New Leak May Show If You Were Hacked By The NSA

Above Photo: From arstechnica.com

Shadow Brokers—the name used by a person or group that created seismic waves in August when it published some of the National Security Agency’s most elite hacking tools—is back with a new leak that the group says reveals hundreds of organizations targeted by the NSA over more than a decade.

“TheShadowBrokers is having special trick or treat for Amerikanskis tonight,” said the Monday morning post, which was signed by the same encryption key used in the August posts. “Many missions into your networks is/was coming from these ip addresses.”

Monday’s leak came as former NSA contractor Harold Thomas Martin III remains in federal custody on charges that he hoarded an astounding 50 terabytes of data in his suburban Maryland home. Much of the data included highly classified information such as the names of US intelligence officers and highly sensitive methods behind intelligence operations. Martin came to the attention of investigators looking into the Shadow Brokers’ August leak. Anonymous people with knowledge of the investigation say they don’t know what connection, if any, Martin has to the group or the leaks.

Equation Group was originally a name researchers from Moscow-based Kaspersky Lab gave to an elite team of NSA-tied hackers who exploited some of the same then-unknown Windows flaws later targeted by the Stuxnet worm that attacked Iran’s nuclear program. The group operated undetected for more than 14 years until Kaspersky researchers brought it to light. The researchers dubbed it “Equation Group,” but there’s no evidence that was the name anyone inside the group used. The people penning posts accompanying the leaks that started in August then used the Equation Group name when identifying the elite team the data and tools allegedly belonged to.

According to analyses from researchers here and here, Monday’s dump contains 352 distinct IP addresses and 306 domain names that purportedly have been hacked by the NSA. The timestamps included in the leak indicate that the servers were targeted between August 22, 2000 and August 18, 2010. The addresses include 32 .edu domains and nine .gov domains. In all, the targets were located in 49 countries, with the top 10 being China, Japan, Korea, Spain, Germany, India, Taiwan, Mexico, Italy, and Russia. Vitali Kremez, a senior intelligence analyst at security firm Flashpoint, also provides useful analysis here.

The dump also includes various other pieces of data. Chief among them are configuration settings for an as-yet unknown toolkit used to hack servers running Unix operating systems. If valid, the list could be used by various organizations to uncover a decade’s worth of attacks that until recently were closely guarded secrets. According to this spreadsheet, the servers were mostly running Solaris, an operating system from Sun Microsystems that was widely used in the early 2000s. Linux and FreeBSD are also shown.

“If this data is believed then it may contain a list of computers which were targeted during this time period,” the analysis provided by Hacker House, a firm that offers various security services, stated. “A brief Shodan scan of these hosts indicate that some of the affected hosts are still active and running the identified software. These hosts may still contain forensic artifacts of the Equation Group APT group and should be subject to incident response handling procedures.”

The domains and IP addresses purportedly belong to organizations that were hacked by the NSA. But according to Monday’s Shadow Brokers post, once they were compromised, some of them may have been used to attack other NSA targets. If true, the list could help other organizations determine who may have been behind suspicious interactions they had with the listed servers. The possibility that some of hacked servers were used to attack other sites were raised by the discussion of a tool called pitchimpair, which the authors claimed is a “redirector.” Typically, redirectors are used to surreptitiously direct someone from one domain to another.

Other purported NSA tools discussed in Monday’s dump have names including DEWDROP, INCISION, JACKLADDER, ORANGUTAN, PATCHICILLIN, RETICULUM, SIDETRACK, AND STOCSURGEON. Little is immediately known about the tools, but the specter that they may be implants or exploits belonging to the NSA is understandably generating intrigue in both security and intelligence circles.