TheShadowBrokers NSA Hacking tools The Equation Group

Yesterday TheShadowBrokers released password for Leaked Equation Group NSA hacking tools, they have been auctioning in 2016:

medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1


The first cache of NSA hacking tools contained quite a lot of material, such as zero-day exploits and tools to bypass firewalls (Cisco, Fortinet, Juniper, and TOPSEC), a toolkit to extract VPN keys, backdoors for Linux systems, and several Windows exploits.

This second cache is quite fresh, and security researchers haven't had the time to search it in its entirety. As of now, we know of the following findings:
A list of servers belonging to companies and universities from around the world, which the NSA allegedly hacked and used as staging points for deploying malware and launching attacks.
The same list, but only the IPs
A list of usernames and passwords used for tools and backdoor acconts
The TOAST framework used to clean server logs and delete the NSA's tracks.
Many tools for hacking *NIX systems, especially Solaris.
A tool called ELECTRICSLIDE that impersonates a Chinese browser with fake Accept-Language.
A new tool named PITCHIMPAIR used to hack into servers.
An implant called SIDETRACK, used with PITCHIMPAIR.

tl;dr:
bleepingcomputer.com/news/security/shadow-brokers-publish-the-password-for-the-rest-the-stolen-nsa-hacking-tools/

heavy.com/tech/2016/11/shadow-brokers-nsa-leak-hack-auction-equation-group-latest-who-are-they-ransom-hackers-russia-us-election-cyberwar/

Other urls found in this thread:

mediafire.com/?rj8v4xj3d95cs
github.com/x0rz/EQGRP
twitter.com/x0rz/status/850722646966890497
twitter.com/666glen666/status/850781636899811328
forbes.com/sites/paularmstrongtech/2017/04/09/nsa-hacking-tools-leak-online-but-are-the-shadow-brokers-about-to-be-unmasked/#42ef43c53936
heavy.com/tech/2016/11/shadow-brokers-nsa-leak-hack-auction-equation-group-latest-who-are-they-ransom-hackers-russia-us-election-cyberwar/
thegatewaypundit.com/2017/03/massive-amount-data-47-hard-drives-whistle-blower-proves-obama-crew-spied-everyone/
techfleece.com/2013/01/09/up-to-80-of-anonymous-users-can-be-identified-by-using-linguistic-software/
github.com/psal/JStylo-Anonymouth
twitter.com/Snowden/status/851128375397810176
seclists.org/fulldisclosure/2009/Aug/173
youtube.com/watch?v=T--zOjA7WiA
googleprojectzero.blogspot.cl/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html
twitter.com/SFWRedditGifs

Nothing substantial, sadly.

That's probably old stuff, they must have new tools by now.

Encrypted archive: mediafire.com/?rj8v4xj3d95cs
Here are where the files are located: Eyeballing_Snowden_Info_Folder_04/NSA's Equation Group - Cyber Weapons/EQGRP-Auction-Files.zip

Decrpyted archive: github.com/x0rz/EQGRP

More details on these two twitter accounts:
twitter.com/x0rz/status/850722646966890497
twitter.com/666glen666/status/850781636899811328

forbes.com/sites/paularmstrongtech/2017/04/09/nsa-hacking-tools-leak-online-but-are-the-shadow-brokers-about-to-be-unmasked/#42ef43c53936

This. I already looked through it all and there's basically nothing. What a waste of time. I'm gonna go to sleep and I suggest the rest of you do too. It's late we should rest our eyes and take a quick nap.

>Encrypted archive: mediafire.com/?rj8v4xj3d95cs
How do we decrypt the auction files? The method I used for the free files doesn't seem to work.

gpg --output ~/output --decrypt file.tar.xz.gpg

Thanks

The password for the EQGRP-Auction-Files is CrDj”(;Va.*NdlnzB9M?@K2)#>deB7mN

The password is actually 'CrDj"(;Va.*NdlnzB9M?@K2)#>deB7mN' (different quote mark).

Medium replaces " with ”

Also check sha265 so you are sure you are working with unaltered file.

I am a security expert. There is nothing substantial in these leaks.

>Medium replaces " with ”
Not
Medium replaces ”"” with "”"
Disappoint.

Jesus H. Christ. Now we're getting wikileaks in retaliation for US missile strikes. I thought Assange was cool, but he really is a Soviet agent, isn't he?

Not sure if trolling.
This has nothing to do with wikileaks, assange or soviet.


November 2, 2016 October 5, 2016
Hal Martin, the Main Suspect Behind the Shadow Brokers Leak, is in Federal Custody
The NSA contractor Hal Martin is the prime suspect in leaking materials to the Shadow Brokers. Martin was arrested in August after the FBI raided his house where they discovered classified documents and government property. The 51-year-old will face espionage charges after having stolen 50 terabytes of code involving NSA data.
Martin Worked for the Same Consulting Firm as NSA Whistleblower Edward Snowden
> having stolen 50 terabytes of code involving NSA data

heavy.com/tech/2016/11/shadow-brokers-nsa-leak-hack-auction-equation-group-latest-who-are-they-ransom-hackers-russia-us-election-cyberwar/

March 23, 2017
A massive amount of data on 47 hard drives, 170 terabytes from a government whistle blower was turned over to the Freedom Watch group recently.
The whistleblower Mr. Montgomery left the NSA and CIA with 47 hard drives and 600 million pages of information exposing the illegal surveillance on prominent Americans during the Obama years
> left the NSA and CIA with 47 hard drives and 600 million pages

thegatewaypundit.com/2017/03/massive-amount-data-47-hard-drives-whistle-blower-proves-obama-crew-spied-everyone/


Majority if not all political leaks in past few years came from insiders.
(You)
> But, but, wikileaks.

Stop this fucking meme.

Thank you Sergei for this fine information about the kikeful Amerikkkan government

> A list of servers belonging to companies and universities from around the world, which the NSA allegedly hacked and used as staging points for deploying malware and launching attacks.

please make them liable for a lawsuit, that's blatantly illegal

LOL, "TheShadowBrokers".

I especially love the part where they try to pretend they're patriotic Americans and Trump supporters releasing these things as a protest but their terrible broken english tells you otherwise.

Putin's propaganda arm is getting lazy, although you can't blame them, at this point the cucks he's converted are self-propagating and self-reinforcing their brain washing so they just need raw fuel injected from time to time, no need to refine it. Wikileaks, 'TheShadowBrokers', etc...once they were more subtle...now they are painfully obvious propaganda with always rushed released perfectly timed to serve as propaganda for Putin.

It's amazing how Putin was able to put oil under Russia to boost the country's GDP like that.

You guys realise the capabilities this gives criminals?

So the national debt went from $152bn to $169bn

Well. At least now companies know what they have to patch up.

To think if we could have a President like that, just once. I believed the Donald was it, I really did...

A national debt must exist to keep banks viable. The problem is setting the correct proportion and walking that line properly.

every time i read any of these TS/S documents, it blows my fucking mind how much data they have. they have literally everything. there's no fucking way to hide at all. if they want you, they'll get you.

fucking yikes

> but their terrible broken english tells you otherwise.
I am sure you believed that metadata in Guccifer 2.0 documents proves he was russian too.

techfleece.com/2013/01/09/up-to-80-of-anonymous-users-can-be-identified-by-using-linguistic-software/
JStylo-Anonymouth - Java-based Authorship Recognition Analysis and Evasion Tools
github.com/psal/JStylo-Anonymouth

And on your linguistic analysis:

> As a Russian myself, I can tell you with certainty that there are mistakes in that text that a Russian ESL speaker would never make, and verb tenses are a bit too good for an unskilled speaker. Due to the combination of these two factors, I bet this was written by a native English speaker who thinks he/she knows the mistakes a Russian would make. They're wrong.

> I'm also Russian, and I have to concur with this assessment after looking at the text It does sound very much like a native or near-native English speaker trying to fake Russian accent.

> Well, there's no Russian first-language bias in that text for sure. Another argument in favor of the opinion that this was written by an American: the author seems to be well versed in the memes of the US political discourse. Someone from outside the US is unlikely to even know or care about Trump's "movement", or who "Bannon" is, or "drain the swamp", or "white privilege" etc. They're also unlikely to abbreviate "New York Times" as "NYT". The telltale signs are all over the text.

> However, things like "caucus" and "SCOTUS" are really unlikely to be written by a Russian, on any English knowledge level. We do make mistakes, but our mistakes are different. In this text, there are too few common mistakes, and too many strange things.

> A much more common mistake you will find is not knowing when to use "the" or "a".

> But the correct use of definite and indefinite articles indicates someone with a more than competent knowledge of English (whatever their nationality may be).

Some of it is already patched.
Like this Linux kernel exploit found in 2009.

twitter.com/Snowden/status/851128375397810176
seclists.org/fulldisclosure/2009/Aug/173

Another Russian here, and I can also vouch for that to us Shadow Brokers sound like geniune Americans if a little more patriotic than average. I dont understand how anyone could think they or Guccifer were russians, or why we would be leaking things about the american government. We have better things to do!

No no. 1000 Putins slav shitposters on Sup Forums and /r/The_Donald made Trump win the elections. Its all proven.

EXCLUSIVE: Rare Footage of Russian Hackers in Action!
youtube.com/watch?v=T--zOjA7WiA

it's from 2013, of course they have some new tools, but... these are 0days

>tfw you'll never find and exploit a vulnerability like this: googleprojectzero.blogspot.cl/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html

why live ;_;