Was an insider behind the NSA hack?

Linguistic analysis casts doubt on "Russian hacker" claims

The perpetrator of the Shadow Brokers breach at the NSA may in fact by an English-speaking insider at the American agency, rather than a Russian hacker collective, as first presumed.

Earlier this month, attackers revealed they had managed to gain access to cyber weapons from the Equation Group, widely thought to be the NSA's own state hacking collective. They circulated 300 files online detailing zero-day exploits - several of which have been confirmed as genuine - and auctioned off a second, encrypted cache to the highest bidder.

It was initially theorised that the hackers were foreign operatives with the most popular theory being that they were Russian. This was spurred on by the fact that the Pastebin post from the perpetrators was in broken English.

However, linguistic analysis by Shlomo Aragon, professor of Computer Science and director of the Linguistic Cognition Laboratory at the Illinois Institute of Technology (IIT) suggested that the author of the post is actually a native English-speaker trying to disguise the fact they are anglophone.

"The texts contain a variety of different grammatical errors that are not usual in the English of US native speakers," writes Aragon in a post on Taia Global. These include the omission of definite and indefinite articles ("a" and "the"), the omission of infinitive "to" (e.g., "I want get" instead of "I want to get") and confusion of tenses.

However, he points out that, while there are grammatical errors, there are no spelling errors, irrespective of how complex the word is. Additionally, the grammatical errors are inconsistent and the author uses plenty of idioms, even though they do contain mistakes in grammar. This has let Aragon to the conclusion that "the author is most likely a native speaker of US English who is attempting to sound like a non-native speaker by inserting a variety of random grammatical errors".

Separately, others have come to the conclusion that the perpetrator is an NSA insider.

Cyber security professional and white hat hacker Matt Suiche said in a post on Medium that a former NSA analyst had come to him with this theory, speaking on the condition of anonymity.

After discussions with this source, several points were put forward suggesting the "hackers" were in fact a single person working from within the NSA. These include the fact that the name ShadowBrokers originally comes from the computer game Mass Effect, and that the NSA Tailored Access Operations (TAO) group, where the cyber weapons stolen are thought to come from, apparently has a "big gaming culture"

Also, the depository containing the NSA TAO toolkit is reportedly stored on a separate network that is not connected to the internet at all (which would impede someone trying to hack from the outside).

The "TAO Team had severe concerns about how easy it was to just walk out with the data on a USB drive" and a native English-speaker could easily fake broken English to make themselves sound Russian (although Suiche does not go into as much detail as Aragon in terms of analysis).

However, Suiche does concede "this is only a possible scenario" and "the discussion is open".

Featured Resources

BCDR buyer's guide for MSPs

How to choose a business continuity and disaster recovery solution

Download now

The definitive guide to IT security

Protecting your MSP and your customers

Download now

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

Download now

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Recommended

TsuNAME vulnerability could enable DDoS attacks on major DNS servers
distributed denial of service (DDOS)

TsuNAME vulnerability could enable DDoS attacks on major DNS servers

7 May 2021
Security researchers take control of a Tesla via drone
ethical hacking

Security researchers take control of a Tesla via drone

5 May 2021
New report highlights the need for diversity in cyber security recruitment
cyber security

New report highlights the need for diversity in cyber security recruitment

28 Apr 2021
Hackers could abuse legitimate Windows AD FS to steal data
Microsoft Windows

Hackers could abuse legitimate Windows AD FS to steal data

28 Apr 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021