Latest Hacking Tools Leak Indicates Nsa Was Targeting Swift Banking Network

Update: Most of the exploits made publicly available (mentioned inward this article) past times the Shadow Brokers grouping are already patched past times Microsoft inward the concluding month's Patch Tuesday update.

So, it is ever recommended that yous proceed your systems up-to-date inward social club to forestall yous from existence hacked.

The Shadow Brokers – a hackers grouping that claimed to convey stolen a bunch of hacking tools from the NSA – released today to a greater extent than alleged hacking tools as well as exploits that target before versions of Windows operating system, along alongside bear witness that the Intelligence means also targeted the SWIFT banking scheme of several banks some the world.

Last week, the hacking grouping released the password for an encrypted cache of Unix exploits, including a remote beginning zero-day exploit for Solaris OS, as well as the TOAST framework the grouping pose on auction concluding summer.

The hacking tools belonged to "Equation Group" – an elite cyber assault unit of measurement linked to the National Security Agency (NSA).

Now, the Shadow Brokers grouping simply published a novel 117.9 MB of encrypted archive via its novel weblog post, titled "Lost inward Translation," which tin dismiss endure unlocked past times anyone using password "Reeeeeeeeeeeeeee."

Someone has already uploaded the unlocked archive on GitHub as well as listed all the files contained inward the dump released past times the Shadow Brokers, which includes 23 novel hacking tools.

These hacking tools convey been named every bit OddJob, EasyBee, EternalRomance, FuzzBunch, EducatedScholar, EskimoRoll, EclipsedWing, EsteemAudit, EnglishMansDentist, MofConfig, ErraticGopher, EmphasisMine, EmeraldThread, EternalSynergy, EwokFrenzy, ZippyBeer, ExplodingCan, DoublePulsar, as well as others.

Security researchers convey started delving into the dump to arrive at upwards one's hear the capabilities of the alleged exploits, implants as well as payloads that are claimed to travel against Windows platforms.

NSA DUMP: Windows, Swift, as well as OddJob

The latest dump comprises of iii folders: Windows, Swift, as well as OddJob.

"So this calendar week is existence well-nigh money. TheShadowBrokers showing yous cards theshadowbrokers wanting yous to endure seeing. Sometime peoples non existence target audience. Follow the links for novel dumps. Windows. Swift. Oddjob," the Shadow Brokers latest weblog postal service reads.

The Windows folder holds many hacking tools against Windows operating system, but works against exclusively older version of Windows (Windows XP) as well as Server 2003, according to researchers.

“ETERNALBLUE is a #0day RCE exploit that affects latest & updated Windows 2008 R2 SERVER VIA SMB as well as NBT!” tweeted the safety researcher known every bit Hacker Fantastic on Twitter.

Another folder, named OddJob, contains a Windows-based implant as well as includes alleged configuration files as well as payloads. While the details on this implant are scarce at the moment, OddJob works on Windows Server 2003 Enterprise upwards to Windows XP Professional.

Some of the Windows exploits were fifty-fifty undetectable on online file scanning service VirusTotal, Security Architect Kevin Beaumont confirmed via Twitter, which indicates that the tools convey non been seen before.

"A lot of skilful remote exploits inward the #EquationGroup tools. Just a few well-designed 0days is plenty to pwn the planet," tweeted some other safety researcher, who uses Twitter handgrip x0rz.

The SWIFT folder contains PowerPoint presentations, evidence, credentials as well as internal architecture of EastNets, i of the largest SWIFT Service Bureau inward the Middle East.

SWIFT (Society for Worldwide Interbank Telecommunication) is a global fiscal messaging scheme that thousands of banks as well as organizations across the basis role to transfer billions of dollars every day.

"A SWIFT Service Bureau is the sort of the equivalent of the Cloud for Banks when it comes to their SWIFT transactions as well as messages; the banks' transactions are hosted as well as managed past times the SWIFT Service Bureau via an Oracle Database as well as the SWIFT Softwares," safety researcher Matt Suiche explains inward a blog post.

The folder includes SQL scripts that search for information from the Oracle Database similar the listing of database users as well as the SWIFT message queries.

Besides this, the folder also contains Excel files that dot that the NSA's elite cyber assault unit of measurement Equation Group had hacked as well as gained access to many banks some the world, the bulk of which are located inward the Middle East similar UAE, Kuwait, Qatar, Palestine, as well as Yemen.

"SWIFT Host of Palestinian Bank was running Windows 2008 R2 vulnerable to exploit framework FUZZBUNCH." Matt tweeted.

More fundamental findings volition come upwards every bit shortly every bit other safety researchers delve into the latest dump.

This unloose is the latest from the Shadow Brokers desk as well as at the moment, it's non confirmed whether the hacking grouping holds to a greater extent than NSA hacking tools as well as exploits or this i is the concluding batch it stole from the U.S. of A. tidings organization.

UPDATE: EastNets Denies SWIFT Hacking Claims

In an official contestation published today, EastNets denies that its SWIFT bureau was compromised, as well as says the reports of hack are "totally imitation as well as unfounded."

"The reports of an alleged hacker-compromised EastNets Service Bureau (ENSB) network is totally imitation as well as unfounded. The EastNets Network internal Security Unit has run a consummate banking company tally of its servers as well as flora no hacker compromise or whatever vulnerabilities."

"The EastNets Service Bureau runs on a split upwards secure network that cannot endure accessed over Earth networks. The photos shown on twitter, claiming compromised information, is well-nigh pages that are outdated as well as obsolete, generated on a low-level internal server that is retired since 2013."