Softopedia
New Snowden Documents Links Shadow Brokers Leak to Official NSA Hacking Tools
http://news.softpedia.com/news/new-snowden-documents-links-shadow-brokers-leak-to-official-nsa-hacking-tools-507488.shtml
Aug 19, 2016 18:30 GMT · By Catalin Cimpanu
This particular exploit was used in Pakistan and Lebanon
The Intercept has published today new Snowden documents that reveal an official connection between official NSA cyber-weapons and the malware dumped by The Shadow Brokers. The documents are internal NSA operations manuals that describe how CNE (Computer Network Exploitation) tools must be used. The document which The Intercept received from Snowden a few years back but never published describes a hacking system called BADDECISION. Leaked exploit was part of a bigger hacking system The BADDECISION system is made up of the FOXACID server, the SECONDDATE exploit, and the BLINDDATE field operations software, among other things. The SECONDDATE exploit is a tool that works at the network level by intercepting web requests and redirecting them to the FOXACID server, where the user is infected with the desired malware. According to procedures described in the operations manual (page 28), NSA employees must use IDs to tag victims sent to the FOXACID server via different exploits. The document reveals that SECONDDATE's ID is ace02468bdf13579. This very same ID was found in 14 different files in the files named SECONDDATE included in the Shadow Brokers leak. NSA used exploit in Pakistan and Lebanon Furthermore, other documents revealed that the NSA used a system called BLINDDATE to automate SECONDDATE attacks on Wi-Fi networks in the field. BLINDDATE is a hardware system running custom software that can launch MitM (man-in-the-middle) attacks leveraging SECONDDATE, HAPPY HOUR, NITESTAND, and others. The equipment is used in the field, in the range of an enemy's wireless network. BLINDDATE is a laptop with a giant antenna, which can also be mounted on drones, and redirect a Wi-Fi network's web traffic to the NSA FOXACID server. According to Snowden documents leaked in 2013, BLINDDATE was used to spy on Pakistan's National Telecommunications Corporation’s (NTC) VIP Division and on Lebanon's major ISPs. These campaigns provided the NSA with information on Pakistan’s Green Line communications network, Pakistan's civilian and military leadership, and on Hizballah's Unit 1800 activities. Before The Intercept linked the Shadow Brokers leak with actual NSA cyber-weapons, Kaspersky researchers tied the malware in the group's data dump to tools used by the Equation Group cyber-espionage APT, believed to be linked to the NSA.