An analysis of exploit BENIGNCERTAIN that was present in the Shadow Brokers leaked data reveals that the Equation Group, a team associated with the NSA, had the ability to hack firewalls Cisco PIX and obtain RSA private keys from VPNs, as well as other sensitive details.
Over the weekend, Shadow Brokers provided online several tools stolen from a server that used the Equation Group.
The hackers they make this data available to bidders in an auction they run with Bitcoins.
Among these exploits are EPICBANANA, JETPLOW and EXTRABACON, targeting Cisco ASA devices. Other exploits like ESCALATEPLOWMAN are targeting WatchGuard firewalls, while EGREGIOUSBLUNDER targets Fortinet devices.
Mustafa Al-Bassam, also known as tFlow, co-founder of hulking group LulzSec, is now a legitimate White Hat researcher, reportedly examining the BENIGNCERTAIN expliot.
He discovered that BENIGNCERTAIN targets Cisco PIX hardware versions 5.2 (9) to 6,3 (4), and uses three files in an exploitation chain that examines the device's memory using Internet Key Exchange (IKE) packages.
Can the NSA steal the keys?
"The memory dump can then be parsed to extract a private RSA key and other sensitive configuration information," Al-Bassam said in his analysis.
Below is how memory dump looks.
RSA private key structure at offset 0x%04x, size 0x%x bytes: *** Found probable RSA private key *** RSA public insurance key structure at offset 0x%04x, size 0x%x bytes: *** Found probable RSA public key *** RSA key structure at offset 0x%04x, size 0x%x bytes: RSA keys were generated at %s VPN group structure at offset 0x%04x, size 0x%x bytes Split-tunnel ACL: 0x%08x %s Idle-time: 0x%08x [%d seconds] Max-time: 0x%08x [%d %s] PFS: 0x% 08x %s Clear-client-cfg: 0x%08x %s User-idle-timeout: 0x%08x [%d seconds] Authen. server: 0x%08x %s Secure-unit-auth: 0x%08x %s User authen.: 0x%08x %s Device pass-thru: 0x%08x %s
