Former NSA security scientist concurs exposure by “Equation Group” connected to DNC leak. Two former employees of the National Security Agency—including exiled whistleblower Edward Snowden—are speculating that Monday’s leak of what are now confirmed to be advanced hacking tools belonging to the US government is connected to the separate high-profile hacks and subsequent leaks of two Democratic groups.
Private security firms brought in to investigate the breach of the Democratic National Committee and a separate hack of the Democratic Congressional Campaign Committee have said that the software left behind implicates hackers tied to the Russian government. US intelligence officials have privately said they, too, have high confidence of Russian government involvement.
In the weeks following the reports, WikiLeaks and an unknown person using the moniker Guccifer 2.0 have published a steady stream of documents. One batch released just ahead of last month’s Democratic National Convention contained embarrassing private conversations that led to the resignation of DNC Chair Debra Wasserman Schultz. A more recent installment included a spreadsheet detailing the cell phone numbers, e-mail addresses, and other personal information of every Democratic member of the House of Representatives. The Obama administration has signaled that it may impose new economic sanctions on Russia in response to what critics claim is Russian attempts to disrupt or influence the US presidential election.
“More diplomacy than intelligence”
Both Snowden and Dave Aitel, an offensive security expert who spent six years as an NSA security scientist, are speculating that Monday’s leak by a group calling itself Shadow Brokers is in response to growing tensions between the US and Russia over the hacks on the Democratic groups. As this post was being prepared, researchers with Kaspersky Lab confirmed that the tools belong to Equation Group, one of the most sophisticated hacking groups they’ve ever investigated. Ars will have more on this development in an upcoming story.
“Why did they do it?” Snowden wrote in a series of tweets early Tuesday morning. “No one knows, but I suspect this is more diplomacy than intelligence, related to the escalation around the DNC hack.”
In the same tweet stream, Snowden continued:
Circumstantial evidence and conventional wisdom indicates Russian responsibility. Here’s why that is significant: This leak is likely a warning that someone can prove US responsibility for any attacks that originated from this malware server. That could have significant foreign policy consequences. Particularly if any of those operations targeted US allies. Particularly if any of those operations targeted elections. Accordingly, this may be an effort to influence the calculus of decision-makers wondering how sharply to respond to the DNC hacks. TL;DR: This leak looks like a somebody sending a message that an escalation in the attribution game could get messy fast.
In a brief post of his own, Aitel agreed that Russia is the most likely suspect behind both the Democratic hacks and the leaking of the NSA spying tools. He also said the NSA data was likely obtained by someone with physical access to an NSA secure area who managed to walk out with a USB stick loaded with secrets. Aitel cited the following support:
Timing: Seems almost certain to be related to the DNC hacks. High level US political officials seemed quite upset about the DNC hacks, which no doubt resulted in a covert response, which this is then likely a counter-response to. As Snowden put it: Somebody is sending a message that they know about USG efforts to influence elections and governments via cyber.
Mention of corruption and elections in the text of the release feels classically Russian.
Ability to keep something this big quiet for three years (leak is just post-Snowden) is probably limited to only those with operational security expertise or desire to leverage those bugs for themselves.
Information results from HUMINT, not simple hack of a C2 box as suggested (not that even that would be easy). Level of difficulty: Very Experienced Nation State.
Alternate possibility: someone was sitting on a redirector box and the most incompetent person on Earth uploaded this ops disk to it to make their lives easy. Still means someone was hiding on this box who knows what they’re doing in an unusually skilled way.
No team of “hackers” would want to piss off Equation Group this much. That’s the kind of cojones that only come from having a nation state protecting you.
Wikileaks also has the data (they claim).
As noted throughout this post, attributing Internet hacks is a difficult undertaking that’s often prone to error. In the interest of keeping readers apprised of what informed security experts are saying, Ars is providing these opinions as is, with the reminder that they’re pure speculation.
Source:https://arstechnica.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
