The Shadow Brokers - The story so far

The Shadow Brokers

The story so far

Michael Schneider
by Michael Schneider
time to read: 9 minutes

On August 13, 2016, a group of hackers called The Shadow Brokers leaked exploits that they had apparently stolen from another hacker group, The Equation Group. This was first mentioned by Kapersky; it was assumed that there was a connection to the US intelligence agency NSA. News of the leak was posted in various places, including on Twitter, GitHub, Tumblr and Imgur.

These announcements mainly served as an incentive for the auction of further exploits that began at the same time. The group which sent the largest amount of Bitcoin (BTC) to the address 19BY2XCgbDe6WtTVbTyzM9eR3LYr6VitWK would receive the password to decrypt the collection of exploits; the other bidders would not be refunded. If the sum of BTC 1 million were exceeded, the exploits would be released and freely accessible to everyone. The auction was not time-limited; the end was determined arbitrarily by the Shadow Brokers themselves.

The auction itself was not a success. The overview of all transactions shows that the biggest contribution was BTC 1.5, and as of August 2016, only BTC 2.006074 had been credited to the account. On January 12, 2017, the Shadow Brokers ended the auction, declaring it unsuccessful, and disappeared with one final message. The chronological course of the auction is detailed in an article entitled The Shadow Brokers: Lifting the Shadows of the NSA’s Equation Group?, published by the company Risk Based Security.

Published exploits

Two files were published: the file eqgrp-free-file.tar.xz.gpg, meant as a teaser for the auction, and the file eqgrp-auction-file.tar.xz.gpg, for which the password was auctioned. Both files were encrypted; the password for the teaser file was theequationgroup. This file included the following exploits, among others:

Unexpected comeback and new exploits

The Shadow Brokers returned on April 8, 2017. In a message to the US President Donald Trump entitled Don’t Forget Your Base, they provided a password, CrDj”(;Va.*NdlnzB9M?@K2)#>deB7mN, for the auction file eqgrp-auction-file.tar.xz.gpg. This file again contained tools and exploits, this time for the operating systems Windows, Linux and Solaris. Some of the following exploits can be used to allow an unauthenticated user to obtain the highest local privileges on the system under attack:

On April 14, 2017, Microsoft published the statement Protecting customers and evaluating risk, which discussed the published exploits. On Patch Tuesday in March, Microsoft released the update Microsoft Security Bulletin MS17-010, which fixed most of the vulnerabilities, without any special announcement. Microsoft did not comment on when and by whom they were informed about the existence of these vulnerabilities.

Consequences

The MS17-010 update was distributed in March via Windows Update. Companies and private users who regularly install updates are therefore now protected against these exploits. However, many systems are still vulnerable to such attacks. Systems are attacked using the exploit ETERNALBLUE. After its successful completion, the backdoor DOUBLEPULSAR is installed. The tool FUZZBUNCH can also be used to simplify the configuration and launch of the exploit. The execution of ETERNALBLUE occurs as follows:

Module: Eternalblue

[?] Execute Plugin? [Yes] :
[*] Executing Plugin
[*] Connecting to target for exploitation.
    [+] Connection established for exploitation.
[*] Pinging backdoor...
    [+] Backdoor not installed, game on.
[*] Target OS selected valid for OS indicated by SMB reply
[*] CORE raw buffer dump (52 bytes):
0x00000000  57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32  Windows Server 2
0x00000010  30 30 38 20 52 32 20 53 74 61 6e 64 61 72 64 20  008 R2 Standard
0x00000020  37 36 30 31 20 53 65 72 76 69 63 65 20 50 61 63  7601 Service Pac
0x00000030  6b 20 31 00                                      k 1.
[*] Building exploit buffer
[*] Sending all but last fragment of exploit packet
    ................DONE.
[*] Sending SMB Echo request
[*] Good reply from SMB Echo request
[*] Starting non-paged pool grooming
    [+] Sending SMBv2 buffers
        ..............DONE.
    [+] Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] Sending SMB Echo request
[*] Good reply from SMB Echo request
[*] Sending last fragment of exploit packet!
    DONE.
[*] Receiving response from exploit packet
    [+] ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] Sending egg to corrupted connection.
[*] Triggering free of corrupted buffer.
[*] Pinging backdoor...
    [+] Backdoor returned code: 10 - Success!
    [+] Ping returned Target architecture: x64 (64-bit)
    [+] Backdoor installed
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[*] CORE sent serialized output blob (2 bytes):
0x00000000  08 00                                            ..
[*] Received output parameters from CORE
[+] CORE terminated with status code 0x00000000
[+] Eternalblue Succeeded

A system infected with DOUBLEPULSAR can be identified by the response to a specific ping on port 445/tcp. In the blog post Analyzing the DOUBLEPULSAR Kernel DLL Injection Technique, the company Countercept gave a detailed analysis of the backdoor and also published a tool called doublepulsar-detection-script in order to detect infected systems. However, an analysis by the company BinaryEdge shows that on April 21, 2017, there were already 106,410 internet-accessible systems infected. A few days later, on April 27, 2017, that number had risen to 428,827. It can be assumed that the number of infected systems will increase even further in the near future.

Conclusion

This example clearly demonstrates the importance of continually keeping systems up to date. A system’s attack surface should also be reduced as much as possible. For example, the SMB should not be accessible in systems that are directly connected to the internet. Anyone who has delayed installing security updates should see the release of these exploits as a wake-up call.

About the Author

Michael Schneider

Michael Schneider has been in IT since 2000. Since 2010 he is focused on information security. He is an expert at penetration testing, hardening and the detection of vulnerabilities in operating systems. He is well-known for a variety of tools written in PowerShell to find, exploit, and mitigate weaknesses. (ORCID 0000-0003-0772-9761)

Links

Tags

Bachelor Backdoor Bitcoin Block Blockchain Cisco Detect Exploit Firewall GitHub Hacker IIS Leak Linux Malware Master Microsoft NSA Password Ping Request Research Risk Solaris Standard Tool Twitter VulDB Windows

Is your data also traded on the dark net?

We are going to monitor the digital underground for you!

×
Area41 2024

Area41 2024 - A Recap

Michael Schneider

Reporting and Documenting

Reporting and Documenting

Michael Schneider

Introduction of CVSS v4.0

Introduction of CVSS v4.0

Michael Schneider

Rogue Device

Rogue Device

Michael Schneider

You want more?

Further articles available here

You need support in such a project?

Our experts will get in contact with you!

You want more?

Further articles available here