Untangling the NSA's latest alleged embarrassment

Last week, security researcher Mikko Hypponen found a notice on Github from an entity called Shadow Brokers, a reference to master of the galactic black market for information in the game Mass Effect. The notice was for an auction of exploits from the Equation Group (widely believed to be operated by the NSA).

The Github auction included two files. One was free and open for examination. The other, Shadow Brokers said, was for "the party which sends most bitcoins" to their payment address and who would then get the decryption information. The free samples showed that the exploits were quite real, and alarmingly powerful.

The free samples also helped researchers figure out that the exploits had been snatched from an external staging server and not the NSA itself, as many headlines this week incorrectly suggested... in a breach that happened three years ago. See, there's nothing in the dump was newer than October, 2013.

Of course, the press is having its usual, confused feeding frenzy about anything and everything hacking and infosec, leading most people to believe that the NSA itself had actually been hacked. Well, the NSA has not been hacked; the New York Times headline asking if the NSA has been hacked and the Atlantic's stupid "Yup! The NSA Got Hacked" are as egregiously irresponsible as they are uninformed.

Think of it like this: Your local Safeway uses a separate company to buy beer for its store. That buyer "stages" some of Safeway's beer in a storage unit, which is robbed. Only the storage unit was burgled -- but the newspapers are saying that Safeway was robbed, making everyone think the Safeway store was broken into and its security compromised.

Although, there is one thing here: This might solidify a link between Equation Group and NSA: The Washington Post confirmed the authenticity of the tools with two anonymous ex-NSA employees.

The auction page had been sitting there for two days before Hypponen tweeted his discovery. It has since has been removed by Github, as well as Pastebin and Tumblr.

It read, in part:

Shadow Brokers added, "If our auction raises 1,000,000 (million) btc total, then we dump more Equation Group files, same quality, unencrypted, for free, to everyone."

Unfortunately for Shadow Brokers, the auction hasn't exactly been a hit. Losing bidders don't get their money back, and the kitty is only up to 1.5 BTC ($862).

Alex Rice, CTO at bug bounty platform HackerOne, told CSO Online that Shadow Brokers had given a fortune in 0day away for free in that sample file. The exploits could've sold for "north of six figures" each on the grey market to governments (Hacking Team, for example, was a grey market operator). In an incredibly detailed post, Risk Based Security thought the pilfered attacks would've pulled in between $200,000 and a million dollars -- and that's if they'd sold the booty to "good guy" bug bounty buyers.

At Lawfare, Nicholas Weaver explained that the freebie file included eight different exploits and some dead-serious implants that circumvent firewalls, among other things. He also said that the exploits "appear to target Fortinet, Cisco, Shaanxi Networkcloud Information Technology (sxnc.com.cn) Firewalls, and similar network security systems."

The fact that this is all from 2013, which continues to get overlooked in reporting and armchair-activist hysteria alike, is important. This week's headlines saying "oh noes the bad tools are being used now" are bit hyperbolic in light of the fact that these tools are three years old and have likely been used "in the wild" (to a very limited extent) since.

Some of my colleagues in the press are falling all over themselves with another genuine NSA-whodunnit on their hands. So, who is the culprit? Lawfare had three great, rational, sensible, and far-too-practical-for-CNN answers to the question:

While the sideshows of conspiracy theories and government hyperbole spin-up, Risk Based Security wrote an extremely grounded post. It included this salient section about the timing of it all:

Of course, Edward Snowden struck a few suggestive poses on Twitter while confirming the validity of the finds (hey, it's a living). The sycophantic elite cooed; The Intercept released code from deep in their years-old and coveted treasure trove of Snowden files that matched a couple exploits in the dump.

The Intercept triggered another simultaneous release -- of public anger at the organization's hoarding of critical information on tracking malware strains.

Hacker Matt Suiche has a great post with an ex-NSA analyst, who had many great points, including this one:

And that's a much needed dose of common sense in this whole NSA circus revival.