Hackers holding stolen NSA cyber tools auction

FORTUNE: 

The teaser data dump appears to contain legitimate attack code, some experts say.

The United States government can’t seem to catch a break in cyberspace.

Hackers claim to have stolen attack code from a team of sophisticated cyber spies known as “the Equation Group,” widely believed to be associated with the U.S. National Security Agency, one of the world’s top intelligence outfits. The hackers have offered to sell their purloined exploits to the highest bidder in an online auction conducted in the cryptocurrency Bitcoin.

Although the alleged breach could just be an extravagant hoax, experts who reviewed a preliminary data dump teased alongside the hackers’ garbled sales pitch said that the files, amazingly, looked authentic. “This appears to be legitimate code,” Matt Suiche, a French cybersecurity entrepreneur, wrote in a Medium blog post, echoing what others had posted on Twitter TWTR -2.54% .

Get Data Sheet, Fortune’s technology newsletter.

“We hack Equation Group. We find many many Equation Group cyber weapons. You see pictures. We give you some Equation Group files free, you see,” the hackers wrote Saturday on the code-sharing site Github, as well as on Yahoo-owned Tumblr YHOO -0.94% (both later taken down). “This is good proof no? You enjoy!!!”

The lifted goods include exploits allegedly designed to target firewalls and equipment produced by Cisco CSCO -0.11% , Juniper Networks JNPR -1.08% , Fortinet FTNT 3.22% , and Topsec, a Chinese firm. The latest file modifications appear to date back to 2013, and names are consistent with NSA programs leaked by whistleblower Edward Snowden that year, such as “BANANAGLEE,” “EPICBANANA,” and “JETPLOW.”

WIRED: 

Among the sample files released by the group are exploits that target equipment sold by companies including Cisco, Juniper, Fortigate and Topsec, a Chinese network security firm, according to Matt Suiche, founder of UAE-based incident response and forensics startup Comae Technologies. Suiche says those exploits attack older versions of the equipment and don’t use “zero-days”—previously undiscovered flaws in target software or hardware. But he believes they had nonetheless remained unpublished until now and hadn’t been included in public collections of exploits like the tool Metasploit.

All of that weighs against any theory that the leaked data is a mere scam to score a few quick bitcoins. “To create [all this evidence] from scratch, it’s very unlikely but not impossible,” says Suiche. “It seems pretty legitimate to me, and I’m not the only one.”

On the other hand, the Shadow Brokers group certainly doesn’t seem to be running its auction in a very professional fashion. They require bidders to send cryptocurrency blindly to their bitcoin address, with no hope of getting their coins back if they don’t submit the winning bid. “Sorry lose bidding war lose bitcoin and files. Lose Lose. Bid to win!” the message reads. But it also promises a “consolation prize” to all bidders and adds that if bids reach the ludicrous sum of one million bitcoins, they’ll publicly release another trove of high quality data.

“Why I trust you?” reads another question in their FAQ. “No trust, risk. You like reward, you take risk, maybe win, maybe not, no guarantees.”

The Shadow Brokers’ page ends with a long message to “wealthy elites,” arguing that the tactics of hackers like Equation Group could put their control of global politics at risk, and suggesting that they too should bid on the stolen files. “We want make sure Wealthy Elite recognizes the danger cyber weapons, this message, our auction, poses to their wealth and control,” the Shadow Brokers’ message reads.

The haphazard auction and political message present a jarring disconnect: Any hackers capable of compromising the Equation Group or another NSA hacker team would likely have to be extremely sophisticated; the Equation Group, after all, went not only uncompromised, but undetected for 14 years, a remarkable track record of stealth and operational security for a team believed to have attacked targets from Russia to Belgium to Lebanon. Anyone capable of finding NSA hackers’ infrastructure, not to mention penetrating it, would likely have to possess government-level resources and talent.

READ MORE HERE

AND HERE:

BREAKING: Russia informs US that a chemical attack may have occurred in Aleppo

The Russian military informed the United States that rebels in the Syrian city of Aleppo launched an attack using toxic substances at 19:05 on Aug. 2, Interfax news agency reported on Wednesday, citing a Russian general.

As a result of the attack, seven people died and more than 20 people were sent to hospital, Interfax reported.

The fighting in Aleppo between government and rebel forces saw the largest rebel assault so far, according to monitoring group the Syrian Observatory for Human Rights, followed by suspected chemical attacks on Tuesday the BBC reported.

On July 30 and 31, the rebels blew up a tunnel under regime forces stationed in the Ramousah district of the city. The Syrian army, however, has fought back, aided by Russian air strikes. The Syrian Observatory said that it has managed to retake five of the eight positions the rebels had captured.

The insurgents are trying to break a government siege of their territory, which is home to around 250,000 civilians.

US Consulate issues alert following Munich Mall shooting - shelter in place.

U.S. Embassy in Saudi Arabia: "potential, imminent threat" against U.S. citizens in areas of the city of Jeddah

The U.S. Embassy in Saudi Arabia said on Thursday it had received reports of a "potential, imminent threat" against U.S. citizens in areas of the city of Jeddah frequented by Westerners.

The notice on the Embassy's website provided no other details.

"It’s a security message, not a travel warning, that our consulate put out in Jeddah. Obviously, our consulate felt that the information they had was credible enough, serious enough to warrant sending that message out immediately," State Department spokesman John Kirby told a briefing.

China builds 4th Stealth J-20

AIN ONLINE: China’s Chengdu Aircraft Company (CAC) has built more Low Rate Initial Production (LRIP) J-20 stealthy jet fighters, with another new aircraft featured in flight on Chinese websites over the past week. This is the second known J-20LRIP aircraft, after the first example serialed 2101 was shown in late December 2015. They follow two prototypes and six known development aircraft thatfeatured a successive series of refinements.

The latest aircraft is painted in shades of gray and carries toned down national insignia, but unlike all previous J-20s has no identifying serial numbers. Reports from China suggest that this latest aircraft may in fact be the fourth LRIP aircraft, but verifiable evidence of this has yet to surface. Most information about the J-20 has emerged from unofficial Chinese websites, and the type has never been shown in public.

The appearance of LRIP aircraft suggests that the type is nearing introduction into service with the People’s Liberation Army Air Force. A number of J-20s have been seen on satellite imagery at the China Flight Test Establishment base at Xi’an-Yanliang. The latest report to Congress on Chinese defense developments by the U.S. Department of Defense suggests that the J-20 could become operational in 2018.

The J-20 appears to be designed for long-range interception with an emphasis on frontal-aspect low-observability. It has an infrared search and track sensor and possibly also an electro-optical distributed aperture system (EODAS), the latter a Chinese-designed system similar to that on the Lockheed-Martin F-35 Lightning IIstealth fighter. The weapons are carried internally, with a central bay expected to contain four beyond visual range air-to-air missiles (BVRAAMs). There is also provision for two short-range AAMs in two separate weapons bays on each side of the fuselage.

The main question that is left for the design is the powerplant, with all J-20s built so far being powered by two Russian Saturn AL-31 engines. China hopes eventually to install 180-kN (40,000-pound-thrust)-rated WS-15 turbofans. But China’s jet engine development program has been stymied by manufacturing and reliability issues. Even the less ambitious WS-10 turbofan is yet to fully enter service with the single-engine Chengdu J-10 fighter, although it has been flying on the twin-engine Shenyang J-11 Flanker since 2010.

READ MORE HERE