A blueprint of how the U.S. National Security Agency likely used weaknesses in commercially available software to gain access to the global system for transferring money between banks was shown by a review of the data, documents and computer files released by hackers, reported Reuters.
Indicating NSA had accessed the SWIFT money-transfer system through service providers in the Middle East and Latin America, a group calling itself the Shadow Brokers released documents and files on Friday. In a series of disclosures by the group in recent months, that release was the latest.
the Microsoft exploits published by the Shadow Brokers would make vulnerable some SWIFT affiliates that were using Windows servers at the time, in 2013, showed the screen shots, Matt Suiche, founder of cybersecurity firm Comae Technologies, wrote in a blog post. The NSA took advantage and got in that way, he concluded in his post.
"As soon as they bypass the firewalls, they target the machines using Microsoft exploits," Suiche told Reuters. Small programs for taking advantage of security flaws are known as exploits. For continued access, eavesdropping or to insert other tools, hackers use them to insert back doors.
"We now have all of the tools the NSA used to compromise SWIFT (via) Cisco firewalls, Windows," Suiche said.
Reuters however said that the authenticity of the documents released by the hackers could not be verified independently. They had been patched, Microsoft said while acknowledging the vulnerabilities. Its firewalls had been vulnerable, Cisco Systems Inc has previously acknowledged.
There were no comments from Cisco and the NSA. Belgium-based SWIFT said on Friday that it had no evidence that the main SWIFT network had ever been accessed without authorization and downplayed the risk of attacks employing the code released by hackers.
SWIFT said in a statement, which did not specifically mention the NSA, that it was possible that the local messaging systems of some SWIFT client banks had been breached.
SWIFT transfers would be a natural espionage target for many national intelligence agencies because tracking sources of terrorist financing and money flows among criminal groups is a high priority.
Indications that the NSA used a tool codenamed BARGLEE to breach the SWIFT service providers' security firewalls was indicated in a PowerPoint presentation that was part of the most recent Shadow Brokers release.
Although Reuters could not independently determine the authenticity of the slides, the NSA's official seal appeared on one of the slides in the presentation.
The slide referred to ASA firewalls. According to a Cisco employee who spoke on condition of anonymity, Cisco is the only company that makes ASA firewalls. ASA is a combined firewall, antivirus, intrusion prevention and virtual private network, or VPN and stands for Adaptive Security Appliance.
Comae Technologies' Suiche said that the NSA used Microsoft exploits to target the computers interacting with the SWIFT network, after penetrating the firewall of the SWIFT service providers, suggests documents included in the Shadow Brokers release.
The flaws that apparently were exploited by nine of the NSA programs were fixed after determining prior patches to dozens of software versions, Microsoft late on Friday said. Blocked by comprehensive updates on March 14 were four of the vulnerabilities. The company said that at risk to three of the newly released exploits were the only older, unsupported versions of Windows operating systems and Exchange email servers.
(Source:www.reuters.com)
Indicating NSA had accessed the SWIFT money-transfer system through service providers in the Middle East and Latin America, a group calling itself the Shadow Brokers released documents and files on Friday. In a series of disclosures by the group in recent months, that release was the latest.
the Microsoft exploits published by the Shadow Brokers would make vulnerable some SWIFT affiliates that were using Windows servers at the time, in 2013, showed the screen shots, Matt Suiche, founder of cybersecurity firm Comae Technologies, wrote in a blog post. The NSA took advantage and got in that way, he concluded in his post.
"As soon as they bypass the firewalls, they target the machines using Microsoft exploits," Suiche told Reuters. Small programs for taking advantage of security flaws are known as exploits. For continued access, eavesdropping or to insert other tools, hackers use them to insert back doors.
"We now have all of the tools the NSA used to compromise SWIFT (via) Cisco firewalls, Windows," Suiche said.
Reuters however said that the authenticity of the documents released by the hackers could not be verified independently. They had been patched, Microsoft said while acknowledging the vulnerabilities. Its firewalls had been vulnerable, Cisco Systems Inc has previously acknowledged.
There were no comments from Cisco and the NSA. Belgium-based SWIFT said on Friday that it had no evidence that the main SWIFT network had ever been accessed without authorization and downplayed the risk of attacks employing the code released by hackers.
SWIFT said in a statement, which did not specifically mention the NSA, that it was possible that the local messaging systems of some SWIFT client banks had been breached.
SWIFT transfers would be a natural espionage target for many national intelligence agencies because tracking sources of terrorist financing and money flows among criminal groups is a high priority.
Indications that the NSA used a tool codenamed BARGLEE to breach the SWIFT service providers' security firewalls was indicated in a PowerPoint presentation that was part of the most recent Shadow Brokers release.
Although Reuters could not independently determine the authenticity of the slides, the NSA's official seal appeared on one of the slides in the presentation.
The slide referred to ASA firewalls. According to a Cisco employee who spoke on condition of anonymity, Cisco is the only company that makes ASA firewalls. ASA is a combined firewall, antivirus, intrusion prevention and virtual private network, or VPN and stands for Adaptive Security Appliance.
Comae Technologies' Suiche said that the NSA used Microsoft exploits to target the computers interacting with the SWIFT network, after penetrating the firewall of the SWIFT service providers, suggests documents included in the Shadow Brokers release.
The flaws that apparently were exploited by nine of the NSA programs were fixed after determining prior patches to dozens of software versions, Microsoft late on Friday said. Blocked by comprehensive updates on March 14 were four of the vulnerabilities. The company said that at risk to three of the newly released exploits were the only older, unsupported versions of Windows operating systems and Exchange email servers.
(Source:www.reuters.com)
Homepage
Send to a friend
Printable version
Share
