Hints suggest an insider helped the NSA “Equation Group” hacking tools leak

Structure of leaked files, other factors suggest someone inside “air gap” snuck them out.

Sean Gallagher – Aug 22, 2016 6:05 pm | 71

This is not what NSA's TAO is doing right now.

A group called the Shadow Brokers made headlines this month by leaking a hacking tool belonging to the NSA’s Tailored Access Operations (TAO) team. Now this week, several informed sources suggest an inside source may have been involved.

The leaked software—which can exploit weaknesses in a number of network hardware platforms and other devices—apparently may have come with the help of an NSA insider, according to the analysis of several information security experts, reports citing former NSA employees, and one journalist who had access to the files leaked by Edward Snowden. While the hacking tools were said not to have come from the Snowden documents cache, they may in fact be associated with another leaker who provided information to Jacob Appelbaum and Wikileaks, James Bamford suggests in a commentary published Monday by Reuters.

Details of the hacking tools also match with a training manual for NSA cyberespionage operations included in the Snowden document trove, released last week by The Intercept. Some of the tools also match with entries in the TAO’s ANT catalog—an NSA internal wishbook for hardware and software exploits. That document was published in part by Der Spiegel in collaboration with Appelbaum back in December of 2013.

On Twitter, Snowden himself said the most recent files in the Shadow Brokers’ dump had date stamps in June of 2013—a month after Snowden fled the US to Hong Kong. He pointed to that as proof that his leak actually stopped whatever “hacking” of the NSA was going on at that time. “When I came forward, NSA would have migrated offensive operations to new servers as a precaution – it’s cheap and easy,” Snowden wrote. “So? So… The undetected hacker squatting on this NSA server lost access in June 2013. Rare public data point on the positive results of the leak. You’re welcome, @NSAGov.”

It seems unlikely that the exploits would have been forward-positioned in bulk, in carefully-inventoried and documented form, on a server accessible from the Internet. The post-Snowden crackdown also included new attention to “insider threats” like Snowden at NSA, and the dates on the files may simply reflect when another NSA insider finally felt too much heat to continue to purloin data.

Shlomo Engelson Argamon, a professor of Computer Science at the Illinois Institute of Chicago and chief scientist at Taia Global who specializes in text analysis and attribution, has evaluated the text posted by the person or persons calling themselves the Shadow Brokers. He suggests that the broken English used to advertise the stolen code was intentionally broken—written by a native US English speaker. The lack of misspellings mixed with some strange combinations of grammatical errors “leads to the conclusion that the author is most likely a native speaker of US English who is attempting to sound like a non-native speaker by inserting a variety of random grammatical errors,” Engelson wrote in a post on Taia Global’s site.

On August 17, Motherboard cited a former NSA employee’s analysis that Shadow Brokers was, in fact, a lone insider. The naming convention used for the directories and files, as well as some of the scripts included in the dump, suggested the documents were copied from an internal system at the NSA that would have never been in contact with external networks. As Motherboard’s source told reporters Lorenzo Franceschi-Bicchierai and Joseph Cox, “My colleagues and I are fairly certain that this was no hack, or group for that matter…This ‘Shadow Brokers’ character is one guy, an insider employee.”

Bamford suggested the person behind the ANT catalog leak may be the same person responsible for the Shadow Brokers posts. “Unlike the catalog, the tools themselves…would have been useless if leaked to a publication,” Bamford wrote. “This could be one reason why they have not emerged until now.” And after the charade of the “auction” announcement by the first dispatch from Shadow Brokers, WikiLeaks posted on Twitter that they “had already obtained the archive of cyberweapons released…and will release our own pristine copy in due course.”