We had promised you there would be more updates as this story developed and, it turns out, we were right!
So here’s the second article we at DEFEND have written on the fallout from the NSA Breach.
While at press time the public still hadn’t shown a huge amount of interest in the online auction for “the good stuff” that The Shadow Brokers had held back, there’s literally a trove of material to wade through that they’d made available, for free, a little over a week ago. And there’s been a lot of wading through these interesting cyber-waters.
In case you’re joining us mid-story cycle, here’s a quick briefing: A previously unknown group of hackers calling themselves The Shadow Brokers had pulled off a historic hack of the elite, formerly “omnipotent” NSA-affiliated hacking collective known as The Equation Group. It was, in effect, a breach of the super secretive NSA itself, as reported here and elsewhere, and as researchers continue to investigate, they’re finding out more and more about what The Equation Group was able to do (and the material that we’re specifically talking about here is all at least three years out of date, which should give us all pause…)
Now it should be noted that The Equation Group is currently thought to be the world’s most sophisticated — and well-funded — group of hackers. And their list of victims is far-reaching and complex, though not nearly as impressive as the things they’ve been accused of doing in the digital realm to victims all over the globe. And when I say accused, what I really mean is the things they’ve done but were too clever to leave a concrete trace to prove it was actually them. Salim Scafuto, Comodo’s Director of Product Strategy, Advanced Endpoint Protection is waiting for concrete proof that The Equation Group is in fact either NSA or NSA sponsored, stating that, “If this group does in fact prove to be a nation sponsored intelligence agency, it highlights what the impact can be when stockpiled private exploits are used to breach widely deployed, publicly accessible perimeter security products for the purpose of mass surveillance programs.”
Now one of the ‘achievements’ the NSA-affiliated Equation Group was able to accomplish was to defeat the security systems built into older legacy Cisco firewalls, and inject firmware into those machines to intercept – and potentially redirect – communications which were supposedly safeguarded on Virtual Private Networks (VPNs). What this means is that all of the private communications we thought were actually private for the last, oh, 8-10 years, probably weren’t.
At first, the prevailing wisdom about this bit of the exploit kit we’ve gotten to see was that it all just related to old Cisco firewalls.
However, new information from one of the research groups investigating the cache of material, a group known as SilentSignal, based in Budapest, Hungary, indicates that they were able to modify an exploit found in the trove called, wonderfully, ExtraBacon. Now ExtraBacon originally had a defeat built into it to stop it (the exploit, that is) from infecting newer versions of Cisco’s Adaptive Security Appliance (ASA) line of firewalls, which seems awfully considerate, if you think about it.
One of the many scary things here is the fact that Cisco’s ASAs are quite popular with governments and large businesses and enterprises all over the world. Scafuto adds, “There are over 1.9 million Cisco ASA firewalls deployed across the globe, in both private and public sector networks, so the potential impact here is significant.”
And again, when the breach was first made public, many took some small comfort that while the materials that had been uncovered were truly remarkable, we were all able to sleep easier knowing that the Cisco firewalls targeted initially had been discontinued and that most conscientious enterprises and governments were no longer running such old/sunsetted/unsupported hardware.
Back to Hungary.
It turns out, after just a bit of work, the SilentSignal team was able to defeat the defeat, if you will, and with just a little finagling, enable ExtraBacon to then go ahead and infiltrate much more recent versions of the ASA firewalls.
“Oy,” said everyone running newer Cisco firewalls. “Oy also,” said everyone running other makers’ products, knowing that this wasn’t a Cisco-focused NSA campaign but a campaign, basically, to enable the NSA to spy on anyone, anywhere, and at anytime, with impunity and a cloak of undetectability, to coin a new phrase. Because, really, If they can breach those appliances’ defenses, why not yours?
Back to Cisco and its newly vulnerable ASAs.
It turns out the new ASA models are at risk as well due to a hitch in the source code that had been carried over from earlier models. And this illustrates yet another important point: that even though code is updated from release to release, if a vulnerability hasn’t been discovered, it can often “sleep” in the source code for generations of a product line. Then, as has happened here, if the vulnerability is discovered by hackers, they can “wake up” that chunk of source code to exploit not only one generation, say an older, less sophisticated version, but multiple years’ worth of products. In this case, the hackers put a limit on their own malware to stop it from infiltrating newer machines. Pretty heady stuff, this…
Scafuto summed it all up as follows, “Nation state cyber espionage is here to stay. Those concerned with privacy and obligated to ensure confidentiality, must take a lesson and deploy active network monitoring systems, to identify exploit code, behaviors, and “TTP’s” when perimeter products like Cisco ASA fail.”
Cisco, to their credit, has quickly come up with a software patch that lets ASA owners discover and disable ExtraBacon on their systems, but, importantly, they haven’t actually fixed the source code with the underlying vulnerability yet. But you can bet they’re working on it. But until THAT happens (and until we find out what else the NSA folks have in their bag of tricks) you should be aware that, for at least the time being, privacy as we now know it no longer exists.
