ShadowBrokers Put Price on Monthly Zero Day Leaks

The threat posed by the first wave of ShadowBrokers leaks of Equation Group hacking tools was relatively benign. Some vendors had to scramble to patch zero days in older versions of products, but for the most part, the leaks and accompanying auction were more of a novelty. That obviously changed...

On WannaCry, the KillSwitches, and the Possible Lazarus Group Connection

Mike Mimoso and Chris Brook discuss WannaCry, Microsoft’s response, the killswitches, a potential link with Lazarus Group, and what the future holds for the ShadowBrokers. Download: ThreatpostNewsWrapMay192017.mp3 Music by Chris Gonsalves...

Next Payload Could be Much Worse Than WannaCry

No one should be letting their guard down now that the WannaCry ransomware attacks have been relatively contained. Experts intimately involved with analyzing the malware and worldwide attacks urge quite the opposite, warning today that there’s nothing stopping attackers from using the available N...

ShadowBrokers Planning Monthly Exploit, Data Dump Service

Popcorn in hand, the ShadowBrokers say they’re taking in the WannaCry outbreak from the sidelines before starting in June a subscription service for new exploits and stolen data akin to a wine of the month club. In what’s become a signature periodic rant from the unknowns behind the leak of...

Leaked NSA Exploit Spreading Ransomware Worldwide

A ransomware attack running rampant through Europe today is spreading via an exploit leaked in the most recent ShadowBrokers dump. Researchers at Kaspersky Lab said the attackers behind today’s outbreak of WannaCry ransomware are using EternalBlue, the codename for an exploit made public by the...

MS17-010 SMBv1 SrvOs2FeaToNt OOB Remote Code Execution

Exploit Author: Juan Sacco at KPN Red Team - http://www.kpn.com Date and time of release: May, 9 2017 - 13:00PM Found this and more exploits on my open source security project: http://www.exploitpack.com MS17-010 - https://technet.microsoft.com/en-us/library/security/ms17-010.aspx Tested on:...

The Time Has Arrived to Embrace Hackers

BOSTON—More than ever, hackers are getting a welcoming embrace from law enforcement, governments and business. Bug bounties and vulnerability disclosure programs are becoming the norm across industry, and hackers are no longer universally viewed as a pariah. Simultaneously, however, groups such a...

NSA's DoublePulsar Kernel Exploit In Use Internet-Wide

If you’re on a red team or have been on the receiving end of a pen-test report from one, then you’ve almost certainly encountered reports of Windows servers vulnerable to Conficker MS08-067, which has been in the wild now for nearly 10 years since the bug was patched. A little more than two weeks...

On The Latest ShadowBrokers Dump, Microsoft, Oracle, and the Bosch OBD-II Dongle Hack

Mike Mimoso and Chris Brook discuss the news of the week, including last Friday’s ShadowBrokers dump, how Microsoft learned and patched the vulnerabilities, and the Solaris bugs patched by Oracle. Microsoft ditching passwords, and a new car dongle hack are also discussed. Download:...

Record Oracle Patch Update Addresses ShadowBrokers, Struts 2 Vulnerabilities

Oracle released its biggest Critical Patch Update ever on Tuesday, and with it came added urgency in the form of patches for the Solaris vulnerabilities exposed by the ShadowBrokers last week, as well as the recent Apache Struts 2 vulnerability, also under public attack. In all, Oracle admins hav...

ShadowBrokers' Windows Zero-Days Already Patched

Hours after what was thought to be a damaging release of NSA hacking tools for Windows systems, Microsoft quelled some anxiety with a late-night statement on Friday that most of the vulnerabilities disclosed by the ShadowBrokers had already been patched. The biggest surprise was that the most...

ShadowBrokers Expose NSA Access to SWIFT Service Bureaus

The NSA used exploits to target two SWIFT Service Bureaus in order to access banking data from a number of financial institutions in the Middle East. The access was likely used to monitor funding for terrorist operations, experts said today as analysis continues of the latest ShadowBrokers dump o...

ShadowBrokers Dump More Equation Group Hacks, Auction File Password

The mysterious ShadowBrokers, long thought to have given up their cause, released on Saturday additional hacking tools allegedly belonging to the Equation Group, along with the password guarding the original set of exploits the group planned to auction off. The password was at the tail end of a...

Saying Goodbye to the ShadowBrokers, GoDaddy's Domain Validation Issue, and More

Mike Mimoso and Chris Brook discuss the news of the week, including the ShadowBrokers’ farewell, GoDaddy’s buggy domain validation issue, MongoDB ransoms, and the latest with St. Jude Medical. Show notes: ShadowBrokers Bid Farewell, Close Doors ShadowBrokers Selling Windows Exploits, Attack Tools...

ShadowBrokers Bid Farewell, Close Doors

The ShadowBrokers are no more. The group or individual responsible for multiple leaks of exploits and attack tools believed to belong to the NSA said today they have closed up shop and deleted all of their online accounts. “Despite theories, it always being about bitcoins for TheShadowBrokers. Fr...

ShadowBrokers Selling Windows Exploits, Attack Tools

The latest Shadowbrokers dump of alleged NSA tools—a cache of Windows exploits—surfaced over the weekend. And for the first time since these unannounced releases started last summer, analysts don’t have the luxury of a free set of files to dig in to. The group is selling the database for 750...

ShadowBrokers Dumps List of Equation Group Hacked Servers

The ShadowBrokers’ last two bits of outreach to the world lacked the oomph of August’s showstopper dump of Equation Group zero days, but the group is more than making up for it in severely broken English political banter, and another plea to buy the full boat of NSA exploits it allegedly has...

Cisco Warns of IOS Flaw Vulnerable to ShadowBrokers Attack

Cisco is warning its customers of new activity around the ShadowBrokers data dump, indicating that all versions of its IOS, IOS XE and IOS XR software are vulnerable to one of the many exploits released more than a month ago. “Cisco Product Security Incident Response Team PSIRT is aware of...

DHS Urges Vigilance in Protecting Networking Gear

After a summer of high-profile attacks and disclosures centered around enterprise network infrastructure, the Department of Homeland Security on Tuesday put out an alert explaining some of the tactics used by advanced attackers, and urged special caution in maintaining supply chain integrity. The...

On Shadowbrokers, Cisco, Sweet32, Wildfire, and More

Mike Mimoso and Chris Brook discuss the news of the week, including the latest on ShadowBrokers and Cisco, the Sweet32 collision attack, decryptors for the Wildfire ransomware, and this week’s gaming forum breaches. Download: ThreatpostNewsWrapAugust262016.mp3 Music by Chris Gonsalves...