![\"NSA-HQ-Day\"](\"https:\/\/solutionsreview.com\/endpoint-security\/files\/2016\/08\/NSA-HQ-Day.jpg\")
The NSA has been hacked\u2014 or at least that\u2019s what an anonymous hacker group is claiming.<\/p>\nThe NSA has been hacked\u2014 or at least that\u2019s what an anonymous hacker group is claiming.<\/p>\n
The news made headlines this week, but not without sparking massive controversy\u00a0in the #InfoSec world. Here’s the who, what, and why of what went down:<\/p>\n
What Happened?<\/strong><\/p>\n On August 15th, an anonymous hacker group calling itself ShadowBrokers posted a cache of so-called \u201ccyberweapons\u201d that it claims to have obtained by hacking an NSA-linked cyber-espionage team known as the Equation Group. In a statement posted on a Tumblr page, which has since been removed, ShadowBrokers offered to sell off those \u201ccyberweapons\u201d in a bitcoin auction to the highest bidder. As proof, the ShadowBrokers released an unencrypted sample with 300 megabytes worth of exploits designed to target various networking appliances from companies like Cisco and Fortinet.<\/p>\n Though some experts and pundits initially doubted the validity of the ShadowBrokers\u2019 claims, The Intercept<\/a><\/em> has reported that previously unpublished documents leaked by NSA-whistleblower Edward Snowden confirm that \u201cthe malware is covered with the NSA\u2019s virtual fingerprints and clearly originates from the agency.\u201d<\/p>\n So far it\u2019s not fully known what the ShadowBroker group has access to, but Cybersecurity firm Kaspersky has tackled the known quantities with a detailed breakdown of the \u201cEquation Giveaway.\u201d<\/a><\/p>\n Who are The Equation Group?<\/strong><\/p>\n The Equation Group is a hacking team that many believe to be a part of the NSA’s Tailored Access Operations (TAO) unit, a cyber-warfare intelligence-gathering unit.<\/p>\n Equation Group was first discovered in 2015 by researchers at Kaspersky Labs, who claim to have found evidence that the group has been active since at least 2001, with more than 60 different actors involved. Kaspersky Labs disclosed their discovery at the 2015 Kaspersky Security Analysts Summit, calling the Equation Group “one of the most sophisticated cyber attack groups in the world.”<\/p>\n Who are The ShadowBrokers?<\/strong><\/p>\n Nobody knows for sure who the ShadowBrokers are, but there are a few educated guesses being thrown out there, with most fingers firmly pointed at Russia, as usual.<\/p>\n For his part, Edward Snowden sent out a barrage of tweets<\/a> stating that he believes the stolen files are genuinely NSA tools, and that \u201ccircumstantial evidence and conventional wisdom indicates Russian responsibility.\u201d<\/p>\n However, other experts have claimed<\/a> that the leak more likely points to a \u201csecond Snowden\u201d at the NSA, aka and insider, who leaked the exploits, possibly for personal profit.<\/p>\n In an article for Reuters<\/a> posted Monday, long-time NSA reporter James Bamfield wrote that \u201cRather than the NSA hacking tools being snatched as a result of a sophisticated cyber operation by Russia or some other nation, it seems more likely that an employee stole them.\u201d Bamfield claims that Russia would not have exposed the vulnerabilities\u00a0because doing so makes the worthless as affected companies scramble to patch their vulnerabilities.<\/p>\n In an article<\/a> that appears to give some credence to Bamfield’s claims, linguistics expert Shlomo Argamon has claimed that ShadowBroker is a native English speaker masquerading as a non-English speaker.<\/p>\n “The texts contain a variety of different grammatical errors that are not usual in the English of US native speakers,” Argamon says in his\u00a0analysis, suggesting that the ShadowBrokers used these mistakes to cast suspicion on foreign nationals such as the Chinese or Russians.<\/p>\n “While no one of these factors is dispositive, the cumulative effect of these multiple lines of evidence leads to the conclusion that the author is most likely a native speaker of US English who is attempting to sound like a non-native speaker by inserting a variety of random grammatical errors.”<\/p>\n Who\u2019s affected?<\/strong><\/p>\n So who exactly is affected by the NSA tools exposed in the ShadowBrokers\u2019 data dump? So far, it seems that mostly networking appliances from companies such as Cisco and Fortinet were targeted by the NSA\u2019s exploits.<\/p>\n Both Cisco and Fortinet immediately issued warnings about vulnerabilities revealed in the data dump, and both companies quickly moved to patch the vulnerabilities, but some experts<\/a> are now saying that the exploits affect more machines than previously thought.<\/p>\n Many pundits have used the hack as damning evidence against the NSA. In a blog post<\/a> published on Vox.com, cyber security expert and cryptographer Bruce\u00a0Schneier<\/a> writes: “The National Security Agency is lying to us. We know that because of data stolen from an NSA server was dumped on the internet. The agency is hoarding information about security vulnerabilities in the products you use, because it wants to use it to hack others’ computers. Those vulnerabilities aren’t being reported, and aren’t getting fixed, making your computers and networks unsafe.”<\/p>\n Damning indeed. But as others have pointed out<\/a>. the NSA was just doing its job\u2014stealing and making sense of other people\u2019s information. Pentesting for Cisco is not the mission.<\/p>\n Where to from here?<\/strong><\/p>\n In many ways, the outcome of these events depends on two things: the veracity of The ShadowBroker’s claims, and who wins the auction.<\/p>\n Any\u00a0auction or leak of further data could have serious consequences for the security world, not least of all for many major corporate and government \u00a0networks dependent on compromised systems. If a malicious actor wins the auction, the results could be disastrous. If the NSA or another government entity is able to win the auction and retain the data, we could return to status quo, though the genie is out of the bottle. In any case, it’s unlikely that the hackers would disclose the winners of such an auction.<\/p>\n One thing is certain: we’ll be hearing a lot more about this breach\u2014from politicians and security pundits alike.<\/p>\n Compare Top Endpoint Security Providers with the 2016 Endpoint Security Buyer\u2019s Guide.<\/a><\/p>\n Now watch this:<\/strong><\/p>\n![\"Endpoint_Buyers_Guide_No_DL\"](\"https:\/\/solutionsreview.com\/endpoint-security\/files\/2016\/04\/Endpoint_Buyers_Guide_No_DL-150x150.png\")
<\/a>Don’t Get Hacked.\u00a0<\/strong><\/p>\n\n