NSA Equation Group tool was used by Chinese hackers years before it was leaked online
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0005 | Local Privilege Escalation Flaw in Microsoft Windows GDI CVE-2017-0005 is an elevation of privilege vulnerability in the Graphics Device Interface (GDI) component of Microsoft Windows, scored 7.8 (High) because a successful exploit compromises confidentiality, integrity, and availability. It is triggered when a local, low-privileged user runs a crafted application that manipulates GDI, causing code to run with elevated privileges. An attacker who already has a foothold on a machine (e.g., via malware or a compromised account) gains higher privileges, enabling full control of the host, persistence, and access to sensitive data. The flaw affects a broad set of Windows releases from Windows Vista SP2 through Windows 10 1607, plus Windows RT 8.1 and Windows Server 2008, 2012, and 2016, so most Windows estates of that era are in scope. Exploitation is confirmed in the wild: Microsoft published detection and mitigation guidance for an actively used exploit in 2017, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2022-05-24; EPSS estimates a ~10.9% probability of exploitation within 30 days (96th percentile). Do: Apply Microsoft's security updates for all affected releases per the CISA KEV required action: Windows 10 1507/1511/1607 via cumulative updates, and Windows 7 SP1, 8.1, RT 8.1, Server 2008 SP2/R2 SP1, Server 2012 Gold/R2, and Server 2016 via the corresponding vendor patches. Out-of-support versions such as Vista SP2 or Server 2008 need extended/custom-support updates or an OS upgrade, and Windows 10 devices on 1507/1511/1607 should be moved to a currently serviced build. Because exploitation requires local code execution, restrict untrusted local software, and review Microsoft's MMPC detection guidance referenced for this CVE to hunt for prior exploitation. | 7.8 | 11% | KEV PoC |
| masshundreds of millions of Windows PCs and servers across the affected Vista through Windows 10 1607 / Server 2008-2016 releases |
Full article627 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 22, 2021
The Chinese APT group had access to an NSA Equation Group, NSA hacking tool and used it years before it was leaked online by Shadow Brokers group.
Check Point Research team discovered that China-linked APT31 group (aka Zirconium.) used a tool dubbed Jian, which is a clone of NSA Equation Group ‘s “EpMe” hacking tool years before it was leaked online by Shadow Brokers hackers.
In 2015, Kaspersky first spotted the NSA Equation Group, it revealed it was operating since at least 2001 and targeted almost any industry with sophisticated zero-day malware.
The arsenal of the hacking crew included sophisticated tools that requested a significant effort in terms of development, Kaspersky speculated the Equation Group has also interacted with operators behind Stuxnet and Flame malware.
Based on the evidence collected on the various cyber espionage campaigns over the years, Kaspersky experts hypothesize that the National Security Agency (NSA) is linked to the Equation Group.
Jian used the same Windows zero-day exploit that was stolen from the NSA Equation Group ‘s arsenal for years before it was addressed by the IT giant.
In 2017, the Shadow Brokers hacking group released a collection of hacking tools allegedly stolen from the US NSA, most of them exploited zero-day flaws in popular software.
One of these zero-day flaws, tracked as CVE-2017-0005, was a privileged escalation issue that affected Windows XP to Windows 8 operating systems,
“In this blog we show that CVE-2017-0005, a Windows Local-Privilege-Escalation (LPE) vulnerability that was attributed to a Chinese APT, was replicated based on an Equation Group exploit for the same vulnerability that the APT was able to access.” reads the analysis published by CheckPoint. ““EpMe”, the Equation Group exploit for CVE-2017-0005, is one of 4 different LPE exploits included in the DanderSpritz attack framework. EpMe dates back to at least 2013 – four years before APT31 was caught exploiting this vulnerability in the wild.”
Check Point discovered that the Jian tool was being actively utilized between 2014 and 2017, it dates its usage years before the vulnerability was addressed by Microsoft. The security firm also excluded that the tool was developed by the Chinese threat actors.
The EpMe hacking tool was included in the 2017 Shadow Brokers “Lost in Translation” leak.
The researchers pointed out that Lockheed Martin reported CVE-2017-0005 to Microsoft, this is the only vulnerability Lockheed Martin reported in recent years.
The experts speculate that APT31 group had obtained access to Equation Group’s hacking tool, likely because it was employed in attacks against Chinese targets. The Chinese hackers gained access to both 32- and 64-bit versions of the exploit module. An alternative hypothesis is that the Chinese APT group has stolen the tool from the Equation Group while their were spying on a target network also being monitored by APT31. We cannot exclude that APT31 has stolen the tool from Equation Group servers.
“Together with additional artifacts that match Equation Group artifacts and habits shared between all exploits even as far back as 2008” concludes Check Point “we can safely conclude the following”:
- Equation Group’s EpMe exploit, existing since at least 2013, is the original exploit for the vulnerability later labeled CVE-2017-0005.
- Somewhere around 2014, APT31 managed to capture both the 32-bit and 64-bit samples of the EpMe Equation Group exploit.
- They replicated them to construct “Jian”, and used this new version of the exploit alongside their unique multi-staged packer.
- Jian was caught by Lockheed Martin’s IRT and reported to Microsoft, which patched the vulnerability in March 2017 and labeled it CVE-2017-0005.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, NSA Equation Group)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/114898/apt/nsa-equation-group-tool-apt31.html