Incident: NSA's Leaked Hacking Tools Lead to EternalRocks Malware Outbreak

Published Date: 2017-05-22

Postmortem Analysis
Timeline 1. The software failure incident involving the EternalRocks malware happened in May 2017 [59339].
System 1. Microsoft Windows Server Message Block (SMB) technology 2. EternalBlue exploit 3. DoublePulsar exploit 4. EternalChampion exploit 5. EternalRomance exploit 6. EternalSynergy exploit 7. ArchiTouch exploit 8. SMBTouch exploit 9. Tor's private browser
Responsible Organization 1. The National Security Agency (NSA) [59339]
Impacted Organization 1. Hospitals, schools, and offices around the world [59339] 2. Computers infected by EternalRocks [59339]
Software Causes 1. The software causes of the failure incident were the exploitation of vulnerabilities in Microsoft Windows Server Message Block by malware such as EternalRocks, EternalBlue, DoublePulsar, EternalChampion, EternalRomance, EternalSynergy, ArchiTouch, and SMBTouch [59339].
Non-software Causes 1. Lack of timely disclosure and warning by the NSA regarding the exploits [Article 59339] 2. Delay in action by security experts due to the malware's stealthy behavior [Article 59339]
Impacts 1. The software failure incident involving EternalRocks, a malware utilizing leaked NSA hacking tools, had the impact of potentially infecting a significant number of computers globally, with the exact number of infections remaining unclear [59339]. 2. EternalRocks, unlike WannaCry, remained hidden and quiet on infected computers, delaying detection and analysis by security experts for at least 24 hours after infection [59339]. 3. The malware's stealthy nature and ability to self-replicate could lead to it being weaponized into more ransomware or trojan attacks, posing further risks to cybersecurity and potentially affecting banking systems [59339]. 4. The incident highlighted the criticism faced by the NSA for holding onto exploits without informing the affected companies, leading to calls for greater transparency and oversight of government cyber tools [59339].
Preventions 1. Promptly applying software patches: Microsoft had released patches to fix the vulnerabilities exploited by EternalRocks in March [59339]. 2. Regularly updating software: Keeping software up to date could have prevented the exploitation of known vulnerabilities [59339]. 3. Implementing strong cybersecurity measures: Having robust cybersecurity protocols in place could have helped detect and prevent the malware from infecting systems [59339].
Fixes 1. Patching vulnerabilities: Microsoft had already patched the vulnerabilities exploited by EternalRocks in March, so ensuring that all computers are updated with the latest security patches could help fix the software failure incident [59339]. 2. Enhanced cybersecurity measures: Implementing stronger cybersecurity measures, such as firewalls, intrusion detection systems, and regular security audits, can help prevent malware like EternalRocks from infecting computers [59339]. 3. Improved threat intelligence sharing: Enhancing the sharing of threat intelligence among cybersecurity experts and organizations can help in early detection and mitigation of such malware attacks [59339].
References 1. Cybersecurity experts such as Miroslav Stampar from Croatia's CERT [59339] 2. Michael Patterson, CEO of security firm Plixer [59339]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: The article mentions that after the WannaCry ransomware incident, a new malware named EternalRocks emerged, utilizing exploits leaked by the NSA. EternalRocks uses similar exploits as WannaCry, such as EternalBlue and DoublePulsar, and also remains hidden and quiet on infected computers [59339]. (b) The software failure incident having happened again at multiple_organization: The article discusses how the NSA's leaked hacking tools have been used in various malware incidents, including WannaCry, Adylkuzz, and now EternalRocks. These incidents have affected a wide range of organizations globally, including hospitals, schools, and offices, showcasing the widespread impact of these exploits [59339].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be attributed to the NSA's leaked hacking tools, which were originally developed and used for cyber espionage purposes. These tools, such as EternalBlue and DoublePulsar, were discovered by the Shadow Brokers group and subsequently leaked, leading to the creation of malware like WannaCry, Adylkuzz, and EternalRocks [59339]. (b) The software failure incident related to the operation phase is evident in the way EternalRocks operates once it infects a computer. Unlike WannaCry, which alerts victims of infection through ransomware, EternalRocks remains hidden and quiet on computers. It downloads Tor's private browser and communicates with hidden servers, delaying its malicious activities for 24 hours to evade detection. This stealthy operation poses challenges for security experts trying to detect and stop the malware [59339].
Boundary (Internal/External) within_system (a) The software failure incident related to EternalRocks can be categorized as within_system. The malware utilizes multiple exploits leaked by the National Security Agency (NSA) and the Shadow Brokers group, such as EternalBlue, DoublePulsar, EternalChampion, EternalRomance, EternalSynergy, ArchiTouch, and SMBTouch [59339]. These exploits target vulnerabilities within the Microsoft Windows Server Message Block (SMB) technology used by PCs, allowing the malware to spread rapidly within systems that have not applied the necessary security patches [59339]. The malware's stealthy behavior, delayed activation, and ability to download additional components like Tor's private browser from hidden servers all indicate that the failure originates from within the system itself.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case is primarily due to non-human actions, specifically the use of leaked hacking tools originally developed by the National Security Agency (NSA) and later exposed by the Shadow Brokers group. The malware, EternalRocks, utilizes seven exploits discovered by the NSA and leaked by the Shadow Brokers, such as EternalBlue and DoublePulsar, to spread and infect computers [59339]. (b) However, human actions also play a role in this software failure incident. The NSA has faced criticism for holding onto these exploits without informing the affected companies, which could have potentially prevented such widespread attacks. Additionally, the delay in communication by the malware itself, as mentioned by security experts, is a strategic move by bad actors to be more stealthy in their operations [59339].
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: - The software failure incident involving EternalRocks, a new malware, is not directly attributed to hardware issues. The incident primarily revolves around the exploitation of software vulnerabilities in Microsoft Windows Server Message Block (SMB) technology [59339]. (b) The software failure incident related to software: - The software failure incident involving EternalRocks is primarily due to contributing factors that originate in software. EternalRocks is a malware that exploits software vulnerabilities in Microsoft Windows Server Message Block (SMB) technology, specifically using leaked NSA hacking tools like EternalBlue, DoublePulsar, and others [59339].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the articles is malicious in nature. The incident involves the creation and spread of malware named EternalRocks, which utilizes leaked hacking tools from the National Security Agency (NSA) to infect computers and potentially be weaponized for harmful purposes [59339]. The malware remains hidden and quiet on infected computers, downloads Tor's private browser, and communicates with hidden servers to self-replicate. It delays its malicious activities by remaining dormant for 24 hours before starting to spread and infect more computers. The malware's stealthy behavior, lack of a kill-switch, and potential for weaponization indicate a malicious intent to harm systems and potentially carry out ransomware or trojan attacks [59339].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was poor_decisions. The failure was due to contributing factors introduced by poor decisions made by the NSA in holding onto exploits without warning the companies involved [59339].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the case of the EternalRocks malware. The malware utilized multiple exploits leaked by the National Security Agency (NSA) and the Shadow Brokers group, including EternalBlue, DoublePulsar, EternalChampion, EternalRomance, EternalSynergy, ArchiTouch, and SMBTouch [59339]. These exploits were originally developed by the NSA for intelligence purposes but were leaked and subsequently used by malicious actors to create malware like EternalRocks. The fact that these exploits were not securely held by the NSA and were ultimately weaponized into malware highlights a failure in professional competence in handling and securing such critical tools. (b) The software failure incident related to accidental factors is demonstrated by the unintended consequences of the NSA's leaked hacking tools. The exploits developed by the NSA were meant for intelligence gathering but were accidentally leaked by the Shadow Brokers group, leading to the creation of malware like EternalRocks [59339]. This accidental exposure of powerful hacking tools resulted in widespread cyber threats and potential harm to computer systems worldwide, showcasing the unintended negative impact of the original development and subsequent leak of these tools.
Duration temporary (a) The software failure incident described in the article is more likely to be temporary rather than permanent. The EternalRocks malware, which uses leaked NSA hacking tools, remains dormant on infected computers for 24 hours before it starts downloading and self-replicating [59339]. This temporary nature of the malware's behavior indicates that the failure is not permanent but rather triggered by specific circumstances.
Behaviour byzantine, other (a) crash: The software failure incident described in the articles does not involve a crash where the system loses state and stops performing its intended functions. The malware, EternalRocks, remains hidden and quiet on infected computers, waiting for instructions to start downloading and self-replicating after 24 hours [59339]. (b) omission: The software failure incident does not involve omission where the system fails to perform its intended functions at an instance(s). Instead, the malware operates stealthily on infected computers without alerting the victims of infection [59339]. (c) timing: The software failure incident does not involve timing issues where the system performs its intended functions correctly but at the wrong time. EternalRocks waits for 24 hours before initiating its malicious activities, which is a deliberate delay tactic to evade detection [59339]. (d) value: The software failure incident does not involve the system performing its intended functions incorrectly. EternalRocks operates as intended by its creators, remaining hidden on infected computers and waiting for instructions to spread and replicate [59339]. (e) byzantine: The behavior of the software failure incident aligns more closely with a byzantine failure, where the system behaves erroneously with inconsistent responses and interactions. EternalRocks operates in a stealthy manner, downloads Tor's private browser, communicates with hidden servers, and can potentially be weaponized for various malicious purposes [59339]. (f) other: The software failure incident also exhibits characteristics of a sophisticated and strategic attack, where the malware creators intentionally delay the activation of the malicious activities to avoid detection and allow the worm to spread undetected for a period before becoming active [59339].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence unknown (a) death: People lost their lives due to the software failure - There is no mention of people losing their lives due to the software failure incident in the provided article [59339].
Domain information (a) The software failure incident mentioned in the article is related to the information industry. The malware, EternalRocks, targeted computers by exploiting vulnerabilities in Microsoft Windows Server Message Block, which is a technology commonly used for file sharing on PCs [59339].

Sources

Back to List