In case you missed it, the Shadow Brokers just released a list of keys that are reportedly used to connect to Equation Group compromised servers. While this dump doesn't contain any exploits, the filenames do contain the IP addresses and hostnames of machines on the Internet. Presumably these are all infected machines, some are reporting they have been used as staging servers for other attacks.
If your organization owns one of the servers in this dump, obviously you should be performing an incident response. But the Shadow Brokers themselves recommend that you only perform dead box forensics, taking disk images in lieu of live response. This quote was taken from the Shadow Brokers' latest post.
"To peoples is being owner of pitchimpair computers, don’t be looking for files, rootkit will self destruct. Be making cold forensic image. @GCHQ @Belgacom"
If you're one of the organizations impacted, but you're not comfortable performing dead box forensics on Unix machines (most or all of these machines are Solaris, Linux, and HPUX according to those performing scans) talk to us at Rendition Infosec - we'd love to help.
What's interesting is that we now have a list of victims of an apparently government organization (Equation Group). To my knowledge NSA has never openly admitted these are their tools, but every major media outlet seems to be running with that narrative and we have no substantive evidence against it.
Cyber insurance coverage and nation state hacks
Let's assume that at least some of these organizations have cyber insurance. There are some interesting questions here. First, these hacks appear to be pretty old and many likely predate the purchase of cyber insurance. How does the cyber insurance handle pre-existing conditions? Even if the policy cover a pre-existing hack, the bigger question I have involves the "Act of War" exclusion in many policies.
If we assume that Equation Group is a government organization (e.g. a state sponsored hacking group), does the compromise of the identified in the dump constitute an Act of War? Since this is presumably only espionage and not attack, the answer is probably no.
But suppose an organization hacked by Equation Group via one of these compromised servers detects they are being hacked. Suppose they hack back and cause damage to the organization who owns one of these redirection servers? What then? Does this constitute an Act of War? And if the insurance company thinks the a state sponsored hack is an Act of War, who has the burden of proof?
In short, I don't have the answers here. But these are great questions to be asking your insurer. I know I will be.
