Was the NSA Hacked By Enemies Abroad, or Was It an Inside Job?

Not long ago, a group referring to itself as the Shadow Brokers distributed hacking tools utilized by the United States National Security Agency (NSA), on various publically-accessible websites. While the motives of the Shadow Brokers are a story for another time, an investigation seems to have locked in on a particular theory of how the Shadow Brokers came into possession of the tools in the first place.

Hypotheses were initially varied as to how the tools were taken from the NSA at all. Some surmised that the leak must have been the work of another agency insider following the lead of the controversial Edward Snowden. Some suspected that Russia, deemed responsible by D.C. lawmakers, had hacked into the NSA headquarters located in Fort Meade.

However, the FBI has begun to focus their efforts on an entirely different source, one that--while certainly less openly malicious than a foreign attack or insider leak--still shows the dangers that human error can present to cyber security.

Based on information provided by the NSA, investigators are looking into reports that an individual associated with the agency, either as an employee or a contractor, had left the tools on a remote computer during an operation approximately three years ago. These tools would allow their users to exploit systems from Fortinet Inc. and Cisco Systems.

Patches have since been released to help protect these systems from the now-public tools. Investigators, however, are not ruling out the possibility that the tools were left exposed on purpose, or that others within the NSA made similar mistakes that ultimately resulted in the Shadow Brokers obtaining them.

To their credit (assuming that it was an honest mistake), the unnamed individual reported their mistake shortly afterwards, according to the NSA--which, it must be mentioned, did not inform the companies of the risk to their systems. Rather, having sought out foreign use of the tools with no results, the NSA saw no need to inform the software manufacturers.

Regardless of blame for the release of these tools into the public domain, the unnamed former NSA representative who left the tools on the remote computer proves that critical data should never leave the safety measures to be found on-premises and taken into the world without considerable measures put in place to ensure its security.

For advisement and assistance in putting measures in place to protect your business from theft, call Computerware at (703) 821-8200.