Shadow Brokers promise release of more NSA hacks to be used against the world

As if dealing with the continuing drama of the WannaCry global ransomware attack was not enough, the original group behind the leak of the US National Security Agency (NSA’s), hacking tools has announced it is going to release more tools that could be exploited in the near future.

The ShadowBrokers originally tried to auction the NSA hacking tools that they claimed were from the Equation Group, a hacker group tied to the NSA. After failing to get a bidder for the leaked files, the Shadow Brokers leaked in April 2017 a part of their horde, some of which was subsequently incorporated into the WannaCry ransomware.

In the Shadow Broker’s latest posting, they have threatened to release even more tools in June. Having failed to get anyone interested in an auction however, the group is starting up what they call something like the “wine of month club”. A subscription service where you get new exploits every month.

The exploits that the Shadow Brokers are threatening to pass on include vulnerabilities of browsers, mobile devices, Windows 10 and information about compromised banks and Russian, Chinese, Iranian and North Korean nuclear missile programs.

As a final offer, the Shadow Brokers have said that if someone buys the entire horde of data, they will “go dark permanently”, having no financial incentive to continue.

Although nobody knows who the Shadow Brokers are, various theories point to either a disgruntled insider or a group with ties to Russia. In another post the Shadow Brokers identify themselves as disappointed supporters of US President Donald Trump. The ideals espoused in the post celebrate all that they believed that Donald Trump stood for, “anti-globalism, anti-socialism, nationalism, isolationism” and racism.

Tellingly, the Shadow Brokers claimed its members to be originally all part of the “Deep State which lends credence to the fact that they may be disaffected insiders of the NSA itself.

In any event, it is likely that the exploits they have will find their way into the hands of groups who in turn will unleash them on the global public.

The only mitigating factor in this is that the NSA appears to have been informing companies about the different exploits and so allowing them to fix their products and issue updates to affected software and systems. It is likely that most, if not all of the outstanding exploits held by the Shadow Brokers have already been fixed by Microsoft, Google, Apple and others.

Despite the availability of fixes, the exploits that the Shadow Brokers still have could lead to even more damage on a global scale. The fact that the WannaCry attack has persisted as long as it has is an indication of the refusal of many people globally to update and protect their systems, despite the risks. Part of the blame for this has to be laid at the feet of people who have advised the public to switch off automatic software updates of their systems and do these manually, advice that has been condemned by cybersecurity experts.

Security is a balance of risk against cost and updates may seem like a painful ordeal, but the world is moving into an environment where this cost is nothing in comparison to the risks of doing nothing. Vendors do share part of the blame in not making these updates more seamless, but it may simply be impossible to do make updating completely transparent to users.

In assessing risk, the public, companies and government are not always in a position to make informed decisions. Experts are still trying to understand the threats themselves without having sufficient time to explain it in simple terms to the public. What has not helped has been the lack of response from governments and security agencies in all of this in comparison to the involvement of private security companies and individuals trying to battle the attack as it has unfolded.

When 22 year olds are the celebrated heroes of stemming the damage of a cyber attack rather than the agencies tasked to defend countries against these types of threat, it is perhaps time to question what these organisations have been doing over the past few days?