ShadowBrokers: The NSA Compromised the SWIFT Network

https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195

by raesene9 • 9 years ago

296 87 9 years ago

SamLevin88• 9 years ago

Perhaps this is one of the reasons Americans don't want to be surveilled unconstitutionally by our own government!

dmix• 9 years ago

This release includes logs, excel files, and even for the first time PowerPoint of TOP SECRET documents. This is a first from Shadow Brokers, this would mean ShadowBrokers has definitely more than only tools.

I'm curious what the implication is here. Why would a TOP SECRET power point slide be packaged together with malware on an attack server? It's either really sloppy OPSEC by NSA TAO (or random hired contractor) or may just be a collection of files put together by an intel agency/'criminal' hacker group from various sources to embarrass NSA.

posixplz• 9 years ago

The implication is that they're working directly with leakers. It's pretty hard to imagine that a PPT would be left on operational assets where tools are traditionally found.

devoply• 9 years ago

So why is the NSA leaking all this shit. What's the leading theory on that? It's like just get it all out there, just to preempt an eventual leak? Maybe see who picks up this stuff and uses it? Mis-lead the other side on the capabilities which are actually far superior than a few things which have been released?

mike_hearn2• 9 years ago

Aren't we overlooking a rather more likely possibility here - that the NSA has itself been hacked? You're right, I see no reason why slideware would be sitting outside the NSA corporate networks and I'm sure they have various procedures to try and prevent exactly that. The two remaining possibilities are:

1. Another leaker who isn't Snowden

2. A third party who has gained access to the insides of the NSA

I don't see why we're apparently ignoring 2 in this thread. The Snowden leaks made it very, very clear that essentially nothing is unhackable. And it's not like the USA has a monopoly on hacking skill. What else do we know about the NSA? That they perform the largest WireSharking in history, they literally parse most of the internet with a giant collection of programs which I will assume are written in C or C++ for the sake of performance (though a lot of Perl seems to crop up for analysis purposes too).

What are the chances that the NSA have managed to build a huge network with hugely complex interfacing to the entire internet, and huge amounts of software, without opening themselves up to attack by equally sophisticated attackers? I'd say close to zero.

jerf• 9 years ago

The Shadow Brokers are speculated to be an insider [1] (or my own speculation, a small but >1 group given what we've seen), which would mean that these things are packaged together because they've chosen to package them together, not because they were necessarily proximal "in the wild".

[1] https://en.wikipedia.org/wiki/The_Shadow_Brokers#Speculation...

Bartweiss3• 9 years ago

Yeah, this is fascinating. I thought the prior understanding was that Shadow Brokers had found/located a TAO box which had unintentionally been left with a full pen suite.

That was an interesting error already, but this implies either a ludicrous screwup (how would you even package those together?) or some much deeper compromise.

ryanmarsh2• 9 years ago

Is anyone else as horrified by this as I am?

Bitcoin being a sewer rat, and the banking system being a bubble boy, I knew a day would come when the bubble boy would be exposed to something bitcoin had grown immune to, get sick, and possibly die. I didn't know his protective bubble was already gone. I thought these banks all communicated on leased lines and weren't exposed to the public internet.

Is there any indication that a criminal hacker gang couldn't have compromised this or other SWIFT service bureau's or banks in a similar manner?

Which fiat bank will be the first Mt Gox?

nickpsecurity11• 9 years ago

"Is anyone else as horrified by this as I am?"

My quick skim shows they're gaining information about transactions in Middle East and Panama. One is essentially a hotbed of competing interests among imperialists and terrorism. The U.S. invaded two countries over there. There's proxy war going on in another. Far as Panama, it's one of leading spots for rich people, threatening or just tax-dodging, to set up offshore accounts, companies, and so on. They use it to hide their transactions. FinCEN has been fighting for access to tax haven data for years. No surprise NSA is monitoring illegal, money moving given targets of interests might be involved in it in that specific place.

ryanmarsh2• 9 years ago

It's clear why they're penetrating those networks and it's at least arguable they have cause too.

My comment was about the security house of cards surrounding the fiat banking system.

lovich• 9 years ago

What's illegal or not changes with political winds, and if they can access one part of the system the rest is now circumspect

foepys4• 9 years ago

exposed to something bitcoin had grown immune to

I don't know where this myth is coming from that Bitcoin is immune to state-level actors. If a relatively large government really wanted to manipulate the Bitcoin network, they could either just buy some thousand Bitcoin and spam the network with transactions or buy enough hardware to get over 50% hashing power. Especially China only needs to take down the 2 or 3 top miners and can cut the mining power in half within a day.

Bitcoin is simply not interesting enough at the moment to get manipulated by state-level actors. But that doesn't mean that it's impossible, regardless what Bitcoin advocates want you to believe.

JoshTriplett• 9 years ago

Definitely not impossible, but a quick check at the moment suggests that with the best available ASICs, it'd cost about $376M retail (or perhaps less wholesale) to buy hashing power equivalent to the current network. (And that assumes sufficient supply to do so, though it might be possible to scale that better.) So, definitely in the range for states to accomplish, but not trivial; it'd have to be extremely critical to do so. (And an attempt to do so would likely get noticed, and there are ways to work around it.)

_iao• 9 years ago

As the supply goes down, so too does the price rise. They will become more expensive the more governments try to do this. This is like saying that "a government can buy all the gold in the world to prevent this" .. inherently false and shallow statement ignoring the complexity of the issue

nebabyte• 9 years ago

they could either just buy some thousand Bitcoin and spam the network with transactions

Marginal loss on each transaction + "spamming transactions" = essentially paying people to run their machines at 100% for a while for you, which to the tune of "some thousand bitcoin" would be money to their ears

just [..] buy enough hardware to get over 50% hashing power

'just'

Especially China only needs to take down the 2 or 3 top miners and can cut the mining power in half within a day

If that is true (and I'm not convinced that it is) you don't think those '2 or 3' entities aren't large and financially self-interested enough to work to secure themselves, divest their resources, or so on?

I highly doubt any sort of subversive action could be taken sub-rosa to the tune of 51% of a network of paraniod individuals who'd either fork or move out given any whiff of subversion, especially by state actors.

neffy• 9 years ago

The big advantage of double entry book keeping is that it provides multiple layers of security in the basic ledger handling the banks must perform. (The big disadvantage is the implicit instabilities that result from the associated statistical multiplexing of money.) So SWIFT being compromised is bad, just ask the Central Bank of Bangladesh, but it's not the end of the world as we know it.

kasey_junk• 9 years ago

The idea that the stability of banks is largely determined by their internet security is not something anyone who is familiar with bank operations believe. Breaches, fraud, inside jobs (and much more commonly) errors in SWIFT or other electronic communications are assumed to be happening by the banks.

Double entry accounting, auditing, charge backs and correction protocols are all normal, standard and expected in even the smallest credit unions and the amount of dollars spent on these things at the larger financial institutions is staggering. That is essentially the job of a bank. To back stop that we have insurance and regulatory bodies working to prevent and mitigate losses. Again, this is normal and expected.

The thing those of us who have worked in banks find so funny about Bitcoin isn't that it solves some issues that banks don't know about or does something clever. Its how unprofessional the whole thing is. It doesn't account for hardly any of the real world problems of the banking system.

Which fiat bank will be the first Mt Gox?

Depends on what you mean? A bank that is brought down by theft by its employees? That was such a big problem in the early banking world that banks competed on the edifices and security theater to prove it didn't happen at their bank...150 years ago or more.

sfifs• 9 years ago

Bitcoin is quite trivial to take down (spam with transactions because clearing rate is so slow). Also remember that the core promise of Bitcoin is decentralization not anonymity and anyone with resources amd will like the NSA should be able to comfortably trace back users unless there's unusually good opsec (even Tor merely increases the cost of unmasking).

The point of the banking system is not necessarily high security, it's the legal frameworks and process flexibility to identify and prosecute fraud and reverse the effect of fraud of detected in time

nickpsecurity11• 9 years ago

Alright, maybe SWIFT will be interested in high-assurance systems now. Any day now they'll start applying the best of real INFOSEC to a world-wide, financial-transfer network. Any day now... Probably not lol...

walterbell3• 9 years ago

Are any of these meaningful?

https://www.swift.com/myswift/customer-security-programme-cs...

nickpsecurity11• 9 years ago

I can't glean useful information out of it except to note Fox-IT has some experts on hand that can help. They were mentioned. The hacks usually come from malicious insiders, social engineering of benign insiders, bad configurations, bad protocols, and especially 0-days in software. The interim solution should then be hardened OS with strong TCB, use of proven protocols, secure-by-default configuration, auditing/monitoring by third-parties for malicious insiders, and controls for both malicious and benign insiders. SWIFT's headlines indicate a lot of software implementing controls, analysis, and so on. I didn't see anything at a glance about making the implementation of those software, their protocols, or their OS's bulletproof.

So, I still don't trust them. This looks like the same shit management in banking and "security" industries come up with all the time. You know, the stuff used in dozens of companies that got bypassed by so-called "APT's" that sent emails with infected PDF's and Excel documents. Really "advanced" attacks it takes. Haha. Trick is, you need both the security features and assurance they're secure. Most of industry focuses on former where my type focuses on latter as much as possible. ;)

lallysingh• 9 years ago

I'm not surprised that an agency tasked with counter terrorism is intercepting/manipulating wire transfers.

jcriddle4• 9 years ago

The US government already has legal and very broad access to SWIFT for anything even slightly terror related.

gruturo• 9 years ago

The US government already has legal and very broad access to SWIFT for anything even slightly terror related.

Not really. SWIFT maintains multiple datacenters outside the US so that transactions between 2 non-US actors don't touch US-based computers and are therefore not (easily, officially) accessible by the US government.

walterbell3• 9 years ago

Windows XP/2003 has been unsupported for more than 3 years. This means that security vulnerabilities found on those systems will never be corrected.

Windows Embedded 2009 (based on XP) is receiving security updates until 2019.

Globz• 9 years ago

is there a particular reason why ALL of them are using the same subnet 192.168.200.*?

ganoushoreilly• 9 years ago

Because they likely have an operational network for each work group that's mirrored, using standard configurations to maintain continuity across tools, techniques, and procedures.

raesene92• 9 years ago

It's worth following @hackerfantastic (https://twitter.com/hackerfantastic) on twitter at the moment as he's looking through some of the exploits that were dropped along with this documents.

Highlights so far are a 0-day in windows from NT-->2012 which reliably exploits over the SMBv2 port and a bunch of other stuff. (https://twitter.com/hackerfantastic/status/85291588665052774...)

fpp2• 9 years ago

sounds familiar - we found that one 1996 when doing system programming on NT (NuMega SoftIce was your best friend together with material published by Mark Russinovich prior of him working with MS - remember when you were doing e.g. a file system driver at that time there was close to zero documentation by MS and half of what they provided was wrong). Demonstrated then how to use it to log onto remote Windows systems over the I-Net and gain Admin rights. I thought this one with all what was published about it long ago would be well known since.

Astounded that it took so long to fix and that it passed on through generations of Windows version.

Almost certain similar can be said of other low level "bugs".

hexadecimated• 9 years ago

How do you know it's the same bug?

MichaelMoser123• 9 years ago

SMB protocol was a well known source of bugs, lots of service packs used to patch this service (funny that it was enabled on network facing machines. I think it was because windows server needed to be ready for every use case. They could have had it easier by having a separate windows product with non essential services disabled by default)

rsync2• 9 years ago

In this, or the other recent tool exposes, have there been any exploits for FreeBSD ?

How about OpenSSH or sendmail or Apache httpd (on any UNIX platform) ?

lwhalen• 9 years ago

Nope. Why people/companies insist the Microsoft is usable on the open internet today, despite all evidence to the contrary, is beyond me. They are not, and have not been, suitable-for-the-datacenter/internet for well over a decade now. Let the company and its swiss-cheese OS die already.

hackuser• 9 years ago

have there been any exploits for FreeBSD ?

ShadowBrokers is releasing these exploits to make a loud noise. FreeBSD exploits probably won't be covered on CNN.

phjesusthatguy3• 9 years ago

If I had a 0-day for openssh I'd be selling it to people I could be sure would keep it a secret.

pera• 9 years ago

I wonder why the TFTP[1] is not enough for the US IC, is there any official explanation?

https://en.wikipedia.org/wiki/Terrorist_Finance_Tracking_Pro...

UnoriginalGuy2• 9 years ago

None of the countries targeted in the NSA slides are part of that program.

starefossen• 9 years ago

And here is the EastNets' blog post denying the compromise ever happened http://www.eastnets.com/News_Details/17-04-14/No_credibility...

UnoriginalGuy2• 9 years ago

I love them outright denying it, then slowly admitting that the slides reference real elements of their infrastructure that they have since retired.

This dump is a few years old. Seems very believable that the NSA compromised their network before 2013 in the way the slides suggest. Plus if their "internal Security Unit" was worth a damn they would have known about this already, rather than finding out about it from this dump.

Overall that press release is a little embarrassing, and screams to the tech illiteracy of their senior management. Nobody would publish a press release like this so quickly if they understood the problem scopes in play here (e.g. their Cisco firewalls themselves could have implants!).

jpalomaki2• 9 years ago

The title does not seem to be accurate. I don't see evidence that whole SWIFT network was compromised. Instead it looks like they compromised one company which connects to the SWIFT network.

nickpsecurity11• 9 years ago

That's what it looks like. They were monitoring or getting data from SWIFT before, though. Just can't remember the details. I'd assume they can hack SWIFT, though, given SWIFT probably relies on tech they have 0-days in like most places. Just more monitoring that might catch them. Hopefully...

jpalomaki2• 9 years ago

Yes, that was happening in cooperation with SWIFT in the aftermath of 9/11: https://en.m.wikipedia.org/wiki/Terrorist_Finance_Tracking_P...

Back then SWIFT had two processing centers, one in EU and one in US. Traffic was replicated to both for resiliency. Later they opened up a new center in Switzerland to be able to keep European data in Europe.

Sephr• 9 years ago

How is NSA TAO not being held criminally irresponsible by our administration for not patching the still-unreleased exploits that are currently in possession of third parties?

Chaebixi• 9 years ago

How is NSA TAO not being held criminally irresponsible by our administration

Hate to break the news to you about the new administration...

akvadrako• 9 years ago

or the previous administration ...

rhizome• 9 years ago

What law requires them to do so?

Kinnard• 9 years ago

I find it interesting that he did not mention Bitcoin or other blockchain based solutions as an alternative to SWIFT. I doubt that that's because the author is unaware of these technologies.

1ba9115454• 9 years ago

Blockchains are public databases. So wouldn't really be a solution for privacy in this case.

peterwwillis• 9 years ago

We've known the NSA compromised SWIFT since 2013, that the US has control over SWIFT transactions since 2012, and that the US had been failing to guarantee the privacy of EU citizens' transactions on the network since 2011.

We've also known since last year that at least three separate hacks by three separate thieves stole millions of dollars from multiple banks after compromising the SWIFT network.

All 11,000 financial institutions connected to the network should just switch to sending their 15 million messages per day using iPhones. Problem solved.

nickpsecurity11• 9 years ago

"All 11,000 financial institutions connected to the network should just switch to sending their 15 million messages per day using iPhones. Problem solved."

iPhones are in U.S. jurisdiction. That's a bad idea. Instead, they should send P2P or through SWIFT-like intermediary with signed messages GPG-style over TLS-style links via dedicated lines or Internet lines with high-speed port knocking. It all can be done with highly-secure tech. The tech for bottom of stack from secure CPU's to secure kernels even exists already. SWIFT or some other setup just has to buy it with that pile of money they have.

swalsh• 9 years ago

Correct me if i'm wrong, but i'm pretty sure that OddJob hack has a GUI interface built with Visual basic ;)

Nas808• 9 years ago

Every time something like this breaks I have to take it with a grain of salt. I've been fooled by HN before about "major" security breaches that end up not having much of an impact at all.

Cloudflare leak in Feb... sounded like the world was ending here.

i336_• 9 years ago

You may have noticed that the biggest freakout was from Google.

The freakout wasn't due to the incident itself (although obviously everyone was unimpressed the leak happened), it was the fallout: the leaked data was archived in various caches. Google's indexes of the web are the biggest.

ShadowBrokers: The NSA Compromised the SWIFT Network

Related Stories