Latest Hacking Tools Leak Indicates Nsa Was Targeting Swift Banking Network

Update: Most of the exploits made publicly available (mentioned inward this article) yesteryear the Shadow Brokers grouping are already patched yesteryear Microsoft inward the final month's Patch Tuesday update.

So, it is ever recommended that you lot proceed your systems up-to-date inward social club to foreclose you lot from beingness hacked.

The Shadow Brokers – a hackers grouping that claimed to convey stolen a bunch of hacking tools from the NSA – released today to a greater extent than alleged hacking tools in addition to exploits that target before versions of Windows operating system, along alongside testify that the Intelligence way also targeted the SWIFT banking scheme of several banks unopen to the world.

Last week, the hacking grouping released the password for an encrypted cache of Unix exploits, including a remote origin zero-day exploit for Solaris OS, in addition to the TOAST framework the grouping seat on auction final summer.

The hacking tools belonged to "Equation Group" – an elite cyber laid on unit of measurement linked to the National Security Agency (NSA).

Now, the Shadow Brokers grouping simply published a novel 117.9 MB of encrypted archive via its novel weblog post, titled "Lost inward Translation," which tin locomote unlocked yesteryear anyone using password "Reeeeeeeeeeeeeee."

Someone has already uploaded the unlocked archive on GitHub in addition to listed all the files contained inward the dump released yesteryear the Shadow Brokers, which includes 23 novel hacking tools.

These hacking tools convey been named equally OddJob, EasyBee, EternalRomance, FuzzBunch, EducatedScholar, EskimoRoll, EclipsedWing, EsteemAudit, EnglishMansDentist, MofConfig, ErraticGopher, EmphasisMine, EmeraldThread, EternalSynergy, EwokFrenzy, ZippyBeer, ExplodingCan, DoublePulsar, in addition to others.

Security researchers convey started delving into the dump to hit upward one's hear the capabilities of the alleged exploits, implants in addition to payloads that are claimed to locomote against Windows platforms.

NSA DUMP: Windows, Swift, in addition to OddJob

The latest dump comprises of iii folders: Windows, Swift, in addition to OddJob.

"So this calendar week is beingness near money. TheShadowBrokers showing you lot cards theshadowbrokers wanting you lot to locomote seeing. Sometime peoples non beingness target audience. Follow the links for novel dumps. Windows. Swift. Oddjob," the Shadow Brokers latest weblog shipping service reads.

The Windows folder holds many hacking tools against Windows operating system, but works against solely older version of Windows (Windows XP) in addition to Server 2003, according to researchers.

“ETERNALBLUE is a #0day RCE exploit that affects latest & updated Windows 2008 R2 SERVER VIA SMB in addition to NBT!” tweeted the safety researcher known equally Hacker Fantastic on Twitter.

Another folder, named OddJob, contains a Windows-based implant in addition to includes alleged configuration files in addition to payloads. While the details on this implant are scarce at the moment, OddJob works on Windows Server 2003 Enterprise upward to Windows XP Professional.

Some of the Windows exploits were fifty-fifty undetectable on online file scanning service VirusTotal, Security Architect Kevin Beaumont confirmed via Twitter, which indicates that the tools convey non been seen before.

"A lot of proficient remote exploits inward the #EquationGroup tools. Just a few well-designed 0days is plenty to pwn the planet," tweeted some other safety researcher, who uses Twitter handgrip x0rz.

The SWIFT folder contains PowerPoint presentations, evidence, credentials in addition to internal architecture of EastNets, ane of the largest SWIFT Service Bureau inward the Middle East.

SWIFT (Society for Worldwide Interbank Telecommunication) is a global fiscal messaging scheme that thousands of banks in addition to organizations across the basis purpose to transfer billions of dollars every day.

"A SWIFT Service Bureau is the form of the equivalent of the Cloud for Banks when it comes to their SWIFT transactions in addition to messages; the banks' transactions are hosted in addition to managed yesteryear the SWIFT Service Bureau via an Oracle Database in addition to the SWIFT Softwares," safety researcher Matt Suiche explains inward a blog post.

The folder includes SQL scripts that search for information from the Oracle Database similar the listing of database users in addition to the SWIFT message queries.

Besides this, the folder also contains Excel files that dot that the NSA's elite cyber laid on unit of measurement Equation Group had hacked in addition to gained access to many banks unopen to the world, the bulk of which are located inward the Middle East similar UAE, Kuwait, Qatar, Palestine, in addition to Yemen.

"SWIFT Host of Palestinian Bank was running Windows 2008 R2 vulnerable to exploit framework FUZZBUNCH." Matt tweeted.

More cardinal findings volition come upward equally presently equally other safety researchers delve into the latest dump.

This unloosen is the latest from the Shadow Brokers desk in addition to at the moment, it's non confirmed whether the hacking grouping holds to a greater extent than NSA hacking tools in addition to exploits or this ane is the final batch it stole from the U.S.A. intelligence organization.

UPDATE: EastNets Denies SWIFT Hacking Claims

In an official controversy published today, EastNets denies that its SWIFT bureau was compromised, in addition to says the reports of hack are "totally imitation in addition to unfounded."

"The reports of an alleged hacker-compromised EastNets Service Bureau (ENSB) network is totally imitation in addition to unfounded. The EastNets Network internal Security Unit has run a consummate depository fiscal establishment lucifer of its servers in addition to constitute no hacker compromise or whatever vulnerabilities."

"The EastNets Service Bureau runs on a split secure network that cannot locomote accessed over the populace networks. The photos shown on twitter, claiming compromised information, is near pages that are outdated in addition to obsolete, generated on a low-level internal server that is retired since 2013."

Share This :