of decision-makers wondering how sharply to respond to the DNC hacks.
TL;DR: This leak looks like a somebody sending a message that an escalation in the attribution game could get messy fast.
Bonus: When I came forward, NSA would have migrated offensive operations to new servers as a precaution - it's cheap and easy. So? So... The undetected hacker squatting on this NSA server lost access in June 2013. Rare public data point on the positive results of the leak.
You're welcome, @NSAGov. Lots of love.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: dnc hack, ed snowden, equation group, hacking tools, malware, nsa, surveillance
Reader Comments
Subscribe: RSS
View by: Time | Thread
Putin says he favors Drumpf.
Ivanka pictured with alleged girlfriend of Putin.
Manafort putting up Putin backed ruler of the Ukraine.
Now this from Snowden.
I feel like like I'm reading a Tom Clancy book.
Have I infringed?!
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
"Putin and Trump: A Love Song - A Poetic Work by Baron von Robber"
[ link to this | view in chronology ]
Re: Re: Re:
Hmm. :)
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Not convinced ES has this correct
[ link to this | view in chronology ]
[ link to this | view in chronology ]
when will we ever learn? when will we ever learn?
[ link to this | view in chronology ]
1 million bitcoins?
Sure, pick up a half a billion in cash from the drawer. No problem.
[ link to this | view in chronology ]
Re: 1 million bitcoins?
But I suspect that they aren't really as interested in selling the stuff as they are in sending a signal that they could sell the stuff.
I agree with Snowden in that the way all this went down only really makes sense if its part of a political play. This is about message more than the actual tools.
[ link to this | view in chronology ]
Is anyone else feeling a twinge of nostalgia ...
[ link to this | view in chronology ]
Spy VS Spy Cartoons
Two criminal organizations, just making sure that both stay within the bounds of their populace fleecing gentleman's agreement, in the only way they know how.
Nothing new to see here folks.
---
[ link to this | view in chronology ]
You break many things. You find many intrusions. You write many words.
It sounds more like the English translations of classic asian martial arts movie dialogue.
[ link to this | view in chronology ]
HACKING TIPS
[ link to this | view in chronology ]