12 ms·

ShadowBrokers: The NSA Compromised the SWIFT Network

296 points by raesene9 10y ago

SamLevin88 10y ago
Perhaps this is one of the reasons Americans don't want to be surveilled unconstitutionally by our own government!
dmix 10y ago
> This release includes logs, excel files, and even for the first time PowerPoint of TOP SECRET documents. This is a first from Shadow Brokers, this would mean ShadowBrokers has definitely more than only tools. I'm curious what the implication is here. Why would a TOP SECRET power point slide be packaged together with malware on an attack server? It's either really sloppy OPSEC by NSA TAO (or random hired contractor) or may just be a collection of files put together by an intel agency/'criminal' hacker group from various sources to embarrass NSA.
- posixplz 10y ago
  The implication is that they're working directly with leakers. It's pretty hard to imagine that a PPT would be left on operational assets where tools are traditionally found.
  - devoply 10y ago
    So why is the NSA leaking all this shit. What's the leading theory on that? It's like just get it all out there, just to preempt an eventual leak? Maybe see who picks up this stuff and uses it? Mis-lead the other side on the capabilities which are actually far superior than a few things which have been released?
    - evilantnie 10y ago
      If we do buy into the fact that the NSA is behind the leaks, it would most likely be in response to some sort of loss-aversion or negative leverage play. i.e. they want to severely devalue these assets on the black market.
    - nickpsecurity 10y ago
      "So why is the NSA leaking all this shit. " It would be insiders who oppose what's going on Snowden-style or plants from a foreign, intelligence service.
  - mike_hearn 10y ago
    Aren't we overlooking a rather more likely possibility here - that the NSA has itself been hacked? You're right, I see no reason why slideware would be sitting outside the NSA corporate networks and I'm sure they have various procedures to try and prevent exactly that. The two remaining possibilities are: 1. Another leaker who isn't Snowden 2. A third party who has gained access to the insides of the NSA I don't see why we're apparently ignoring 2 in this thread. The Snowden leaks made it very, very clear that essentially nothing is unhackable. And it's not like the USA has a monopoly on hacking skill. What else do we know about the NSA? That they perform the largest WireSharking in history, they literally parse most of the internet with a giant collection of programs which I will assume are written in C or C++ for the sake of performance (though a lot of Perl seems to crop up for analysis purposes too). What are the chances that the NSA have managed to build a huge network with hugely complex interfacing to the entire internet, and huge amounts of software, without opening themselves up to attack by equally sophisticated attackers? I'd say close to zero.
    - nickpsecurity 10y ago
      "Aren't we overlooking a rather more likely possibility here - that the NSA has itself been hacked?" That's the most obvious one to me. I thought everyone assumed it until I saw some of these comment threads. If it's Russian, it probably goes back to Kaspersky tracking the Equation Group. They put together about everything about how they operated. Giving Russian intelligence this information combined with trip-wires or tip-offs on live activity by NSA hackers would let Russian hackers attempt to own their boxes. They could just work from there. Alternatively, it could be result of long-running infiltrations that U.S. government has been talking about for decades. At various points, U.S. TLA's said China is throwing piles of spies at us in a numbers game whereas Russia was using (I think it was) 4x more than during height of the Cold War. We also know they're easy to infiltrate and have terrible security since Snowden did and showed exactly that. Plus Manning just pulling everything they had from an Army private's account in Middle East. The leaks could've come from infiltrators, too. So, we have infiltrators, hackers via Kaspersky data (or similar), or insiders that for whatever reason want to humiliate them. Whatever Shadow Brokers say about themselves is just propaganda. They're one of the above with probably typical motivations of agents in those categories.
- jerf 10y ago
  The Shadow Brokers are speculated to be an insider [1] (or my own speculation, a small but >1 group given what we've seen), which would mean that these things are packaged together because they've chosen to package them together, not because they were necessarily proximal "in the wild". [1]: https://en.wikipedia.org/wiki/The_Shadow_Brokers#Speculations_and_theories_on_motive_and_identity https://en.wikipedia.org/wiki/The_Shadow_Brokers#Speculation...
- Bartweiss 10y ago
  Yeah, this is fascinating. I thought the prior understanding was that Shadow Brokers had found/located a TAO box which had unintentionally been left with a full pen suite. That was an interesting error already, but this implies either a ludicrous screwup (how would you even package those together?) or some much deeper compromise.
ryanmarsh 10y ago
Is anyone else as horrified by this as I am? Bitcoin being a sewer rat, and the banking system being a bubble boy, I knew a day would come when the bubble boy would be exposed to something bitcoin had grown immune to, get sick, and possibly die. I didn't know his protective bubble was already gone. I thought these banks all communicated on leased lines and weren't exposed to the public internet. Is there any indication that a criminal hacker gang couldn't have compromised this or other SWIFT service bureau's or banks in a similar manner? Which fiat bank will be the first Mt Gox?
- nickpsecurity 10y ago
  "Is anyone else as horrified by this as I am?" My quick skim shows they're gaining information about transactions in Middle East and Panama. One is essentially a hotbed of competing interests among imperialists and terrorism. The U.S. invaded two countries over there. There's proxy war going on in another. Far as Panama, it's one of leading spots for rich people, threatening or just tax-dodging, to set up offshore accounts, companies, and so on. They use it to hide their transactions. FinCEN has been fighting for access to tax haven data for years. No surprise NSA is monitoring illegal, money moving given targets of interests might be involved in it in that specific place.
  - ryanmarsh 10y ago
    It's clear why they're penetrating those networks and it's at least arguable they have cause too. My comment was about the security house of cards surrounding the fiat banking system.
  - lovich 10y ago
    What's illegal or not changes with political winds, and if they can access one part of the system the rest is now circumspect
    - nickpsecurity 10y ago
      It really doesn't. Spy agencies have been collecting economic and military intelligence on foreign countries and companies since their inception. It was a NSA apologist that correctly noted that each country with a spy agency makes it illegal for people to spy on them, complains about it internationally, and then funds an agency to spy on everyone else for their own benefit. Regardless of what laws or technicalities say, all these countries with spy agencies want foreign spying to happen & legally endorse it by creating said agencies. This should be expected. Even if they made it illegal, I still wouldn't trust them as they'd try to do something to get an edge on negotiations. That something would be illegal activity they outsourced to mercenary organizations or partnered with nations with spy organizations with some benefit promised back to them. For example, nearly all of Europe has intelligence sharing agreements per Snowden leaks with the very agency (NSA) they're publicly griping about. Only 3 didn't in whatever deal that was: Switzerland, Iceland, and one other I can't remember.
nickpsecurity 10y ago
Alright, maybe SWIFT will be interested in high-assurance systems now. Any day now they'll start applying the best of real INFOSEC to a world-wide, financial-transfer network. Any day now... Probably not lol...
- walterbell 10y ago
  Are any of these meaningful? https://www.swift.com/myswift/customer-security-programme-csp_/security-announcements https://www.swift.com/myswift/customer-security-programme-cs...
  - nickpsecurity 10y ago
    I can't glean useful information out of it except to note Fox-IT has some experts on hand that can help. They were mentioned. The hacks usually come from malicious insiders, social engineering of benign insiders, bad configurations, bad protocols, and especially 0-days in software. The interim solution should then be hardened OS with strong TCB, use of proven protocols, secure-by-default configuration, auditing/monitoring by third-parties for malicious insiders, and controls for both malicious and benign insiders. SWIFT's headlines indicate a lot of software implementing controls, analysis, and so on. I didn't see anything at a glance about making the implementation of those software, their protocols, or their OS's bulletproof. So, I still don't trust them. This looks like the same shit management in banking and "security" industries come up with all the time. You know, the stuff used in dozens of companies that got bypassed by so-called "APT's" that sent emails with infected PDF's and Excel documents. Really "advanced" attacks it takes. Haha. Trick is, you need both the security features and assurance they're secure. Most of industry focuses on former where my type focuses on latter as much as possible. ;)
    - walterbell 10y ago
      Have you seen Skyport's hardened server? Excluding the "cloud management" portion, it looks promising on paper, https://www.skyportsystems.net/wp-content/uploads/2017/02/Datasheet-SkySecure-Server-On-Premises-Hyper-Secured-Infrastructure.pdf https://www.skyportsystems.net/wp-content/uploads/2017/02/Da... Microsoft's PAW definition covers related topics, https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/privileged-access-workstations https://technet.microsoft.com/en-us/windows-server-docs/secu...
lallysingh 10y ago
I'm not surprised that an agency tasked with counter terrorism is intercepting/manipulating wire transfers.
- jcriddle4 10y ago
  The US government already has legal and very broad access to SWIFT for anything even slightly terror related.
  - gruturo 10y ago
    > The US government already has legal and very broad access to SWIFT for anything even slightly terror related. Not really. SWIFT maintains multiple datacenters outside the US so that transactions between 2 non-US actors don't touch US-based computers and are therefore not (easily, officially) accessible by the US government.
walterbell 10y ago
> Windows XP/2003 has been unsupported for more than 3 years. This means that security vulnerabilities found on those systems will never be corrected. Windows Embedded 2009 (based on XP) is receiving security updates until 2019.
Globz 10y ago
is there a particular reason why ALL of them are using the same subnet 192.168.200.*?
- ganoushoreilly 10y ago
  Because they likely have an operational network for each work group that's mirrored, using standard configurations to maintain continuity across tools, techniques, and procedures.
raesene9 10y ago
It's worth following @hackerfantastic (https://twitter.com/hackerfantastic https://twitter.com/hackerfantastic) on twitter at the moment as he's looking through some of the exploits that were dropped along with this documents. Highlights so far are a 0-day in windows from NT-->2012 which reliably exploits over the SMBv2 port and a bunch of other stuff. (https://twitter.com/hackerfantastic/status/852915886650527744 https://twitter.com/hackerfantastic/status/85291588665052774...)
- fpp 10y ago
  sounds familiar - we found that one 1996 when doing system programming on NT (NuMega SoftIce was your best friend together with material published by Mark Russinovich prior of him working with MS - remember when you were doing e.g. a file system driver at that time there was close to zero documentation by MS and half of what they provided was wrong). Demonstrated then how to use it to log onto remote Windows systems over the I-Net and gain Admin rights. I thought this one with all what was published about it long ago would be well known since. Astounded that it took so long to fix and that it passed on through generations of Windows version. Almost certain similar can be said of other low level "bugs".
  - jacobush 10y ago
    I am sorry, we can't bash Microsoft anymore, they are on Github now!
  - hexadecimated 10y ago
    How do you know it's the same bug?
    - fpp 10y ago
      same result - only one issue like that known to me So of course I could be wrong and this issue is not the only one in that protocol implementation / sys component(s)
  - MichaelMoser123 10y ago
pera 10y ago
I wonder why the TFTP[1] is not enough for the US IC, is there any official explanation? https://en.wikipedia.org/wiki/Terrorist_Finance_Tracking_Program https://en.wikipedia.org/wiki/Terrorist_Finance_Tracking_Pro...
- UnoriginalGuy 10y ago
  None of the countries targeted in the NSA slides are part of that program.
starefossen 10y ago
And here is the EastNets' blog post denying the compromise ever happened http://www.eastnets.com/News_Details/17-04-14/No_credibility_to_the_online_claim_of_a_compromise_of_EastNets_customer_information_on_its_SWIFT_service_bureau.aspx http://www.eastnets.com/News_Details/17-04-14/No_credibility...
- UnoriginalGuy 10y ago
  I love them outright denying it, then slowly admitting that the slides reference real elements of their infrastructure that they have since retired. This dump is a few years old. Seems very believable that the NSA compromised their network before 2013 in the way the slides suggest. Plus if their "internal Security Unit" was worth a damn they would have known about this already, rather than finding out about it from this dump. Overall that press release is a little embarrassing, and screams to the tech illiteracy of their senior management. Nobody would publish a press release like this so quickly if they understood the problem scopes in play here (e.g. their Cisco firewalls themselves could have implants!).
throwzaway 10y ago
I am trying to figure out why you are being downvoted
- jacobush 10y ago
  I guessed in the comment above...
- throwzaway 10y ago
  Well seems i got downvoted for asking a simple question. Next time, Keep mum
  - nickpsecurity 10y ago
    A person claimed they already found a vulnerability, maybe reported it or just ignored it, and this was the same vulnerability. That person provided no evidence this was true. My impression was that people were downvoting it because they thought it was a lie (no evidence) or thought an unsupported "me too" claim added nothing to the discussion. You (a) didn't spot that or (b) asked about votes [1]. Both can lead to further downvotes. I just skipped past this whole, pointless section of the comments as I imagine most people do. Some people will downvote stuff like this, though, to clean up the thread or out of irritation. [1] "Please resist commenting about being downvoted. It never does any good, and it makes boring reading."
- dang 10y ago
  We detached this subthread from https://news.ycombinator.com/item?id=14115902 https://news.ycombinator.com/item?id=14115902 and marked it off-topic.
jpalomaki 10y ago
The title does not seem to be accurate. I don't see evidence that whole SWIFT network was compromised. Instead it looks like they compromised one company which connects to the SWIFT network.
- nickpsecurity 10y ago
  That's what it looks like. They were monitoring or getting data from SWIFT before, though. Just can't remember the details. I'd assume they can hack SWIFT, though, given SWIFT probably relies on tech they have 0-days in like most places. Just more monitoring that might catch them. Hopefully...
  - jpalomaki 10y ago
    Yes, that was happening in cooperation with SWIFT in the aftermath of 9/11: https://en.m.wikipedia.org/wiki/Terrorist_Finance_Tracking_Program https://en.m.wikipedia.org/wiki/Terrorist_Finance_Tracking_P... Back then SWIFT had two processing centers, one in EU and one in US. Traffic was replicated to both for resiliency. Later they opened up a new center in Switzerland to be able to keep European data in Europe.
Sephr 10y ago
How is NSA TAO not being held criminally irresponsible by our administration for not patching the still-unreleased exploits that are currently in possession of third parties?
- Chaebixi 10y ago
  > How is NSA TAO not being held criminally irresponsible by our administration Hate to break the news to you about the new administration...
  - sunshinerag 10y ago
    or the previous administration ...
  - akvadrako 10y ago
    or the previous administration ...
- rhizome 10y ago
  What law requires them to do so?
Kinnard 10y ago
I find it interesting that he did not mention Bitcoin or other blockchain based solutions as an alternative to SWIFT. I doubt that that's because the author is unaware of these technologies.
- 1ba9115454 10y ago
  Blockchains are public databases. So wouldn't really be a solution for privacy in this case.
peterwwillis 10y ago
We've known the NSA compromised SWIFT since 2013, that the US has control over SWIFT transactions since 2012, and that the US had been failing to guarantee the privacy of EU citizens' transactions on the network since 2011. We've also known since last year that at least three separate hacks by three separate thieves stole millions of dollars from multiple banks after compromising the SWIFT network. All 11,000 financial institutions connected to the network should just switch to sending their 15 million messages per day using iPhones. Problem solved.
- nickpsecurity 10y ago
  "All 11,000 financial institutions connected to the network should just switch to sending their 15 million messages per day using iPhones. Problem solved." iPhones are in U.S. jurisdiction. That's a bad idea. Instead, they should send P2P or through SWIFT-like intermediary with signed messages GPG-style over TLS-style links via dedicated lines or Internet lines with high-speed port knocking. It all can be done with highly-secure tech. The tech for bottom of stack from secure CPU's to secure kernels even exists already. SWIFT or some other setup just has to buy it with that pile of money they have.
  - deleted 10y ago
    [deleted]
swalsh 10y ago
Correct me if i'm wrong, but i'm pretty sure that OddJob hack has a GUI interface built with Visual basic ;)
stefantalpalaru 10y ago
https://en.wikipedia.org/wiki/Society_for_Worldwide_Interbank_Financial_Telecommunication#U.S._control_over_transactions_within_the_EU https://en.wikipedia.org/wiki/Society_for_Worldwide_Interban... : > On 26 February 2012 the Danish newspaper Berlingske reported that US authorities have sufficient control over SWIFT to seize money being transferred between two European Union (EU) countries (Denmark and Germany), since they have seized around US$26,000 which was being transferred from a Danish businessman to a German bank. The transaction was automatically routed through the US, possibly because of the USD currency used in the transaction which is how the United States was able to seize the funds. The money was a payment for a batch of Cuban cigars previously imported to Germany by a German supplier. As justification for the seizure, the U.S. Treasury stated that the Danish businessman had violated the United States embargo against Cuba.
Nas808 10y ago
Every time something like this breaks I have to take it with a grain of salt. I've been fooled by HN before about "major" security breaches that end up not having much of an impact at all. Cloudflare leak in Feb... sounded like the world was ending here.
- i336_ 10y ago
  You may have noticed that the biggest freakout was from Google. The freakout wasn't due to the incident itself (although obviously everyone was unimpressed the leak happened), it was the fallout: the leaked data was archived in various caches. Google's indexes of the web are the biggest.

296 points by raesene9 10y ago

Perhaps this is one of the reasons Americans don't want to be surveilled unconstitutionally by our own government!

dmix 10y ago

> This release includes logs, excel files, and even for the first time PowerPoint of TOP SECRET documents. This is a first from Shadow Brokers, this would mean ShadowBrokers has definitely more than only tools. I'm curious what the implication is here. Why would a TOP SECRET power point slide be packaged together with malware on an attack server? It's either really sloppy OPSEC by NSA TAO (or random hired contractor) or may just be a collection of files put together by an intel agency/'criminal' hacker group from various sources to embarrass NSA.

posixplz 10y ago
The implication is that they're working directly with leakers. It's pretty hard to imagine that a PPT would be left on operational assets where tools are traditionally found.
- devoply 10y ago
  So why is the NSA leaking all this shit. What's the leading theory on that? It's like just get it all out there, just to preempt an eventual leak? Maybe see who picks up this stuff and uses it? Mis-lead the other side on the capabilities which are actually far superior than a few things which have been released?
  - evilantnie 10y ago
    If we do buy into the fact that the NSA is behind the leaks, it would most likely be in response to some sort of loss-aversion or negative leverage play. i.e. they want to severely devalue these assets on the black market.
  - nickpsecurity 10y ago
    "So why is the NSA leaking all this shit. " It would be insiders who oppose what's going on Snowden-style or plants from a foreign, intelligence service.
- mike_hearn 10y ago
  Aren't we overlooking a rather more likely possibility here - that the NSA has itself been hacked? You're right, I see no reason why slideware would be sitting outside the NSA corporate networks and I'm sure they have various procedures to try and prevent exactly that. The two remaining possibilities are: 1. Another leaker who isn't Snowden 2. A third party who has gained access to the insides of the NSA I don't see why we're apparently ignoring 2 in this thread. The Snowden leaks made it very, very clear that essentially nothing is unhackable. And it's not like the USA has a monopoly on hacking skill. What else do we know about the NSA? That they perform the largest WireSharking in history, they literally parse most of the internet with a giant collection of programs which I will assume are written in C or C++ for the sake of performance (though a lot of Perl seems to crop up for analysis purposes too). What are the chances that the NSA have managed to build a huge network with hugely complex interfacing to the entire internet, and huge amounts of software, without opening themselves up to attack by equally sophisticated attackers? I'd say close to zero.
  - nickpsecurity 10y ago
    "Aren't we overlooking a rather more likely possibility here - that the NSA has itself been hacked?" That's the most obvious one to me. I thought everyone assumed it until I saw some of these comment threads. If it's Russian, it probably goes back to Kaspersky tracking the Equation Group. They put together about everything about how they operated. Giving Russian intelligence this information combined with trip-wires or tip-offs on live activity by NSA hackers would let Russian hackers attempt to own their boxes. They could just work from there. Alternatively, it could be result of long-running infiltrations that U.S. government has been talking about for decades. At various points, U.S. TLA's said China is throwing piles of spies at us in a numbers game whereas Russia was using (I think it was) 4x more than during height of the Cold War. We also know they're easy to infiltrate and have terrible security since Snowden did and showed exactly that. Plus Manning just pulling everything they had from an Army private's account in Middle East. The leaks could've come from infiltrators, too. So, we have infiltrators, hackers via Kaspersky data (or similar), or insiders that for whatever reason want to humiliate them. Whatever Shadow Brokers say about themselves is just propaganda. They're one of the above with probably typical motivations of agents in those categories.
jerf 10y ago
The Shadow Brokers are speculated to be an insider [1] (or my own speculation, a small but >1 group given what we've seen), which would mean that these things are packaged together because they've chosen to package them together, not because they were necessarily proximal "in the wild". [1]: https://en.wikipedia.org/wiki/The_Shadow_Brokers#Speculations_and_theories_on_motive_and_identity https://en.wikipedia.org/wiki/The_Shadow_Brokers#Speculation...
Bartweiss 10y ago
Yeah, this is fascinating. I thought the prior understanding was that Shadow Brokers had found/located a TAO box which had unintentionally been left with a full pen suite. That was an interesting error already, but this implies either a ludicrous screwup (how would you even package those together?) or some much deeper compromise.

ryanmarsh 10y ago

Is anyone else as horrified by this as I am? Bitcoin being a sewer rat, and the banking system being a bubble boy, I knew a day would come when the bubble boy would be exposed to something bitcoin had grown immune to, get sick, and possibly die. I didn't know his protective bubble was already gone. I thought these banks all communicated on leased lines and weren't exposed to the public internet. Is there any indication that a criminal hacker gang couldn't have compromised this or other SWIFT service bureau's or banks in a similar manner? Which fiat bank will be the first Mt Gox?

nickpsecurity 10y ago
"Is anyone else as horrified by this as I am?" My quick skim shows they're gaining information about transactions in Middle East and Panama. One is essentially a hotbed of competing interests among imperialists and terrorism. The U.S. invaded two countries over there. There's proxy war going on in another. Far as Panama, it's one of leading spots for rich people, threatening or just tax-dodging, to set up offshore accounts, companies, and so on. They use it to hide their transactions. FinCEN has been fighting for access to tax haven data for years. No surprise NSA is monitoring illegal, money moving given targets of interests might be involved in it in that specific place.
- ryanmarsh 10y ago
  It's clear why they're penetrating those networks and it's at least arguable they have cause too. My comment was about the security house of cards surrounding the fiat banking system.
- lovich 10y ago
  What's illegal or not changes with political winds, and if they can access one part of the system the rest is now circumspect
  - nickpsecurity 10y ago
    It really doesn't. Spy agencies have been collecting economic and military intelligence on foreign countries and companies since their inception. It was a NSA apologist that correctly noted that each country with a spy agency makes it illegal for people to spy on them, complains about it internationally, and then funds an agency to spy on everyone else for their own benefit. Regardless of what laws or technicalities say, all these countries with spy agencies want foreign spying to happen & legally endorse it by creating said agencies. This should be expected. Even if they made it illegal, I still wouldn't trust them as they'd try to do something to get an edge on negotiations. That something would be illegal activity they outsourced to mercenary organizations or partnered with nations with spy organizations with some benefit promised back to them. For example, nearly all of Europe has intelligence sharing agreements per Snowden leaks with the very agency (NSA) they're publicly griping about. Only 3 didn't in whatever deal that was: Switzerland, Iceland, and one other I can't remember.

nickpsecurity 10y ago

Alright, maybe SWIFT will be interested in high-assurance systems now. Any day now they'll start applying the best of real INFOSEC to a world-wide, financial-transfer network. Any day now... Probably not lol...

walterbell 10y ago
Are any of these meaningful? https://www.swift.com/myswift/customer-security-programme-csp_/security-announcements https://www.swift.com/myswift/customer-security-programme-cs...
- nickpsecurity 10y ago
  I can't glean useful information out of it except to note Fox-IT has some experts on hand that can help. They were mentioned. The hacks usually come from malicious insiders, social engineering of benign insiders, bad configurations, bad protocols, and especially 0-days in software. The interim solution should then be hardened OS with strong TCB, use of proven protocols, secure-by-default configuration, auditing/monitoring by third-parties for malicious insiders, and controls for both malicious and benign insiders. SWIFT's headlines indicate a lot of software implementing controls, analysis, and so on. I didn't see anything at a glance about making the implementation of those software, their protocols, or their OS's bulletproof. So, I still don't trust them. This looks like the same shit management in banking and "security" industries come up with all the time. You know, the stuff used in dozens of companies that got bypassed by so-called "APT's" that sent emails with infected PDF's and Excel documents. Really "advanced" attacks it takes. Haha. Trick is, you need both the security features and assurance they're secure. Most of industry focuses on former where my type focuses on latter as much as possible. ;)
  - walterbell 10y ago
    Have you seen Skyport's hardened server? Excluding the "cloud management" portion, it looks promising on paper, https://www.skyportsystems.net/wp-content/uploads/2017/02/Datasheet-SkySecure-Server-On-Premises-Hyper-Secured-Infrastructure.pdf https://www.skyportsystems.net/wp-content/uploads/2017/02/Da... Microsoft's PAW definition covers related topics, https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/privileged-access-workstations https://technet.microsoft.com/en-us/windows-server-docs/secu...

lallysingh 10y ago

I'm not surprised that an agency tasked with counter terrorism is intercepting/manipulating wire transfers.

jcriddle4 10y ago
The US government already has legal and very broad access to SWIFT for anything even slightly terror related.
- gruturo 10y ago
  > The US government already has legal and very broad access to SWIFT for anything even slightly terror related. Not really. SWIFT maintains multiple datacenters outside the US so that transactions between 2 non-US actors don't touch US-based computers and are therefore not (easily, officially) accessible by the US government.

walterbell 10y ago

> Windows XP/2003 has been unsupported for more than 3 years. This means that security vulnerabilities found on those systems will never be corrected. Windows Embedded 2009 (based on XP) is receiving security updates until 2019.

Globz 10y ago

is there a particular reason why ALL of them are using the same subnet 192.168.200.*?

ganoushoreilly 10y ago
Because they likely have an operational network for each work group that's mirrored, using standard configurations to maintain continuity across tools, techniques, and procedures.

raesene9 10y ago

It's worth following @hackerfantastic (https://twitter.com/hackerfantastic https://twitter.com/hackerfantastic) on twitter at the moment as he's looking through some of the exploits that were dropped along with this documents. Highlights so far are a 0-day in windows from NT-->2012 which reliably exploits over the SMBv2 port and a bunch of other stuff. (https://twitter.com/hackerfantastic/status/852915886650527744 https://twitter.com/hackerfantastic/status/85291588665052774...)

fpp 10y ago
sounds familiar - we found that one 1996 when doing system programming on NT (NuMega SoftIce was your best friend together with material published by Mark Russinovich prior of him working with MS - remember when you were doing e.g. a file system driver at that time there was close to zero documentation by MS and half of what they provided was wrong). Demonstrated then how to use it to log onto remote Windows systems over the I-Net and gain Admin rights. I thought this one with all what was published about it long ago would be well known since. Astounded that it took so long to fix and that it passed on through generations of Windows version. Almost certain similar can be said of other low level "bugs".
- jacobush 10y ago
  I am sorry, we can't bash Microsoft anymore, they are on Github now!
- hexadecimated 10y ago
  How do you know it's the same bug?
  - fpp 10y ago
    same result - only one issue like that known to me So of course I could be wrong and this issue is not the only one in that protocol implementation / sys component(s)
- MichaelMoser123 10y ago

pera 10y ago

I wonder why the TFTP[1] is not enough for the US IC, is there any official explanation? https://en.wikipedia.org/wiki/Terrorist_Finance_Tracking_Program https://en.wikipedia.org/wiki/Terrorist_Finance_Tracking_Pro...

UnoriginalGuy 10y ago
None of the countries targeted in the NSA slides are part of that program.

starefossen 10y ago

And here is the EastNets' blog post denying the compromise ever happened http://www.eastnets.com/News_Details/17-04-14/No_credibility_to_the_online_claim_of_a_compromise_of_EastNets_customer_information_on_its_SWIFT_service_bureau.aspx http://www.eastnets.com/News_Details/17-04-14/No_credibility...

UnoriginalGuy 10y ago
I love them outright denying it, then slowly admitting that the slides reference real elements of their infrastructure that they have since retired. This dump is a few years old. Seems very believable that the NSA compromised their network before 2013 in the way the slides suggest. Plus if their "internal Security Unit" was worth a damn they would have known about this already, rather than finding out about it from this dump. Overall that press release is a little embarrassing, and screams to the tech illiteracy of their senior management. Nobody would publish a press release like this so quickly if they understood the problem scopes in play here (e.g. their Cisco firewalls themselves could have implants!).

throwzaway 10y ago

I am trying to figure out why you are being downvoted

jacobush 10y ago
I guessed in the comment above...
throwzaway 10y ago
Well seems i got downvoted for asking a simple question. Next time, Keep mum
- nickpsecurity 10y ago
  A person claimed they already found a vulnerability, maybe reported it or just ignored it, and this was the same vulnerability. That person provided no evidence this was true. My impression was that people were downvoting it because they thought it was a lie (no evidence) or thought an unsupported "me too" claim added nothing to the discussion. You (a) didn't spot that or (b) asked about votes [1]. Both can lead to further downvotes. I just skipped past this whole, pointless section of the comments as I imagine most people do. Some people will downvote stuff like this, though, to clean up the thread or out of irritation. [1] "Please resist commenting about being downvoted. It never does any good, and it makes boring reading."
dang 10y ago
We detached this subthread from https://news.ycombinator.com/item?id=14115902 https://news.ycombinator.com/item?id=14115902 and marked it off-topic.

jpalomaki 10y ago

The title does not seem to be accurate. I don't see evidence that whole SWIFT network was compromised. Instead it looks like they compromised one company which connects to the SWIFT network.

nickpsecurity 10y ago
That's what it looks like. They were monitoring or getting data from SWIFT before, though. Just can't remember the details. I'd assume they can hack SWIFT, though, given SWIFT probably relies on tech they have 0-days in like most places. Just more monitoring that might catch them. Hopefully...
- jpalomaki 10y ago
  Yes, that was happening in cooperation with SWIFT in the aftermath of 9/11: https://en.m.wikipedia.org/wiki/Terrorist_Finance_Tracking_Program https://en.m.wikipedia.org/wiki/Terrorist_Finance_Tracking_P... Back then SWIFT had two processing centers, one in EU and one in US. Traffic was replicated to both for resiliency. Later they opened up a new center in Switzerland to be able to keep European data in Europe.

Sephr 10y ago

How is NSA TAO not being held criminally irresponsible by our administration for not patching the still-unreleased exploits that are currently in possession of third parties?

Chaebixi 10y ago
> How is NSA TAO not being held criminally irresponsible by our administration Hate to break the news to you about the new administration...
- sunshinerag 10y ago
  or the previous administration ...
- akvadrako 10y ago
  or the previous administration ...
rhizome 10y ago
What law requires them to do so?

Kinnard 10y ago

I find it interesting that he did not mention Bitcoin or other blockchain based solutions as an alternative to SWIFT. I doubt that that's because the author is unaware of these technologies.

1ba9115454 10y ago
Blockchains are public databases. So wouldn't really be a solution for privacy in this case.

peterwwillis 10y ago

We've known the NSA compromised SWIFT since 2013, that the US has control over SWIFT transactions since 2012, and that the US had been failing to guarantee the privacy of EU citizens' transactions on the network since 2011. We've also known since last year that at least three separate hacks by three separate thieves stole millions of dollars from multiple banks after compromising the SWIFT network. All 11,000 financial institutions connected to the network should just switch to sending their 15 million messages per day using iPhones. Problem solved.

nickpsecurity 10y ago
"All 11,000 financial institutions connected to the network should just switch to sending their 15 million messages per day using iPhones. Problem solved." iPhones are in U.S. jurisdiction. That's a bad idea. Instead, they should send P2P or through SWIFT-like intermediary with signed messages GPG-style over TLS-style links via dedicated lines or Internet lines with high-speed port knocking. It all can be done with highly-secure tech. The tech for bottom of stack from secure CPU's to secure kernels even exists already. SWIFT or some other setup just has to buy it with that pile of money they have.
- deleted 10y ago
  [deleted]

swalsh 10y ago

Correct me if i'm wrong, but i'm pretty sure that OddJob hack has a GUI interface built with Visual basic ;)

stefantalpalaru 10y ago

https://en.wikipedia.org/wiki/Society_for_Worldwide_Interbank_Financial_Telecommunication#U.S._control_over_transactions_within_the_EU https://en.wikipedia.org/wiki/Society_for_Worldwide_Interban... : > On 26 February 2012 the Danish newspaper Berlingske reported that US authorities have sufficient control over SWIFT to seize money being transferred between two European Union (EU) countries (Denmark and Germany), since they have seized around US$26,000 which was being transferred from a Danish businessman to a German bank. The transaction was automatically routed through the US, possibly because of the USD currency used in the transaction which is how the United States was able to seize the funds. The money was a payment for a batch of Cuban cigars previously imported to Germany by a German supplier. As justification for the seizure, the U.S. Treasury stated that the Danish businessman had violated the United States embargo against Cuba.

Nas808 10y ago

Every time something like this breaks I have to take it with a grain of salt. I've been fooled by HN before about "major" security breaches that end up not having much of an impact at all. Cloudflare leak in Feb... sounded like the world was ending here.

i336_ 10y ago
You may have noticed that the biggest freakout was from Google. The freakout wasn't due to the incident itself (although obviously everyone was unimpressed the leak happened), it was the fallout: the leaked data was archived in various caches. Google's indexes of the web are the biggest.