New Shadow Brokers 0-day subscription forces high-risk gamble on whitehats

Mysterious group with cache of NSA exploits promises new release to those who pay.

The mysterious group that over the past nine months has leaked millions of dollars' worth of advanced hacking tools developed by the National Security Agency said Tuesday it will release a new batch of tools to individuals who pay a $21,000 subscription fee. The plans, announced in a cryptographically signed post published Tuesday morning, are generating an intense moral dilemma for security professionals around the world.

On the one hand, the Shadow Brokers, as the person or group calls itself, has in the past released potent hacking tools into the wild, including two that were used to deliver the WCry ransomware worm that infected more than 200,000 computers in 150 countries. If the group releases similarly catastrophic exploits for Windows 10 or mainstream browsers, security professionals are arguably obligated to have access to them as soon as possible to ensure patches and exploit signatures are in place to prevent similar outbreaks. On the other hand, there's something highly unsavory and arguably unethical about whitehats paying blackhats with a track record as dark as that of the Shadow Brokers.
"It certainly creates a moral issue for me," Matthew Hickey, cofounder of security firm Hacker House, told Ars. "Endorsing criminal conduct by paying would be the wrong message to send. Equally, I think $21k is a small price to pay to avoid another WannaCry situation, and I am sure many of its victims would agree with that sentiment."

Tuesday's post revealed instructions for subscribing to the release. It included the wallet address for sending a payment in Zcash, a form of cryptocurrency that's widely believed to be almost impossible to track. Those who send 100 Zcash coins—worth about $24,000 at the moment—from June 1 to June 30 will receive an e-mail in the first half of July with a link and password needed to receive the next release. Everyone else will go without.

"Act quickly," the post, written in the characteristically exaggerated broken English of previous Shadow Brokers dispatches, urged. "Is good chance Zcash price increasing over time."

Hickey, who uses the Twitter handle Hacker Fantastic, set up a Twitter poll on Tuesday that attempted to measure support in security circles for paying the subscription fee. The unscientific survey was roughly evenly split between "yes" and "no" at the time this post was going live.

Smokescreen

The weighty ethical dilemma is all the more frustrating to security experts who believe the Shadow Brokers ultimately have no interest in earning money despite the constant groveling for payments since the group went public last August. EternalBlue, one of the NSA-developed cyberweapons that helped WCry spread like wildfire earlier this month, alone could easily have fetched $1 million had Shadow Brokers sold it in traditional exploit markets. The group's decision to showcase its considerable holdings in poorly organized but widely covered auctions leaves many people to speculate that the true motive of the leak campaign is to annoy or damage the NSA and disrupt its spying activities.

The Shadow Brokers "are foreign intelligence, and the continued requests for money are all geared towards plausible deniability that they are intel," Jake Williams, founder of Rendition InfoSec, told Ars. A former employee who worked for the NSA's elite Tailored Access Operations hacking group until 2013, Williams has long speculated the Shadow Brokers is a group closely aligned with Russian government officials. The group is attempting to counter actions former President Obama took in response to US intelligence reports that Russian hackers meddled in the 2016 presidential election and the steady stream of news reports that have circulated since.

"If [Shadow Brokers] demonstrate that the US is also performing Nation State hacking by burning our tools, they accomplish two things: normalization of the activity and disruption of future NSA activity." The repeated calls for people to purchase the stolen NSA tools, Williams said, are smokescreens "designed to raise questions about 'are these guys really nation state.' If they come out and say: 'we are Russian hackers, we are hurting you more,' that hurts their narrative. Then we say 'look at the big bad Russians continuing to interfere.'"

Tuesday's post didn't say precisely what would be included in the next dispatch. A previous post, however, claimed Shadow Brokers possessed 75 percent of the NSA's arsenal. It said future releases might include:
Web browser, router, handset exploits, and tools
select items from newer Ops Disks, including newer exploits for Windows 10
compromised network data from more SWIFT providers and Central banks
compromised network data from Russian, Chinese, Iranian, or North Korean nukes and missile programs
For an anonymous hacking group, the Shadow Brokers have, so far, an unusually reliable record of delivering on earlier threats. That history isn't lost on security professionals who want to ensure they get access to Shadow Brokers releases at the same time less ethical hackers receive them. Then again, there may be reason to believe the mysterious group may finally be nearing the exhaustion of its cache of stolen weapons. Around the same time Tuesday's post was published, the Shadow Brokers moved the $24,000 worth of bitcoins it made in previous auctions to a series of new wallets, presumably in an attempt to obfuscate where they ultimately wind up. Some researchers have taken the move as a sign the Shadow Brokers are tying up loose ends now, before it becomes common knowledge that their cache of NSA exploits has dried up.

The take-away from all of this is that the Shadow Brokers are forcing a gamble on whitehats with previously unimaginable risks. Perhaps the least-distasteful option is for whitehats to agree to pay a single subscription fee and share any proceeds as widely as possible. NSA officials should also strongly consider reporting as many of the underlying vulnerabilities in its arsenal as possible.

The price for completely boycotting the auction is the very real possibility of getting caught flat-footed in a malware outbreak that could rival the one brought about by WCry. The almost equally unattractive alternative is to pay the fee and live with the knowledge that that move is precisely what the group has been seeking all along, while possibly risking that the group won't deliver the release as promised.

Tuesday's dispatch is prompting plenty of soul-searching in private security circles. One can only imagine it's generating intense debate inside of Fort Meade, too.