> Al-Bassam writes that the tool works by sending a packet to the target machine that makes it dump some of its memory. Included in that dump is the VPN’s authentication password, which is used to log into the device.
> Both Al-Bassam and Maksym Zaitsev, another researcher who has been looking into BENIGNCERTAIN, believe that the attack is likely capable of extracting private encryption keys from VPNs as well, which is another, more robust way of authenticating access.
Seems similar to the famous "Heartbleed" OpenSSL bug, possibly even easier to achieve.
Actually, this tool brings up the question: did NSA discover and exploit Heartbleed years ago?
That is not a conspiracy theory, btw.
A few weeks back, H.D. Moore of Rapid7/Metasploit fame was on the Risky Business podcast. The topic of the week was bug bounty programs, and in particular the larger programs that aggregate individual vendors under a common umbrella - and notably a common set of guidelines.
Moore mentioned that a recurring theme is that when researchers discover a new trick, they will the proceed to apply that trick to every possible vendor on the bounty program, netting 2-3k from each one they pop. In the same vein, I would find it odd if this extraction technique was not applied to every possible encryption target the NSA could think of.
Issuing a disk read every time you need to decrypt data sent over a VPN is not feasible in the slightest. At best you could only keep the key derived from the password, but that's all you'd need to decrypt the traffic.
> Brian Waters, another security researcher, tested BENIGNCERTAIN on his own hardware and managed to obtain the VPN's password, also known as a preshared key.
> On Friday, he tweeted a message of the output from his test, which revealed his test password of “password123” among a list of two other possibilities.
A password and a pre-shared key can mean the same thing depending on context. Regardless of what it is, the value in memory should not be able to be used externally to log into the system. The article references "password123"---that should not be recoverable from memory.
There's a string ("ace02468bdf13579") that is mentioned in a previously-unreleased document from the Snowden cache and also found in some of the binaries contained in the dump.
It's the timing that makes the connection. The sequence of events is:
1. Snowden leaves NSA with documents. Some of these (but, crucially, not all) are published.
2. Shadow Brokers release something claiming to be NSA hacking tools containing ace02468bdf13579 string.
3. The Intercept looks in the unreleased parts of the Snowden documents and finds the same string.
Thus, the fact that the leaked tools contain non-public NSA-specific information is what makes it clear the tools originate from NSA. The only other possibility is that the Shadow Brokers also had access to the full set of Snowden documents and decided to use them to fake the dump, which is much, much less likely.
You could start dropping ace02468bdf13579 into binaries willy nilly now, but it wouldn't do much, because that's now public information.
Suppose the ace02468bdf13579 is a random hex string. That's 8 bytes of data, or 1/2^64 to get that specific value. With the birthday paradox, that only gets you down to 1/2^32 or one in 4 billion chance. Not happening.
While that 64-bit value would be just as likely to occur as any other if randomly chosen, any competent programmer is going to recognize a very strong pattern in that value's binary representation that makes it much more likely to have been chosen with intent. In fact, the pattern is so strong, there's a chance that the appearances of the value in two places is simply a coincidence.
Well, if the string was a widely occuring one (say, because it's useful in some coding task, etc.) you might expect it to turn up a few times in a google search for occurrences prior to Aug 1 2016.
The (yet unpublished) documents obtained by Snowden had the same string as found in the sample files. The documents were not available to the publisher of the files to use.
What more reason could we possibly need to be against the NSA's data collection at this point? They clearly can't keep themselves secure, so why should we allow them to keep a profile of everything everyone does? They're simply collecting the most dangerous database in history and can't even keep the doors locked. I can't imagine how dangerous these tools and all our personal data could be in some other, also wrong hands.
The analogy isn't clear to me. If the NSA's data collection opens up additional avenues for breaches of private data, how does stopping this equate to removing a lock?
which is why i dont even go out and buy things like gold bars, large diamonds, etc because they are essentially bait for thieves
the NSA has collected all of our bait, and put it in one insecure location.
If they had built fort knox of network security maybe there would be less concern about data getting out, but regardless of how secure it is, it never needed to be collected, certainly not collected then stored insecurely.
No one said anything about removing locks. My point is exactly that- no one is ever truly 100% secure. In my opinion that makes it only a matter of time and willpower for some nefarious group to have access to the largest tracking database of all time. Which is exactly why we should never have started collection in the first place. There has never been an attack prevented from this information, so why is it being collected?
That's why we don't want NSA backdoors (among other reasons).
A more accurate analogy would be that the NSA has copies of all the keys in your neighborhood hanging in a cabinet on the street with a slightly better lock (a 7-pin tumbler!).
I don't see on what grounds they can charge anyone.
The documents are not classified, they weren't claimed as official USG property by the NSA, and downloading the torrent is any more or less illegal than reading the leaked Snowden power points online.
They are not marked as classified. That is something different than not being classified. Any US person with any sort of national security-related job, or any hopes of ever getting one, should think twice.
It's like having a stealth fighter crash in your back yard (this has happened). The pieces are not marked as being classified, but selling them on ebay isn't going to win you friends.
That could go also for reading the material released by Snowden not to mention wikileaks.
But overall I don't think this would affect you having a security clearance in the future, this isn't the first time leaks happened and I somehow doubt that it would affect security screening.
You are asked a question along the lines of "have you been ever exposed to classified information without having an explicit permission" if you say yes it was on cover of the goddamn washington post they can't do much.
Saying that it was leaked all of the internet, reported by 100's of news sources, fully analysed and you've looked at it yourself to see if you can learn anything from it isn't going to hurt you either.
But overall this isn't like a stealth fighter crashed in your backyard, it's like a stealth fighter crashed in China, they reverse engineered it, mass produced it, it was reviewed by everyone on the planet and you got one to try it out.
Or, if you torrent these files, the question "have you ever passed classified materials to someone not authorized to receive them?"
>reported by 100's of news sources
That really doesn't matter for many people. Anyone with any links whatsoever to the US military (a large chunk of the US population, including retirees) is bound by orders not to read classified material despite it being all over the newspapers/CNN. This was and still is a big deal re the Snowden material.
The Snowden material had these "SECRET" or "TOP SECRET" tags on every page (as seen on TV, of course!) This software tools, however, probably don't have anything like this, as, if I understand correctly, they are the binaries that should look "innocent" and fully unrelated to the US organizations in any event they are discovered, as some of them were already discovered with Stuxnet and similar events.
So I don't even see how they can be considered "classified" if the US doesn't officially admit they produced them. As far as I understand, there's nothing that carries their signs or any other such marks (like "top secret US government property").
For the reference, the production of Stuxnet by the US was never officially admitted. So you still don't have to answer you've seen something declared as secret by the US if you've seen a report about Stuxnet. And I honestly don't expect the US will soon admit the production of it officially. Unofficially, sure, there's that NYT article reporting what some "American officials" said.
IANAL, but I think that you'd be OK, even if it were marked as classified. I base this on the case of the Pentagon Papers [1]. As I understand it, no prosecution of the Times was possible here because by the time they got their hands on the documents, they had already been leaked.
54 comments
[ 3.3 ms ] story [ 111 ms ] thread> Both Al-Bassam and Maksym Zaitsev, another researcher who has been looking into BENIGNCERTAIN, believe that the attack is likely capable of extracting private encryption keys from VPNs as well, which is another, more robust way of authenticating access.
Seems similar to the famous "Heartbleed" OpenSSL bug, possibly even easier to achieve.
http://heartbleed.com/
That is not a conspiracy theory, btw.
A few weeks back, H.D. Moore of Rapid7/Metasploit fame was on the Risky Business podcast. The topic of the week was bug bounty programs, and in particular the larger programs that aggregate individual vendors under a common umbrella - and notably a common set of guidelines.
Moore mentioned that a recurring theme is that when researchers discover a new trick, they will the proceed to apply that trick to every possible vendor on the bounty program, netting 2-3k from each one they pop. In the same vein, I would find it odd if this extraction technique was not applied to every possible encryption target the NSA could think of.
If it was only needed for comparison, the plaintext password shouldn't even be in a database.
> On Friday, he tweeted a message of the output from his test, which revealed his test password of “password123” among a list of two other possibilities.
A password and a pre-shared key can mean the same thing depending on context. Regardless of what it is, the value in memory should not be able to be used externally to log into the system. The article references "password123"---that should not be recoverable from memory.
like many movie trailers
A far fetched tin-foil hat idea - Shadow Brokers made a few exploits themselves and are looking to bring maximum profit from a smaller amount of work.
The second tin-foil idea is that the NSA themselves are pretending to leak their old tricks in order to find out who the big players are.
https://theintercept.com/2016/08/19/the-nsa-was-hacked-snowd...
There's a string ("ace02468bdf13579") that is mentioned in a previously-unreleased document from the Snowden cache and also found in some of the binaries contained in the dump.
1. Snowden leaves NSA with documents. Some of these (but, crucially, not all) are published.
2. Shadow Brokers release something claiming to be NSA hacking tools containing ace02468bdf13579 string.
3. The Intercept looks in the unreleased parts of the Snowden documents and finds the same string.
Thus, the fact that the leaked tools contain non-public NSA-specific information is what makes it clear the tools originate from NSA. The only other possibility is that the Shadow Brokers also had access to the full set of Snowden documents and decided to use them to fake the dump, which is much, much less likely.
You could start dropping ace02468bdf13579 into binaries willy nilly now, but it wouldn't do much, because that's now public information.
Or am I missing something?
2015:
http://www.ijirst.org/articles/IJIRSTV1I9059.pdf
and 2013:
https://www.halowaypoint.com/en-us/forums/d76f090378914a9bb8...
Still, the string (instead of the binary values) is somewhat less probable than this to be an accidental match.
But, apparently not: https://www.google.com/search?q=ace02468bdf13579&client=fire...
the NSA has collected all of our bait, and put it in one insecure location.
If they had built fort knox of network security maybe there would be less concern about data getting out, but regardless of how secure it is, it never needed to be collected, certainly not collected then stored insecurely.
That's why we don't want NSA backdoors (among other reasons).
A more accurate analogy would be that the NSA has copies of all the keys in your neighborhood hanging in a cabinet on the street with a slightly better lock (a 7-pin tumbler!).
No thanks.
They are not marked as classified. That is something different than not being classified. Any US person with any sort of national security-related job, or any hopes of ever getting one, should think twice.
It's like having a stealth fighter crash in your back yard (this has happened). The pieces are not marked as being classified, but selling them on ebay isn't going to win you friends.
But overall I don't think this would affect you having a security clearance in the future, this isn't the first time leaks happened and I somehow doubt that it would affect security screening.
You are asked a question along the lines of "have you been ever exposed to classified information without having an explicit permission" if you say yes it was on cover of the goddamn washington post they can't do much.
Saying that it was leaked all of the internet, reported by 100's of news sources, fully analysed and you've looked at it yourself to see if you can learn anything from it isn't going to hurt you either.
But overall this isn't like a stealth fighter crashed in your backyard, it's like a stealth fighter crashed in China, they reverse engineered it, mass produced it, it was reviewed by everyone on the planet and you got one to try it out.
>reported by 100's of news sources
That really doesn't matter for many people. Anyone with any links whatsoever to the US military (a large chunk of the US population, including retirees) is bound by orders not to read classified material despite it being all over the newspapers/CNN. This was and still is a big deal re the Snowden material.
So I don't even see how they can be considered "classified" if the US doesn't officially admit they produced them. As far as I understand, there's nothing that carries their signs or any other such marks (like "top secret US government property").
For the reference, the production of Stuxnet by the US was never officially admitted. So you still don't have to answer you've seen something declared as secret by the US if you've seen a report about Stuxnet. And I honestly don't expect the US will soon admit the production of it officially. Unofficially, sure, there's that NYT article reporting what some "American officials" said.
[1] https://en.wikipedia.org/wiki/Pentagon_Papers#The_Supreme_Co...
https://en.m.wikipedia.org/wiki/Mustafa_Al-Bassam
Can't say I approve of these tools being leaked, but you have to admire their style.
Well, if you're familiar with that fictional universe, the name they chose for themselves definitely makes sense.
If the NSA really wanted to keep us safe, they would focus their efforts on patches instead of exploits.