Shortly after its leak of NSA exploit tools enabled the spread of WannaCry, the Shadow Brokers hacking group promised to launch a monthly subscription service for more zero days. Tuesday, it started offering details.
To get in on the action, Shadow Brokers requires that subscribers send them 100 ZEC (Zcash cryptocurrency) or $21,000 per month. The group emptied its Bitcoin wallet yesterday, then switched over to Zcash, though the group said it could require a different currency the following month.
So what will this subscription service get you? A roll of the dice, essentially. Shadow Brokers put it this way on their site:
Monthly dump is being for high rollers, hackers, security companies, OEMs, and governments. Playing “the game” is involving risks.
They promise to continue with a seat-of-the-pants approach beyond June. Asked what will be in the next dump, the group said:
TheShadowBrokers is not deciding yet. Something of value to someone. See theshadowbrokers’ previous posts. The time for “I’ll show you mine if you show me yours first” is being over. Peoples is seeing what happenings when theshadowbrokers is showing theshadowbrokers’ first. This is being wrong question. Question to be asking “Can my organization afford not to be first to get access to theshadowbrokers dumps?”
Meanwhile, some on Twitter are suggesting it might be a good idea to set up crowdfunded access to the dump:
Sophos CTO Joe Levy warns that those who consider doing business with Shadow Brokers and others like them should tread very carefully.
As recent leaks show, the Shadow Brokers crew certainly seem to have acquired some high-value stolen goods, although their previous attempts to auction them off came to nothing and they ended up dumping the data for free. But there’s no reason to believe they have an ongoing supply, or that their subscription service is anything but a cash grab.
Would-be subscribers should ask themselves the following before diving in: what are you going to do if they don’t deliver? Ask for a refund? Report them to the ombudsman?
Sophos’s view is simple: don’t go there.
If you lie down with dogs, you’re likely get up with fleas, and maybe attract the entirely understandable attention of law enforcement.
Steve
Good job, Bill.
Cheryl Thomson
LOL. Law enforcement. That’s pretty funny considering its the powers that be exploit tools that are causing all the trouble. Ironically enough, because of the internet, the thin blue line gets more blurry by the minute.
Every time security comes up in technology, never is data mining brought up. Never are the “Terms of Service” that give every software co complete access to your phone, computer, every bit of personal info of yours and everyone you know, bringing in 3rd party apps while legally signing off on responsibility for what those 3rd party apps do with your info., giving the software co. complete control to change the terms willy nilly, leaving it up to the users to monitor the company’s website 24/7. And when a breach happens? Users are told to change their security.
New passwords, new questions that pertain to other personal info, that only you would know – so they can data mine the crap out of that , another breach, more info, etc. Thus, the Circle of Greed was borne.
Karol
I can’t help but wonder if their name was inspired by Mass Effect games.