Major Leak Suggests NSA Was Deep in Middle East Banking System

WHISTLEBLOWING - SURVEILLANCE, 24 Apr 2017

Andy Greenberg | WIRED – TRANSCEND Media Service

A woman walks past a branch of Noor Islamic Bank along Khalid Bin Al-Waleed Road in Dubai. Reuters

14 Apr 2017 – For eight months, the hacker group known as Shadow Brokers has trickled out an intermittent drip of highly classified NSA data. Now, just when it seemed like that trove of secrets might be exhausted, the group has spilled a new batch. The latest dump appears to show that the NSA has penetrated deep into the finance infrastructure of the Middle East—a revelation that could create new scandals for the world’s most well-resourced spy agency.

Friday [14 Apr] morning, the Shadow Brokers published documents that—if legitimate—show just how thoroughly US intelligence has compromised elements of the global banking system. The new leak includes evidence that the NSA hacked into EastNets, a Dubai-based firm that oversees payments in the global SWIFT transaction system for dozens of client banks and other firms, particularly in the Middle East. The leak includes detailed lists of hacked or potentially targeted computers, including those belonging to firms in Qatar, Dubai, Abu Dhabi, Syria, Yemen, and the Palestinian territories. Also included in the data dump, as in previous Shadow Brokers releases, are a load of fresh hacking tools, this time targeting a slew of Windows versions.

“Oh you thought that was it?” the hacker group wrote in a typically grammar-challenged statement accompanying their leak. There was speculation prior to this morning’s release that the group had finally published its full set of stolen documents, after a seemingly failed attempt to auction them for bitcoins. “Too bad nobody deciding to be paying theshadowbrokers for just to shutup and going away.”

SWIFT Action

The transaction protocol SWIFT has been increasingly targeted by hackers seeking to redirect millions of dollars from banks around the world, with recent efforts in India, Ecuador, and Bangladesh. Security researchers have even pointed to clues that a $81 million Bangladesh bank theft via SWIFT may have been the work of the North Korean government. But the Shadow Brokers’ latest leak offers new evidence that the NSA has also compromised SWIFT, albeit most likely for silent espionage rather than wholesale larceny.

EastNets has denied that it was hacked, writing on its Twitter account that there’s “no credibility to the online claim of a compromise of EastNets customer information on its SWIFT service bureau.” But the Shadow Brokers’ leak seems to suggest otherwise: One spreadsheet in the release, for instance, lists computers by IP address, along with corresponding firms in the finance industry and beyond, including the Qatar First Investment Bank, Arab Petroleum Investments Corporation Bahrain, Dubai Gold and Commodities Exchange, Tadhamon International Islamic Bank, Noor Islamic Bank, Kuwait Petroleum Company, Qatar Telecom and others. A “legend” at the top of the spreadsheet notes that the 16 highlighted IP addresses mean, “box has been implanted and we are collecting.” That NSA jargon translates to a computer being successfully infected with its spyware.¹

Those IP addresses don’t actually correspond to the client’s computers, says Dubai-based security researcher Matt Suiche, but rather to computers servicing those clients at EastNets, which is one of 120 “service bureaus” that form a portion of the SWIFT network and make transactions on behalf of customers. “This is the equivalent of hacking all the banks in the region without having to hack them individually,” says Suiche, founder of UAE-based incident response and forensics startup Comae Technologies. “You have access to all their transactions.”

Blowback

While the Shadow Brokers’ releases have already included NSA exploits, today’s leak is the first indication of targets of that sophisticated hacking in the global banking system. Unlike previous known hacks of the SWIFT financial network, nothing in the leaked documents suggests that the NSA used its access to EastNets’ SWIFT systems to actual alter transactions or steal funds. Instead, stealthily tracking the transactions within that network may have given the agency visibility into money flows in the region—including to potential terrorist, extremist, or insurgent groups.

If that sort of finance-focused espionage was in fact the NSA’s goal, it would hardly deviate from the agency’s core mission. But Suiche points out that confirmation of the operation would nonetheless lead to blowback for the NSA and the US government—particularly given that many of the listed targets are in US-friendly countries like Dubai and Qatar. “A big shitstorm is to come,” says Suiche. “You can expect the leadership of key organizations like banks and governments are going to be quite irritated, and they’re going to react.”

Beyond EastNets alone, Suiche points to references in the files to targeting the Panama-based firm Business Computer Group or BCG, although it’s not clear if the firm was actually compromised. Beyond its Twitter statement, EastNets didn’t respond to WIRED’s request for comment. WIRED also reached out to BCG and the NSA, but didn’t get a response.

Windows to the World

SWIFT aside, the leak also contains a cornucopia of NSA hacking tools or “exploits,” including what appear to be previously secret techniques for hacking PCs and servers running Windows. Matthew Hickey, the founder of the security firm Hacker House, analyzed the collection and believes there are more than 20 distinct exploits in the leak, about 15 of which are included in an automated hacking “framework” tool called FuzzBunch.

“This is as big as it gets.” — Matthew Hickey, Hacker House

The attacks seem to target every recent version of Windows other than Windows 10, and several allow a remote hacker to gain the full ability to run their own code on a target machine. “There are exploits here that are quite likely zero days that will let you hack into any number of servers on the internet,” says Hickey. “This is as big as it gets. It’s internet God mode.”

In a statement to WIRED, a Microsoft spokeperson wrote only, “We are reviewing the report and will take the necessary actions to protect our customers.” If the released code does turn out include zero days, though, that would potentially leave millions of Windows users exposed until the company can pull together patches and release them to users.¹

The Shadow Brokers, meanwhile, hinted in their release that they’re not done creating trouble for the NSA yet. “Maybe if all suviving [sic] WWIII theshadowbrokers be seeing you next week,” the group’s message concludes. “Who knows what we having next time?”

Note:

¹Updated 4/14/2017 12:15 EST to include comments from EastNets and Microsoft.

______________________________________________

More Leaks:

• The Shadow Brokers Mess Is What Happens When the NSA Hoards Zero-Days
• WikiLeaks Just Dumped a Mega-Trove of CIA Hacking Secrets
• How the CIA Can Hack Your Phone, PC, and TV (Says WikiLeaks)

Andy Greenberg is a senior writer for WIRED, covering security, privacy, information freedom, and hacker culture.

Go to Original – wired.com

Share this article: email mastodon facebook 🔗 copy link

DISCLAIMER: The statements, views and opinions expressed in pieces republished here are solely those of the authors and do not necessarily represent those of TMS. In accordance with title 17 U.S.C. section 107, this material is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. TMS has no affiliation whatsoever with the originator of this article nor is TMS endorsed or sponsored by the originator. “GO TO ORIGINAL” links are provided as a convenience to our readers and allow for verification of authenticity. However, as originating pages are often updated by their originating host sites, the versions posted may not match the versions our readers view when clicking the “GO TO ORIGINAL” links. This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available in our efforts to advance understanding of environmental, political, human rights, economic, democracy, scientific, and social justice issues, etc. We believe this constitutes a ‘fair use’ of any such copyrighted material as provided for in section 107 of the US Copyright Law. In accordance with Title 17 U.S.C. Section 107, the material on this site is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml. If you wish to use copyrighted material from this site for purposes of your own that go beyond ‘fair use’, you must obtain permission from the copyright owner.

Comments are closed.