Compliance , PCI

How PCI Acceptance Has Improved Security A Look at How Far Payments Security Has Come in 10 Years Tracy Kitten (FraudBlogger) • August 15, 2016    

Over the last several weeks, my colleagues and I have reviewed the state of PCI compliance in recognition of the upcoming 10-year anniversary of the PCI Security Standards Council.

See Also: API vs. Proxy: Understanding How to Get the Best Protection from Your CASB

We've asked experts in the U.S. Europe, India and Australia to offer their opinions about the efficacy of the PCI Data Security Standard and whether it will still be needed 10 years from now (see PCI DSS: The Asian Journey to Compliance). We've also spoken with experts on the PCI Council, too, including General Manager Stephen Orfei, Chief Security Officer Troy Leach and International Director Jeremy King. And the over-arching message has been the same - PCI may not be perfect, but its widespread adoption has dramatically improved card security. And the need for PCI is not going away anytime soon.

It's easy to look at the payments landscape and see only the flaws, the security lapses and the breaches. Even with EMV chip deployment taking hold in the U.S. and in other parts of the world, important security issues remain (see Alleged EMV Flaw Stirs Debate). Payment card data is going to be vulnerable for quite some time - at least until the magnetic stripe is completely replaced with the chip, whether on a card or within a mobile device.

But if we step back a bit and get some perspective, we have to appreciate how far payments security has come.

Plenty of Progress

Think back to 10 years ago, when hackers, including Albert Gonzalez - one of the masterminds behind the attacks against retailers TJX, Hannaford Brothers and 7-Eleven and payments processor Heartland Payment Systems - were breaking through network firewalls with relative ease to steal credit and debit numbers.

Those attacks opened our eyes to just how insecure security practices surrounding payment card transactions actually were.

Beyond storing card data in the clear, weak perimeter security had made it relatively easy for hackers to infiltrate networks and systems to exfiltrate card data at rest and in transit.

Today, we would never consider a firewall, on its own, sufficient network protection. And anyone storing card data without encrypting it would be slapped with a huge fine from the card brands for blatant disregard for complying with PCI security requirements.

"Ten years ago, people weren't doing anything," Bob Russo, the former general manager of the PCI Security Standards Council, says of inadequate security measures. "A breach opens everybody's eyes. But you have to keep reminding them."

PCI expert Anton Chuvakin, a research director at the consultancy Gartner, says most merchants today understand that PCI compliance is a baseline for security. Ten years ago, that was not the case.

"PCI has been a major positive," he says. "Compare 2007 to 2016. A lot of blatantly idiotic insecurities have been 'PCI-ed out,' making it safer for everybody. Has PCI 'fixed' everything? No, of course not. But nothing can 'fix' crime."

The Long-Term Impact

The breaches we've seen over the last decade have become increasingly more sophisticated. But our breach response strategies have become more sophisticated, too, in part because of widespread acceptance and adoption of PCI DSS, says Jeffrey Man, security advocate at Tenable Network Security.

"When I first started with PCI back in 2004, unencrypted cardholder data (including sensitive authentication data) was everywhere," Man says. "One of my first clients was one of the major payment processors. There was pretty much no encryption available back then, at least for databases, so millions of records were being stored unencrypted and compensating controls were relied upon to protect that data. But there were also stored caches and flat files of transaction data on the POS systems, routers, switches, file servers - just about any place you could think of to look for cardholder data back then you could find it."

Reflecting back on the early days of the council, Russo says its members initially believed they could create a standard, work for about five years to ensure it was adopted, and then card security would no longer be a major issue.

"We thought everything would be secure by then," he says. "We thought EMV was going to be the panacea; and we thought PCI might go away. Now we know that is not the case. Will PCI have to evolve? Yes. But I think PCI and EMV will come closer and closer together. In 10 years, they may not call it PCI. But there will be some form of PCI security 10 years from now."

We also now know that PCI compliance is not a one-time goal, but an ongoing process, Man says.

"The payment industry is changing quickly, with new payment methods, mobile payments, EMV and tokenization," Man says. "All of these will change the landscape significantly. But what will not change is the effort of hackers to steal data and commit fraud. The technology is evolving, but the fundamentals of sound data, information and cybersecurity do not change. The challenge of security is due diligence and a certain amount of paranoia. No company is compliant (or secure) if they focus on an annual compliance assessment and overly rely on automated tools and security solutions to provide the necessary level of security. There is no substitute for trained personnel that know the network, the data flows, what's 'normal' and can more likely and quickly detect the abnormalities that are the indicators of compromise."

The Biggest Challenge

PCI has been criticized and challenged, but it's finally evolving into a set of standards to ensure basic card security. The biggest challenge, however, continues to be global adoption, especially among smaller merchants who find the PCI DSS to be quite complex.

Last month, the PCI Council addressed this issue in a compliance resource guide designed for small to mid-sized merchants (see Can Banks Help Small Merchants with PCI?). The resource aims to simplify the compliance process for merchants by helping them identify the requirements that are most critical.

Taking the complexity out of PCI DSS compliance is a huge first step. Also important is educating merchants about why the basic security measures outlined in PCI DSS and other standards are so critical.

Today, most merchants, regardless of their size, finally recognize the need for security. And that's huge progress from where we were 10 years ago.

So, is PCI working? Yes. But its impact will continue to evolve.

Anti-Malware , Fraud , Phishing

Attackers Increasingly Favor Ransomware Over Banking Trojans, FireEye Says Mathew J. Schwartz (euroinfosec) • August 18, 2016    

Cybercriminals wielding Locky crypto-locking ransomware are continuing to ramp up their assaults, especially in the healthcare sector, with attackers distributing less banking malware and more ransomware, according to new research.

See Also: API vs. Proxy: Understanding How to Get the Best Protection from Your CASB

So far this month, several "massive" new phishing campaigns have been launched, targeting victims in multiple industries with Locky ransomware, security researcher Chong Rong Hwa from cybersecurity firm FireEye says in a blog post (see Report: Most Phishing Emails Pack Ransomware).

As in recent months, healthcare remains the sector most frequently targeted by Locky ransomware. So far in August, other oft-targeted industries include telecommunications, manufacturing, aerospace/defense, financial services and government agencies, according to FireEye. Organizations in the United States were most targeted, followed by Japan, South Korea, Thailand, Singapore and Germany.

Attackers often focus on healthcare organizations and other firms that have "time-sensitive records," according to Mark Rasch, security evangelist at Verizon Enterprise Solutions. That's because even if those organizations are well-prepared to detect, block or recover from a ransomware infection, they may not have the time to do so, and thus may have greater incentives to pay a ransom in exchange for decryption keys (see Ransomware: Is It Ever OK to Pay?).

The Rise of Locky

Industries most targeted by Locky ransomware in August 2016. Source: FireEye

Locky, which first appeared early this year, has become one of the most prevalent types of ransomware. Its name derives from it adding a .locky extension to encrypted files. Once the ransomware encrypts data on a PC, it typically demands a ransom of between 0.5 and 1 bitcoins ($288 to $577), according to Paul Ducklin, a senior security adviser at security firm Sophos. He says spam emails with Locky attachments often urge recipients to enable macros, so the ransomware can run. "Don't do it," he stresses.

It's not clear who created Locky, although some security experts suspect it's the work of whoever created the Dridex banking Trojan and that the culprits are most likely Russian. Security firm Symantec says that Locky and Dridex have in some cases been distributed by the same spam affiliate group.

JavaScript Out, DCOM Files In

In August, FireEye's Chong says, many Locky-wielding attackers appear to have shifted away from using a JavaScript-based downloader contained in a compressed ZIP file to infect endpoints with Locky. Instead, they're using XML-based .docm files attached to phishing emails. Microsoft Word .docm files are like .docx Word files, except they can also be used to execute macros.

Many cybercrime groups employ automated cybercrime exploit kits to distribute not just banking malware but also ransomware, as was seen in a recent campaign that used the Necurs exploit kit to distribute Dridex banking malware as well as Locky (see Cisco Eyes Ties Between Angler and Lurk Malware).

But at least recently, attackers are distributing less banking malware and more ransomware, Chong says. "We have observed that the delivery of Dridex via this distribution channel seems to have stopped, or nearly so, which could explain why we are seeing the Locky uptick."

Other security firms confirm that in recent weeks, Locky attacks have surged. "These attacks were among the largest campaigns we have ever observed, peaking at hundreds of millions of messages a day," according to a report released last month by the cybersecurity firm Proofpoint. Between April and June, it adds, 69 percent of all malicious email attachments seen in the wild were some form of Locky.

Brazilian Locky Taps Windows Script Files

Whoever is distributing - or helping to distribute - Locky recently began using Windows Script Files to download the ransomware onto victims' PCs, researchers at security firm Trend Micro say in a blog post. The new variant, first seen in the wild on July 15, is being sold on underground Brazilian cybercrime sites, the researchers say.

"WSF is a file that allows the combination of multiple scripting languages within a single file," they say, noting that the WSF files arrive via inside .zip files attached to spam emails that sport email subject lines such as "annual report," "bank account record" and "company database."

The gang behind Cerber ransomware also has used WSF files since May, the Trend Micro researchers say (see Cerber 2 Ransomware: Free Decryption Tool Released). "It would seem that the attackers behind Locky followed Cerber in using WSF files after seeing how such a tactic was successful in bypassing security measures like sandbox and blacklisting technologies ... since it has no static file type," the researchers say. "In addition, using blended scripting languages could result to the samples being encoded, making these arduous to analyze."

Opening Unknown Attachments: Think Twice

Locky is designed to encrypt not just the hard drive of the PC it infects, but also any attached drives and network shares, potentially including any other PC or server that it can access via a local area network. Like many other types of ransomware, Locky also deletes Volume Snapshot Service files, a.k.a. shadow copies, that could otherwise be used to help restore forcibly encrypted files.

Locky often spreads via email attachments. "These latest campaigns are a reminder that users must be cautious when it comes to opening attachments in emails or they run the risk of becoming infected and possibly disrupting business operations," Chong says.

Ducklin at Sophos says one related defense is to download Microsoft Office viewers - applications that "let you see what documents look like without opening them in Word or Excel itself." The viewers do not support macros, thus automatically preventing macro-based malware from executing.

To help block Locky attacks, Trend Micro also recommends stripping all WSF files from incoming emails.

Authentication , Biometrics , Technology

NICE Actimize's Mary Ann Miller on Banks' Emerging Strategies Tracy Kitten (FraudBlogger) • August 18, 2016    

Banks need to develop multifactor customer authentication strategies that meet demand for strong security as well as convenience, says Mary Ann Miller, an executive adviser at anti-fraud solutions provider NICE Actimize.

See Also: Data Security Risk: A CISO's Perspective

Many banks are focusing on shoring up customer authentication mechanisms by coupling biometrics with other forms of authentication, such as one-time passcodes or even analytics. But forcing customers to go through additional steps can hinder the customer experience, Miller says.

"There's a lot of experimentation going around what I call form factors - the modality of authentication," she says in this video interview with Information Security Media Group. "So you'll see a lot of modalities like biometrics, from facial [scans] to using the thumbprint. But you'll also see financial institutions focusing on management of that authentication journey, too. In combination with looking at experimental new form factors, [they're looking at] actually how do you manage that new form factor and manage that customer experience."

Banks need to carefully consider the types of authentication their customers will accept and use, Miller says. "What we're finding in the industry is that customers really want an easy journey," she says. "They're really looking for strength of security, but they're also looking for customer convenience as well. "

In this video interview at ISMG's recent New York Fraud and Breach Prevention Summit, Miller discusses:

How institutions are using analytics and other back-end data to authenticate users; Why biometrics is not the panacea it was expected to be; and Why additional log-in steps can hinder the online banking experience.

Miller, who specializes in enterprise fraud and risk management, has more than 20 years of experience in decision analytics, operational excellence and customer centricity. She consults with financial institutions worldwide to establish business and technology strategies.

ID & Access Management , Risk Management , Technology

Amnesia Project Tackles Password Security App Splits Up Information Needed to Generate Full Password Jeremy Kirk (jeremy_kirk) • August 15, 2016    

There's no lack of enthusiasm for trying to change the way we log into services. The weaknesses of passwords are well known, ranging from poor password choices to reusing the same ones over and over. There aren't a lot of good alternatives that can easily supplant the current system, so we're stuck with trying to raise the authentication fence a bit higher in hopes of improving security.

See Also: API vs. Proxy: Understanding How to Get the Best Protection from Your CASB

A former undergraduate student in the computer science department at the College of William and Mary thinks he's come up with a more secure system. He recently presented his peer-reviewed research paper at the 36th IEEE International Conference on Distributed Computing Systems in Nara, Japan.

His system is a password manager without a vault. Password managers are helpful in that they aid in creating and storing complex passwords, but most store those passwords in an encrypted vault. Often, that vault is protected by a master password. All accounts are compromised if the master password is stolen.

Luren Wang's project, called Amnesia, isn't perfect, but it eliminates the weakness of password vaults. It's a generative password manager that uses a combination of information from different sources to reconstruct a password.

Amnesia uses a secret, 256-bit value that is stored in a table on a user's phone. When a user needs a password for a website, the phones passes the secret token to the Amnesia server, which combines it with other secrets stored on the server to construct the password and sends it back to the computer.

"The information that generates the passwords is decentralized, so there's no one point of failure," says Wang, who is now studying for a master's degree in machine learning at Columbia University.

Still a Research Project

Rick Redman of the security consultancy KoreLogic, who reviewed Wang's paper, says the idea of a secret token sent from the phone could be used to augment one-time passcodes sent by SMS, used by many two-factor authentication schemes.

"This is a nice touch," Redman says. "This idea could easily be incorporated into other phone-based 2FA software products that are already well-vetted and tested."

Redman advised that an organization would probably want to host its own Amnesia server rather than relying on cloud providers to host one as suggested in Wang's paper.

One big advantage to Amnesia is that it doesn't require website operators to make any modifications to their login systems while increasing security. In order to compromise a password, an attacker would have to compromise both the Amnesia server and a person's phone. That's far from impossible, but still increases the security around the passwords.

If someone's phone is stolen or lost, the Amnesia master password can be used to set up a new phone. If the Amnesia server is compromised, there's not enough information to successfully steal someone's passwords.

"Though the attackers are able to compromise either the user's smartphone or the master password of the password manager, we assume they cannot compromise both the smartphone and the master password without the user noticing and taking reactive measures," the paper notes.

Areas of Concern

Still, there are other avenues of attack, such as if someone's computer has become infected with a keylogger. Also, the storage of the phone-side secret could be stronger, Redman says. Changing passwords can also be tricky, as generative password managers rely on static information to deliver a password. Wang's paper outlines other potential problems, such as a compromised HTTPS connection and a breach of an Amnesia server, which, while not divulging full passwords, could present social engineering opportunities for an attacker.

It's also not quite as convenient as a password manager, such as LastPass, which quickly autofills stored passwords. With Amnesia, users have to perform an extra click to request a password. A notification of the request pops up on the phone with an IP address, which the user has to approve before it is processed. But it's still easier that two-factor authentication, which often requires a six-digit code to be submitted.

Amnesia is still in the realm of a research project and isn't product ready, Wang says. But a prototype of Amnesia for Android was built, although Wang admits the code wasn't that smooth. Testing of Amnesia with users went well, with the primary complaint of an "ugly UI," he says.

Info Sharing , Network & Perimeter , Technology

Has the US Long Known About the Vulnerabilities? Jeremy Kirk (jeremy_kirk) • August 18, 2016    

Cisco is preparing a patch for a zero-day vulnerability in its firewalls revealed by an unprecedented dump of data from a group allegedly linked to the U.S. National Security Agency. The vulnerability reveals that at least some of the aging attack code in the dump remains potent. That finding may also stoke longstanding concerns that the U.S. government isn't disclosing critical vulnerabilities soon enough to vendors, which could be used by competing spy agencies.

See Also: How to Illuminate Data Risk to Avoid Financial Shocks

Cisco wasn't the only vendor affected by the data dump, released by a mysterious group calling itself the Shadow Brokers. The files show Fortinet, Juniper, WatchGuard and Chinese firewall vendor TopSec were also targeted with attack code designed to compromise firewalls - a crucial piece of networking equipment (see Mystery Surrounds Breach of NSA-Like Spying Toolset).

Fortinet has already issued a patch for a vulnerability revealed via the data dump.

The leaked files are strongly believed to have originated with the Equation Group, an advanced cyber-espionage group first outed by Kaspersky Lab. Many security experts theorize that the Shadow Brokers might be affiliated with Russia - already at odds with the U.S. over cyberattacks against the Democratic Party - or might be someone who worked inside the NSA's Tailored Access Operations group (see Confirmed: Leaked Equation Group Hacking Tools Are Real).

"We're getting to a whole new level of breaches and leaks," says Jerome Segura, lead malware intelligence analyst with Malwarebytes. "First private corporations, now governments and agencies. It seems nothing can stay protected anymore."

Vulnerability Information Sharing Deficit?

The NSA has never confirmed if it is the Equation Group. But if experts have pegged the connection correctly, it begs questions over how committed the U.S. government is to sharing vulnerability information with private vendors.

There has been fierce debate over when U.S. intelligence agencies should share information on vulnerabilities they discover with affected vendors. The software flaws can be used for intelligence operations, but the longer the flaws go unpatched, the greater the chance another party may discover it, including competing cyber spies.

The U.S. government put in place a framework called the Vulnerabilities Equities Process in 2010 for notifying vendors of software flaws it found. But intelligence agencies are allowed to keep the information secret for compelling national security reasons. The VEP has been criticized by organizations, including the Electronic Frontier Foundation, as being opaque.

The Cisco zero-day vulnerability would appear to have been closely held. "I imagine that there are different types of exploits, and the extremely valuable ones may be kept secret because of existing operations or great leverage for cyber warfare," Segura says.

It's a significant vulnerability, too, allowing an attacker to gain full control of the firewall, according to an Aug. 17 Cisco advisory. Secret NSA documents leaked in 2013 showed the agency has long specialized in penetrating firewalls, as they're a pivotal network point, providing visibility into all network traffic flows.

The most recent files in the Equation Group leak come from 2013. If the Equation Group is the NSA, the agency has long known of the flaw. If the Shadow Brokers is affiliated with Russia, meanwhile, that's also a concern, because it means the Russians have also long known of the flaw and perhaps used it offensively.

"It sure is strange when your company doesn't just have to worry about attacks from foreign intelligence agencies, but from your own as well," says Mikko Hypponen, chief research officer for Finnish security firm F-Secure, via Twitter.

A U.S. company blogs about attacks against their products, done by U.S intelligence agency. https://t.co/YiqSauozTC pic.twitter.com/7FnEk1oDpF

More Grief for Cisco, Customers

Cisco was outspoken following documents leaked in 2013 via former NSA contractor Edward Snowden, which revealed the agency's "interdiction" operations, which involved secretly intercepting Cisco equipment en route to customers and adding spying code. Then-CEO John Chambers argued in a letter to President Barack Obama at the time that spy agency interference was undermining confidence in American products.

In response to the new Equation Group findings, Cisco says in a statement: "We are deeply concerned with anything that may impact the integrity of our products or our customers' networks, and we continue to seek additional information. With the security of our customers in mind, we will continue to address facts as they become clear through available channels."

Cisco also issued another advisory for a separate vulnerability that the Equation Group exploited. The vulnerability, which affects Cisco's ASA and the Pix line of firewalls, was patched in 2011, but Cisco says it chose to issue a more prominent advisory now, in light of the findings, to emphasize the importance of installing the patch for any holdouts.

Risks to Other Vendors

For customers of Fortinet, firmware that runs some Fortigate firewalls - released before August 2012 - contains a buffer overflow vulnerability that can be exploited, the company warns. That vulnerability has now been patched, Fortinet says in an Aug. 17 advisory.

"We continue to investigate this exploit and are conducting an additional review of all of our Fortinet products," the company says in a statement.

Juniper says it is reviewing the Equation Group dump and will notify customers if a vulnerability is found.

A spokesman for WatchGuard said its currently supported appliances are not affected by an exploit in the dump. The vulnerability for that exploit targeted RapidStream-branded appliances, he says. WatchGuard acquired RapidStream in 2002, and the vulnerability didn't carry over to WatchGuard appliances.

Anti-Malware , Data Loss , Network & Perimeter

Dump May Reveal Russian, US Intelligence Agencies Openly Squaring Off Jeremy Kirk (jeremy_kirk) • August 17, 2016    

The release of spying code authored by one of the most sophisticated hacking groups in the world has prompted questions about whether Russia may be taunting the United States in an unprecedented, public cyber stunt.

See Also: Hide & Sneak: Defeat Threat Actors Lurking within Your SSL Traffic

On Aug. 13, a group calling itself the Shadow Brokers released samples of exploits and software implants from the Equation Group, which many security experts suspect is linked to the U.S. National Security Agency. The dumped code is designed to compromise network-level equipment such as firewalls and includes notes on infiltration techniques (see Mystery Surrounds Breach of NSA-Like Spying Toolset).

If Shadow Brokers is indeed a state-sponsored group, its outing of one of its peers is unprecedented. The action comes as the United States investigates potential Russian involvement in the Democratic Party breaches, which have caused turbulence during a fierce U.S. presidential campaign (see DNC Breach More Severe Than First Believed).

Shadow Brokers claims to be auctioning the password for a second, encrypted file that it also released. The password will go to the highest bidder, or alternatively the group claims it will be publicly released if it receives 1 million bitcoins, currently worth about $568 million. That file - which could be fake - might have already served its purpose: creating anxiety within the Equation Group over what might be dumped next.

Leaked Code Matches

There's now little doubt that the sample code that was dumped indeed belongs to the Equation Group.

Moscow-based security firm Kaspersky Lab, which cast the first light on the Equation Group in February 2015, finally weighed in on the new data dump on Aug. 16. It's compared the implementation of the encryption algorithms used by the Equation Group to the code dumped by Shadow Brokers, and found that the crypto is nearly the same.

"While we cannot surmise the attacker's identity or motivation nor where or how this pilfered trove came to be, we can state that several hundred tools from the leak share a strong connection with our previous findings from the Equation Group," Kaspersky Lab researchers write in a blog post.

The Equation Group used the RC5 and RC6 encryption algorithms within its malware. Kaspersky had previously identified 20 compiled versions of RC5/6 code in the Equation Group's malware. The Shadow Brokers' archive provided another large sample set for Kaspersky to analyze, and it found 300 files that implement a specific version of RC6 - used by the Equation Group - in 24 different forms, according to Costin Raiu, director of the Kaspersky Lab research team.

Over 300 tools from the Shadowbrokers leak have shared code with known Equation tools. pic.twitter.com/BtWevPjD14

"The chances of all these being faked or engineered is highly unlikely," according to Kaspersky Lab.

The hacking tools are relatively old - the most recent ones date from late 2013 - which has somewhat diminished their usefulness. But a Brisbane, Australia-based network security consultant has successfully tested one of the exploits against an older version of Cisco's Adaptive Security Appliance firewalls.

The exploit works against Cisco ASA version 8.4, which dates from 2012, says XORcat, who spoke on condition of only being identified by his Twitter handle. The attack creates a backdoor that allows for access to the firewall without a password. A firewall is a key piece of network equipment to attack since all of an organization's web traffic flows through it.

It's unclear if Cisco has patched the buffer overflow vulnerability that the attack exploits or if newer versions are affected. Still, it's an example of a functional exploit that would work against the right product version.

"You get people running old code all the time if they don't have a support contract anymore," XORcat says in a phone interview. "They'll be stuck with whatever version they've got."

But not much of the newly released code rivals the firmware exploits against hard drives that Kaspersky says the Equation Group had developed. The new code, simply put, appears to be less refined. "The sad thing is that all of these Equation Group exploits are totally boring, trivial stuff," writes Héctor Martín Cantero, a Tokyo-based IT security consultant, on Twitter. "None of it is particularly impressive."

Exfiltration Method Remains Unclear

What remains unclear is how the Shadow Brokers may have grabbed the newly leaked tools. One idea floated by none other than former NSA contractor Edward Snowden is that the Equation Group forgot to scrub a command-and-control server that was used for launching an attack.

Cyberattacks are typically staged from proxy servers that are hard to trace back to those running an offensive operation. It's possible that Shadow Brokers compromised one of those servers.

Snowden says the NSA, as well as other state actors, are known to "lurk" on such servers to figure out what their adversaries are up to. But whatever they observe, at least historically, has remained a closely held secret.

"NSA malware staging servers getting hacked by a rival is not new," Snowden writes on Twitter. "A rival publicly demonstrating they have done so is."

Others have suggested the leak came from an insider, based on a screenshot of an internal file structure that Shadow Brokers released. One anonymous commentator, going by the handle Zipa Dux, claims on Twitter that "Shadow Brokers is an insider who grabbed the data via USB and is trying to pass himself off as a foreign group."

@msuiche ShadowBrokers is an insider who grabbed the data via USB and is trying to pass himself off as a foreign group.

@msuiche File directories like the one he screenshot are physically gapped and not accessible externally.Names are changed before deployment

In an email reply to Information Security Media Group, Zipa Dux implied previously working for the NSA's Tailored Access Operations group, which specializes in infiltrating computers.

Zipa Dux says the file directories shown in the screenshot wouldn't be externally accessible and would have to have been taken from an air-gapped system. The filenames for the resources shown also get changed before an operation, meaning that if Shadow Brokers had accessed a staging server, the files wouldn't appear in that form.

"It was also a concern of everyone working in TAO that operators had access to all of this and could easily be taken such as via USB," Zipa Dux says. "One theory is that this guy separated the military/NSA and has been sitting on this data for some time before trying to profit from it. Another could be that he is still working there - however unlikely - and using NSA infrastructure for anonymity."

The name of the group also raises suspicions of an insider theft since many TAO employees played Mass Effect, a popular Xbox video game, Zipa Dupa says. In that game, a "shadow broker" is someone who trades in information.

"We can remember disgruntled employees working there and people that didn't leave on good terms," Zipa Dupa writes.

Dave Aitel, CTO of the penetration testing consultancy Immunity and a former NSA research scientist, has also suggested that an internal leaker might be the source. "First off, it's not a 'hack' of a command and control box that resulted in this leak," Aitel writes in a blog post. "It's almost certainly human intelligence - someone walked out of a secure area with a USB key."

Russian Connection Eyed

The Shadow Brokers intrigue comes as the United States continues to investigate the Democratic Party breaches. Guccifer 2.0, the handle for someone or some group that began leaking Democratic National Committee files in June, continues to release sensitive documents. The most recent significant one included phone numbers and email addresses for close to 200 Democratic party officials.

Snowden hints at a Russian connection to Shadow Brokers. "Why did they do it? No one knows, but I suspect this is more diplomacy than intelligence, related to the escalation around the DNC hack," he writes on Twitter.

7) Why did they do it? No one knows, but I suspect this is more diplomacy than intelligence, related to the escalation around the DNC hack.

Aitel seconds Snowden's observation, based on the timing of the release and the Democratic Party incidents. Also, Shadow Brokers' ability to hold onto the data for more than three years after it was apparently breached shows some operational discipline. The release of it is bold, he writes.

"No team of 'hackers' would want to piss off Equation Group this much," Aitel writes. "That's the kind of cojones that only come from having a nation-state protecting you."