A group calling itself "The Shadow Broker" released a set of internal NSA files allegedly from the Tailored Access Operations (TAO) team, including several descriptions of 0-day exploit chains and tools.
First Published 17th August 2016
"I know your every secret, while you fumble in the dark."
4 min read | Reflare Research Team
Yesterday a group calling itself "The Shadow Broker" released a set of documents allegedly taken from the National Security Agency's "Tailored Access Operations" (TAO) team.
At this moment, many experts are giving opinions on who they suspect behind the leak, the way they suspect the information was obtained and the implications of the previous assumptions. We will purposefully not speculate on either point as no evidence is available and random speculation does not support forecasting.
The term "Shadow Broker" itself comes from the video gaming series "Mass Effect" where it denotes an entity selling information to the highest bidder. It thus provides no further leads.
This incident matches our prediction made last week that the use of high-profile cyber attacks to impact governmental actors will continue to escalate for the foreseeable future. The documents themselves also give an insight into the TAO's operations. We will review both points in order.
The escalation of force in cyber attacks is expected to continue in the coming weeks and months. Since cyber-attacks are by their very nature anonymous, it is highly unlikely that an actor will claim responsibility for this attack or any of the previous or future ones. Quite to the contrary, actors in the field may specifically aim to uncover cyber-attacks performed by other actors as has happened in this case.
Doing so would allow the attacker to leverage their capabilities to cause operational and PR damage to an adversary without taking on any risk. The leak of TAO files shows that no organization - no matter how sophisticated in terms of IT security - is immune to breaches. We expect a number of further leaks and breaches targeting governmental actors and teams globally over the coming months. Organizations are advised to take extra precautions to secure their infrastructure.
The leaked documents themselves confirm several facts that were already known but never officially acknowledged. Namely that the NSA actively searches or buys software vulnerability information and develops exploit code which is then deployed against targets to gain access. The leaks also confirm that standard procedures exist for such attacks.
The same is likely true for most countries at this point in time.
However, the leaks will likely require an official response from US government officials and may also uncover NSA backdoors in the infrastructure of other countries. If backdoors in the infrastructure of allies are uncovered this could lead to some level of political indignation.
We further expect leaked exploits to be abused by criminal actors to attack infrastructure before the vendors can address the vulnerabilities, and will continue to closely monitor the situation.