Documents and computer files released by hackers provide a blueprint for how the U.S. National Security Agency likely used weaknesses in commercially available software to gain access to the global system for transferring money between banks, a review of the data showed.
On Friday, a group calling itself the Shadow Brokers released documents and files indicating NSA had accessed the SWIFT money-transfer system through service providers in the Middle East and Latin America. That release was the latest in a series of disclosures by the group in recent months.
Matt Suiche, founder of cybersecurity firm Comae Technologies, wrote in a blog post that screen shots indicated some SWIFT affiliates were using Windows servers that were vulnerable at the time, in 2013, to the Microsoft exploits published by the Shadow Brokers. He said he concluded that the NSA took advantage and got in that way.
“As soon as they bypass the firewalls, they target the machines using Microsoft exploits,” Suiche told Reuters. Exploits are small programs for taking advantage of security flaws. Hackers use them to insert back doors for continued access, eavesdropping or to insert other tools.
“We now have all of the tools the NSA used to compromise SWIFT (via) Cisco firewalls, Windows,” Suiche said.
Reuters was not able to independently verify the authenticity of the documents released by the hackers. Microsoft acknowledged the vulnerabilities and said they had been patched. Cisco Systems Inc has previously acknowledged that its firewalls had been vulnerable.
Cisco and the NSA did not reply to requests for comment. Belgium-based SWIFT on Friday downplayed the risk of attacks employing the code released by hackers and said it had no evidence that the main SWIFT network had ever been accessed without authorization.
It was possible that the local messaging systems of some SWIFT client banks had been breached, SWIFT said in a statement, which did not specifically mention the NSA.
Because tracking sources of terrorist financing and money flows among criminal groups is a high priority, SWIFT transfers would be a natural espionage target for many national intelligence agencies.
BREACH OF FIREWALLS
A PowerPoint presentation that was part of the most recent Shadow Brokers release indicates the NSA used a tool codenamed BARGLEE to breach the SWIFT service providers’ security firewalls.
The NSA’s official seal appeared on one of the slides in the presentation, although Reuters could not independently determine the authenticity of the slides.
The slide referred to ASA firewalls. Cisco is the only company that makes ASA firewalls, according to a Cisco employee who spoke on condition of anonymity. ASA stands for Adaptive Security Appliance and is a combined firewall, antivirus, intrusion prevention and virtual private network, or VPN.
Documents included in the Shadow Brokers release suggest that the NSA, after penetrating the firewall of the SWIFT service providers, used Microsoft exploits to target the computers interacting with the SWIFT network, Comae Technologies’ Suiche said.