{"id":7297,"date":"2017-04-10T10:10:15","date_gmt":"2017-04-10T18:10:15","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/04\/10\/news-1088\/"},"modified":"2017-04-10T10:10:15","modified_gmt":"2017-04-10T18:10:15","slug":"news-1088","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/04\/10\/news-1088\/","title":{"rendered":"ShadowBrokers fails to collect 1M bitcoins \u2013 releases stolen information"},"content":{"rendered":"

Credit to Author: Adam McNeil| Date: Mon, 10 Apr 2017 17:49:20 +0000<\/strong><\/p>\n

ShadowBrokers finally made good on their promise to release the decryption key to unlock the stolen ‘auction’ file purportedly filled with NSA hacking tools.<\/p>\n

Over the weekend, the hacking group ShadowBrokers released the decryption key for the \u2018auction\u2019 file that was included in the dump of information from last summer that the group claimed they acquired<\/em> from Equation Group \u2013 reportedly a well-known hacking team responsible for highly sophisticated malware campaigns such as Flame and Stuxnet and possibly associated with certain 3-letter government agencies.<\/p>\n

While the group\u2019s get-rich-quick<\/em> plan to sell the auction file for the astronomical asking price of 1M bitcoins (roughly $1,186,510,000.00 US Dollar as of today) may have ended with spectacular failure, the team has made good on their promise to ultimately release the stolen information should the requested payoff not be received. It\u2019s difficult, if not impossible for us to verify the claims from the hackers or to place attribution to the appropriate group, but there are interesting bits of information contained within the archive and we will document some of the early discoveries here.<\/p>\n

The release of the key came in a highly politicized tirade directed to President Donald Trump touching on everything from Obamacare and Goldman Sachs, to Syria, Steven Bannon, and John McCain. The epic rant discusses the Alien and Sedition Act of 1798, Social Collectivism, White Privilege, Russia, and even Magog (I had to look it up too.<\/em>\u00a0It seems most applicable to the Islam interpretation of the word. Courtesy of Wikipedia<\/a><\/em>). For the inference of being American citizens and in the eyes of any High School English teacher, it\u2019s a cringe-worthy read<\/a> filled with grammatical, spelling, and punctuation errors (although,\u00a0good use of the Oxford comma<\/em>), and seems to use a variety of written dialects and cultural references throughout. All of which appear to be deliberate false-flags to help conceal the identity of the person\/group associated with the original attack.<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Exploits<\/h3>\n

There are a number of tools in the dump with notes and code that indicate possible exploits against various software and products. A majority of the files seem to target Linux and Solaris-based servers. Though many of the exploits are dated from many years ago, some as far back as 2003, it\u2019s possible they are still usable on legacy systems. While we can\u2019t confirm the authenticity of the following exploits, we will provide a small snippet from the collection below.<\/p>\n

ElatedMonkey<\/em> is a local privilege escalation exploit against the cPanel Remote Management Web interface current through at least version 24:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

ElginGamble<\/em> is a \u2018public\u2019 vulnerability affecting Linux 2.6.13 \u2013 2.6.17.4 to create a cron script capable of spawning a root shell:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

PTrace\/ForkPTY<\/em> is a kernel exploit affecting Linux 2.2 \u2013 2.4:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

EngageNaughty<\/em> is an Apache and SSL exploit:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

EasyStreet<\/em> appears to be some sort of UDP exploit utilizing sendmail:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

EBBSHAVE<\/em> is a vulnerability affecting Solaris RPC services version 2.10:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

EXCELBERWICK<\/em> is a remote exploit against xmlrpc.php on Unix based systems:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Tools<\/strong><\/h3>\n

Aside from the partial selection of exploits posted above, the dump also contains a number of tools, utilities, and scripts to deploy once successful exploitation of the system occurs.<\/p>\n

 <\/p>\n

Strifeworld<\/em> is a TCP session recorder that dates from 2001:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

EndlessDonut<\/em> helps deploy monitoring agents and to maintain a clean record:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Ys.auto<\/em> is an encompassing script that assists with the deployment of various RATs and system monitors. It\u2019s a curious footnote that the Ford Motor Company IP address appears within a number of files under the \u2018example\u2019 section:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

ELECTRICSLIDE.pl<\/em> is a PERL script, that as pointed out by x0rz<\/a>, impersonates a Chinese browser with a fake accept-language:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

A number of documents reference the deployment of RATs (Remote Access Trojans) to compromised machines. The vast majority of these files appear to target various Solaris, Linux, and FreeBSD clients – just based off their naming conventions. Additional analysis of these files will surely be published in coming days:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

There also appears to be a number of tools, documents, or scripts that reference cell phone information.<\/p>\n

Cdrprint.pl<\/em> is a script that takes CDR records and makes them pretty. CDR records are data records that are created when call information or other telecommunications transactions (text messages) passes through a processing facility or device. These are accompanied by \u2018definition\u2019 files, which to the best of my understanding, helps parse the collected data for specific phones:<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Within the targets.py file, there are strings and IP addresses relating to the Russian division of Sprint Telecom:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

The information contained in this dump is extensive and it will take security researchers some time to digest. While many of the exploits appear to be public and quite old, it\u2019s not out of the realm of possibility these vulnerabilities aren\u2019t still useful on legacy systems.<\/p>\n

But after spending ample time on a weekend pouring over the data, I fail to find the value in ShadowBrokers initial asking price of 1M bitcoins for an archive filled with publicly known (and probably patched) vulnerabilities dating as far back as 2003. Nothing appears to be more recent than 2013, so the information is likely obsolete and possibly not even used. This appears to be either a massive failure on the part of ShadowBrokers or a giant prank done for the lulz as there is no way they could have possibly thought this sort of information was worth anywhere near what was being asked.<\/p>\n

Regardless, another public disclosure of valuable information reminds us once again the value in OPSEC and secure data retention.<\/p>\n

The post ShadowBrokers fails to collect 1M bitcoins \u2013 releases stolen information<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: Adam McNeil| Date: Mon, 10 Apr 2017 17:49:20 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
ShadowBrokers finally made good on their promise to release the decryption key to unlock the stolen ‘auction’ file purportedly filled with NSA hacking tools.<\/p>\n

Categories: <\/p>\n