Hacking Group Claims N.S.A. Infiltrated Mideast Banking System
By Nicole Perlroth, NY Times, April 15, 2017
For the past few months, an elite hacking group calling itself the Shadow Brokers has sporadically leaked sensitive data from the National Security Agency. On Friday, just when its leaks had appeared to slow, the group released what appears to be its most damaging leak so far: a trove of highly classified hacking tools used to break into various Microsoft systems, along with what it said was evidence that the N.S.A. had infiltrated the backbone of the Middle East’s banking infrastructure.
Among the leaks on Friday was an extensive list of PowerPoint and Excel documents that, if authentic, indicate that the N.S.A. has successfully infiltrated EastNets, a company based in Dubai that helps to manage transactions in the international bank messaging system called Swift.
Swift, short for the Society for Worldwide Interbank Financial Telecommunication, is used by about 11,000 banks to transfer money from one country to another. The vast majority of those banks rely on Swift service bureaus, like EastNets, the largest bureau in the Middle East, to handle their transactions. The latest leaks suggest that, by hacking EastNets, the N.S.A. may have successfully hacked, or at minimum targeted, computers inside some of the biggest banks in the Middle East, including ones in Abu Dhabi and Dubai in the United Arab Emirates; Kuwait; Qatar; Syria; Yemen; and the Palestinian territories. Among the leaked documents was a now-patched N.S.A. road map to hacking Swift’s back-end infrastructure, which could be used by cybercriminals in the future.
This would not be the first time that United States intelligence agencies have been accused of hacking into Middle Eastern banks. In 2012, security researchers discovered that a computer virus had infiltrated thousands of computers, many inside Lebanese banks. Unlike cybercriminals, who target banks to maximize financial profit, the attackers had monitored the financial transactions of a targeted list of clients of Lebanese banks, which experts said had been used as financial conduits for the Syrian government and Hezbollah, the Lebanese militant group and political party.
The digital crumbs from that attack suggested, cybersecurity experts said, that the virus was the work of the same attackers behind Stuxnet, the computer attack that destroyed the centrifuges in an Iranian nuclear facility and that has been attributed to the United States and Israel.
The N.S.A. did not respond to requests for comment.
On Friday, EastNets denied that it had been hacked. In a statement, the company said its Swift service bureau runs on a separate secure network that cannot be reached over the public internet. The company said the leaked documents that claimed its computers had been compromised referred to an old server that the bureau had retired in 2013.
But the latest Shadow Brokers leak claims otherwise. One Excel spreadsheet lists what appears to be thousands of stolen credentials belonging to compromised employees and technology administrators at EastNets offices around the globe. Another shows a list of what the group said was computer addresses that have been hacked or targeted by N.S.A. analysts, with the corresponding bank they belong to. Among those listed as having been successfully “implanted,” or infected with spyware, are Noor Bank, Tadhamon International Islamic Bank, Al Quds Bank for Development and Investment, Arcapita Bank and the Kuwait Fund for Arab Economic Development.
None of the documents suggest that the N.S.A. used its access to steal funds. Instead, it appears that the agency was seeking to track the financial movements of certain Middle Eastern bank clients, ostensibly to gain insight into potential terrorist groups or government officials.
The Shadow Brokers’ latest data release also includes a listing of what seemed to be N.S.A. hacking tools, so-called exploits, that allowed the agency to invisibly break into computers and servers running Microsoft Windows. The exploits appear to affect every recent version of Microsoft Windows except its Microsoft 10 software.
But in a statement issued on Friday, Microsoft said it had already patched its software to protect users from many of the exploits listed in the leaks. Phillip Misner, Microsoft’s principal security group manager, said that of the exploits listed in the Shadow Broker leaks, only three had not been patched, but that none of those three worked on any of Microsoft’s supported software, which includes Windows 7 and up.
