Solarwind, Fireeye, Microsoft and Cisco leaks are offered for sale

by autoro • 6 years ago

288 123 6 years ago

What evidence is there that this is actually the SolarWinds hackers and not someone who uploaded some random encrypted files and is hoping to trick people into sending them money?

There’s a PGP signature, but as far as I’ve head the attackers didn’t leave behind any other messages to prove it was signed with the same key.

piracy1• 6 years ago

And it does not seem a very serious attempt either. The only way to make this deal is through a single listed protonmail address that if this gets any traction will be closed in all likelihood. Not like an onion site with a contact page or something.

sudosysgen8• 6 years ago

Not really.

The message is PGP signed. If the protonmail address is taken down, then another message will be put out with alternate means of contact that will have a correct PGP signature.

If you read the message there is indeed an onion address as backup in case things get taken down.

The PGP address is the important part. No matter what gets taken down, if they can get attention to another message with a valid PGP signature, then they can carry on easily.

EDIT: This is actually how Cicada3301 of all people operated. The PGP key allowed them to post a message even on Pastebin or /x/ and they would still be contactable and effectively uncensorable, because their identity was persistent and their messages were replicated.

autoro2• 6 years ago

I think we can't know for sure unless they will release some of it like the shadow brokers did. But the shadow brokers show that it is possible for hackers with high valuable leaks to post it for sale in the public Internet.

forgotmypw172• 6 years ago

Strange that there is no public key provided...

You can't verify a signature without a public key.

sudosysgen8• 6 years ago

You can extract the public key from the signature. This public key is E2C73BC53B9118A0.

If you want to have a go at it yourself, run gpg -vv and paste the entire message, it will give you the public key.

malwarebytess• 6 years ago

Usually for this kind of thing samples are provided. This attacks feels too sophisticated for a mere sale. At best, if this is legitimate, it's misdirection.

jinkyu• 6 years ago

needs proof of life. none of the "vendors" will consider it without proof. in-fact they would likely verify if they were real dumps.

buildbot• 6 years ago

Windows source is open to most people at Microsoft IIRC, so I’m not sure why you’d pay 500k for that...

xtanx• 6 years ago

If that was true, I am pretty sure that the entire windows source would be all over the internet.

intern4tional2• 6 years ago

Disclaimer: Am Microsoft.

Windows source is open to most people at MS. MS is not joking when it says we practice an "inner source" policy, in that we do not rely on the security of our source code to secure our products.

rot25• 6 years ago

It is true for most engineers here. Most of us don't want to go to prison though. Most tech companies are the same way.

msftfte666• 6 years ago

it is true

ryanlol5• 6 years ago

It is all over the internet lol. Windows source has always been frequently traded.

tinus_hn• 6 years ago

Different versions have in fact leaked, most recently of Windows XP/server 2003.

tmotwu• 6 years ago

Only 2.6G too, partial is understating it. That's like less than a percent of the monster IIRC. It likely doesn't even include any of the tooling to build it. It notoriously takes days to build.

tallanvor• 6 years ago

This really isn't true. It's open to most people in engineering. On the support side, it's only open to those who support Windows, and I don't think it's open at all to services.

liquidify2• 6 years ago

"Serious buyers only: solarleaks@protonmail.com

- - Q: Is this really happening? Can you provide proof? A: Yes and yes.

Q: Why no more details? A: We aren't fully done yet and we want to preserve the most of our current access. Consider this a first batch.

Q: I'm [vendor] and want my data back? A: Talk to us.

Q: Why not leak it for free? A: Nothing comes free in this world.

Q: How to buy? A: Contact us for more information."

These don't sound like things that the Russian government or any nation state would be saying.

Makes the U.S. intelligence / media look stupid. And if it turns out that it is some individuals that happen to live in Russia, it still makes the U.S. look stupid.

willxinc3• 6 years ago

Are the US intelligence community / media saying that the attack was by the Russians?

1MachineElf• 6 years ago

Yes https://thehill.com/policy/cybersecurity/532756-us-intel-age...

zwp• 6 years ago

Washington Post attributed the attack to Russian actor APT29/Cozy Bear on Dec 14th [1], quoting unnamed sources.

FireEye [2] Dec 13th & Volexity [3] Dec 14th were more cautious, citing an unknown actor that they dubbed UNC2452, and Dark Halo, respectively.

Recorded Future made a fair but ultimately inconclusive case for Chinese attribution [4], Dec 30th.

US gov/CISA continues to claim "Russian linked" [5], Jan 5th.

Kaspersky reported a link to the Kazuar malware used by Russian actor Turla [6], Jan 11th.

CrowdStrike's report on the malware injector [7], Jan 11th says "does not attribute the SUNSPOT implant, SUNBURST backdoor or TEARDROP post-exploitation tool to any known adversary".

[1] https://www.washingtonpost.com/national-security/russian-gov...

[2] https://www.fireeye.com/blog/threat-research/2020/12/evasive...

[3] https://www.volexity.com/blog/2020/12/14/dark-halo-leverages...

[4] https://www.recordedfuture.com/solarwinds-attribution/

[5] https://www.cisa.gov/news/2021/01/05/joint-statement-federal...

[6] https://securelist.com/sunburst-backdoor-kazuar/99981/

[7] https://www.crowdstrike.com/blog/sunspot-malware-technical-a...

saltedonion• 6 years ago

Maybe that’s the entire point

sudosysgen8• 6 years ago

While that's possible, pushed far enough this line of reasoning is unfalsifiable and evidence is thin either way.

ryanlol5• 6 years ago

These don't sound like things that the Russian government or any nation state would be saying.

Why not? Sharing stolen source costs them nothing, and nation state hackers have budgets just like the rest of us.

They probably wouldn’t even get in big trouble for selling this stuff and using the money to buy themselves lambos, a nice bonus on top of the government hacker salary.

throwaway99252• 6 years ago

a nice bonus on top of the government hacker salary.

The current narrative is that they aren't on payroll or under orders, but instead individuals or groups within the collective (cozy bear) act on their own initiative to win putin's favor.

anewaccount2021• 6 years ago

US digital infrastructure is the ultimate soft target. I assume for every SolarWinds we hear about, there are others that the government squashes due to sheer embarrassment or national security concerns.

naikrovek• 6 years ago

Q: Why not leak it for free? A: Nothing comes free in this world.

They didn't pay to get that data they're now charging money for. "Nothing is free when we're offering it" they should say.

nhumrich• 6 years ago

We pay for things with money and time. They absolutely "paid" for the money if you consider the amount of time they probably put into it.

ymosy2• 6 years ago

Russia behaved exactly the same after the DNC hack. They made up a story about some Romanian hacker called Guccifer but their cover up was debunked by Vice: https://www.vice.com/en/article/wnxgwq/guccifer-20-is-likely...

ymosy2• 6 years ago

According to https://www.srcbeat.com/2021/01/solarleaks/ their email sent to solarleaks@protonmail.com bounced back with "Address does not exist" error.

freeflight3• 6 years ago

The whole basis of Vice debunk is "Nobody heard of a Guccifer 2.0 persona before", which is not exactly strong evidence for anything.

Particularly considering Guccifer is a real person and referencing other hackers not that unheard of.

Thorentis• 6 years ago

The main element pointing to Russia is the timeline of the events.

I didn't realize the bar for "debunking" had become so low.

shbooms• 6 years ago

These don't sound like things that the Russian government or any nation state would be saying.

I mean this could just be an attempt to make it _seem_ like it's not a nation state.

One way to essentially guarntee that it _was_ a nation state is for the stolen data to never turn up for sale to the public/back to the owners as we would naturally assume whoever the actor was was happy just keeping everything to themselves, something only a nation state would ever really do. a non-nation state's only real motivation would be financial and so if no evidence of that ever came about, the only real alternative would be to assume it was a nation state.

michaelt• 6 years ago

Well, or the hack was by some greyhat/kid who realised they were in over their head and that keeping evidence of their crime around was a dumb move.

freeflight3• 6 years ago

These don't sound like things that the Russian government or any nation state would be saying.

This goes both ways: Or they would be exactly the kind of things a government would say to dispel any notion of it being a government.

Makes the U.S. intelligence / media look stupid. And if it turns out that it is some individuals that happen to live in Russia, it still makes the U.S. look stupid.

I wonder whatever happened to that whole mantra of the early 2000s and 2010s when governments would regurgitate the difficulty in dealing with "cyber" due to the "asymmetric" nature of "cyber warfare"?

Somehow that was completely forgotten over the last decade in favor of blaming any and all InfoSec breaches instantly on some state actor.

One has to wonder how much of that is just deflecting from bad practices with "The enemy is a state, nothing we could do to defend against an attacker that powerful!" in favor over admitting "Yeah some autistic dude in his parents basement pwned all our stuff because our security is completely amateurish".

jamescun• 6 years ago

Bear in mind that the "results" of a notorious hack are often offered for sale as a diversionary technique, and in particular this offers up nothing beyond commercially sensetive information, if even legitimate at all.

ryanlol5• 6 years ago

often

I really don’t like doing this, but [citation needed]

sudosysgen8• 6 years ago

The PGP key is E2C73BC53B9118A0.

I can't find it on any keyserver, yet.

shakna2• 6 years ago

That key isn't the one linked to the Protonmail account either. [0] (You'll get a payload of all linked public keys with that link).

[0] https://api.protonmail.ch/pks/lookup?op=get&search=solarleak...

bflesch• 6 years ago

This is a nice way to verify Protonmail addresses. Is this API publicly documented?

ROARosen2• 6 years ago

Wonder if mega.nz will not block this download.

beprogrammed• 6 years ago

It appears they have. " The file you are trying to download is no longer available. This link is unavailable as the user’s account has been closed for gross violation of MEGA’s Terms of Service. "

collsni• 6 years ago

Data also off root. http://solarleaks.net/feye.tgz.enc

jasonhansel• 6 years ago

Why isn't mega.nz removing these?

pfundstein2• 6 years ago

I think they have a pretty strong anti-censorship stance, and due to the way the data is en/decrypted on the client side, they have no visibility what the data consists of.

On top of that, the data here (which is posted with the mega.co.nz decryption keys standard as part of the URL) has an additional layer of encryption by the uploader, so for all anyone can prove it's pictures of cats, and not anything illegal.

djkoolaide• 6 years ago

On the other hand, they know exactly what the uploader claims the files are. If they don't take the files down and these turn out to be real, they could be held responsible.

Thorrez2• 6 years ago

It looks like mega.nz has now removed them.

lemonspat2• 6 years ago

autoro- I have to ask, did you publish this yourself? It’s your only submission and your only comment

autoro2• 6 years ago

Yes, I did (off course this message can't prove it in any way). I am usually a silent reader in NH but I saw there was no submission to this topic so I submitted it.

f430• 6 years ago

So what sort of return would someone buying this expect?

dmix• 6 years ago

Buying a .net domain with a cryptocurrency I presume? Anyone know what service they'd use for this?

snypher• 6 years ago

Dns is with https://njal.la/

bdd• 6 years ago

Looks like they used Njalla (https://njal.la) a provider that seems to focus on "privacy aware" domains and virtual private servers hosted in Sweden.

According to their FAQ, when you register a domain name through them, they own the domain but they respect the agreement between them and the customer to let the customer have "full usage rights".

They seem to provide rather fun named name servers. Reads "you can get no info".

    dig +short ns solarleaks.net | sort
    1-you.njalla.no.
    2-can.njalla.in.
    3-get.njalla.fo.

They accept a bunch* of cryptocurrencies and then PayPal.

[*]: "Bitcoin, Litecoin, Monero, ZCash, DASH, Bitcoin Cash, Ethereum"

pfundstein2• 6 years ago

Interesting tidbit: This "dns by proxy" service was founded by The Pirate Bay founder, Peter Sunde.

Jerry2• 6 years ago

So, this was not a nation state hack?

perlgeek• 6 years ago

Or this is a distraction to make it look like not a nation state hack.

mNovak• 6 years ago

I guess I'm curious to understand who has the money and motivation but not risk to spend $1M on stolen data?

King-Aaron• 6 years ago

I'm actually interested to know what the (+ Bonus) is

ALittleLight2• 6 years ago

Seems expensive and you'd have to trust that admitted data thieves would give you the data after you paid them.

nix23• 6 years ago

Is it just me or does that not sound as if it's a "state sponsored attack"? Or maybe a tactic to distract from one?

mcintyre1994• 6 years ago

IIRC the Russian NotPetya attack on Ukraine was disguised as ransomware requesting Bitcoin, so there is some precedent for a state sponsored attack pretending to be criminals trying to make money.

Closi• 6 years ago

...So they want 16k USD non-refundable just to talk, before they even show any proof?

Lol.

Solarwind, Fireeye, Microsoft and Cisco leaks are offered for sale

Related Stories