NSA Secrets Stolen; Edward Snowden 2.0?

NSA Secrets Stolen; Edward Snowden 2.0?

As the name implies, this is based on my analysis of another NSA contractor stealing secrets, similarly to Edward Snowden. I have no insider information and my analysis hinges on what I have read from various news outlets and my own perspective of the events. While I make every effort to be thorough and hit every aspect, there are times that I inadvertently omit things or skip them due to scope, time, length or applicability. Email any questions you have about this or any other topic to blog@advancedpersistentsecurity.net

This seems to be a relatively busy week for those of us who follow information security. First we have the Yahoo revelations, then Kim Kardashian (OSINT), and now a second act of Edward Snowden (albeit not believed to be related) via an NSA contractor stealing secrets. The irony is that both the contractor, Harold Thomas Martin III, aka HTM3, also worked for Booz Allen Hamilton (BAH). The New York Times was the first to report that Martin was secretly arrested by the FBI in August because “he stole and disclosed highly classified computer codes developed to hack into the networks of foreign governments, according to several senior law enforcement and intelligence officials.” The New York Post reports that he was “charged with theft of government property and unauthorized removal and retention of classified materials by a government employee or contractor.”

Initial Analysis

My initial thought was “WOW!” How could this happen AGAIN??! The FBI executed a search warrant on his home, storage shed(s), vehicles, and property and found material in print and digital form that classified “TOP SECRET” or a similar classification and/or compartments (Document Cloud [Affidavit], 2016).

My thoughts

I would prefer to gather my thoughts around his motive, which hasn’t been publicly stated (or on a platform of which I have seen it). I would treat it different if he were selling the materials than if he were publicly releasing programs that are classified not out of national security or the threat to human life, but to hide things from the public. Aldrich Ames isn’t the same as Edward Snowden because of intent and context.
I’m surprised that NSA did not detect this in near real time and prevent it themselves. The fact that he walked out with digital media and physical copies of classified material is deplorable. Could he be associated with the Shadow Brokers? Edward Snowden seems to think so.

After my initial reaction, my next thought process was immediately the Shadow Broker leaks. I commented to friends that they are apparently not as 1337 (hacker slang for elite or ‘leet’) as we once thought. I also opined that NSA might not be as sloppy as we thought in the wake of the zero day leaks. During a twitter exchange, the grugq quite reasonably asked if HTM3 was in TAO, the Tailored Access Operations: NSA’s offensive hacking team.

While the data does not square up precisely, but there is a little cross correlation with the timeline.

It may be safe to assume that he may know something about the zero days leaked earlier in 2016. If he’s the source, then Shadow Brokers lose a lot of credibility. I always thought that the notion of NSA leaving the exploits on a server on the public internet, (compromised or not,) seemed amateur, especially for them. Perhaps HTM3 was using them for personal gain and he was sloppy. Again, we can almost be certain that we’ll never know.

Conclusion and preventative measures

In conclusion, I am not sure this could have been truly prevented. I think there are measures like Data Loss Prevention (DLP) and other mitigating factors such as disabling USB devices wholly (exception for keyboards and mice; which can still be circumvented via the Rubber Duckie) that could have been employed. While I am not sure User Behavior Analytics as we know it now is mature enough to detect this, I would also think that NSA is one of a handful of organizations what would be on the cutting edge of detecting anomalous behavior, especially in the wake of Edward Snowden’s leaks. They have the talent, the processing power, and the necessity to have advanced insider threat detection.

No level of scrutiny or additional polygraphs will prevent these from happening. They will deter them in the interim, but the deterrence will wear off as it has since 2013. It appears as if there is more than meets the eye in this. What was he doing with the classified materials? Was he going to leak them or sell them? And finally, is he affiliated with the Shadow Brokers? This will all pan out in the coming weeks and months.

Announcements and Resources

SANS Mentor Session

Security 504: Hacker Tools, Techniques, Exploits, and Incident Handling

Joe will be leading a SANS Mentor session for Security 504: Hacker Tools, Techniques, Exploits, and Incident Handling, which is the class that corresponds to the GIAC Certified Incident Handler (GCIH) certification. The dates are October 27 -December 15 from 6-9 PM (Eastern Time). Location is TDB. If your organization wants to host the training, email Joe and you can receive a discount. Therefore sign up before September 29 and get a discount and a free attempt at GCIH. https://www.sans.org/mentor/class/sec504-atlanta-27oct2016-joe-gray

OTHER APS POSTS

Implications of Powershell Going Open Source
Yahoo Data Breach: What We Know Now
Most of What You Need to Know: Wi-Fi
Cybersecurity & the US 2016 Presidential Election
Most of What You Need to Know: Passwords
Twitter Hacked?
Change Your Email Password Now!
Qatar Bank Breached After Bangladesh
Bangladesh Bank Loses 80 Million USD

Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will).  To learn more about us, check out our “About Us” page.

If you have ANY Cybersecurity needs, please contact us and we will promptly reply to your question or concern.

References

Yahoo CISO Statement
CNBC

Enter your email address:


Delivered by FeedBurner

Subscribe to our mailing list

* indicates required



About Joe Gray

Joe Gray is a native of East Tennessee. He joined the U.S. Navy directly out of High School and served for 7 years as a Submarine Navigation Electronics Technician. Since leaving the Navy, Joe has lived and worked in St. Louis, MO, Richmond, VA, and Atlanta, GA. His primary experience is in the Information Assurance (IA) and Cyber Security compliance field. He has worked as a Systems Engineer, Information Systems Auditor, Senior UNIX Administrator, Information Systems Security Officer, and Director of IT Security.

Joe is in pursuit of his PhD in Information Technology (with focus in Information Assurance and Security). His undergraduate and graduate degrees are also in Information Technology (with focus in Information Assurance and Security) from Capella University, where he graduated Summa Cum Laude for both degrees and completed a Graduate Certificate in Business Intelligence. He also is a part-time (Adjunct) Faculty at Georgia Gwinnett College.

Joe holds the (ISC)² CISSP-ISSMP, GIAC GSNA, CompTIA Security+, CompTIA Network+, and CompTIA A+ certifications. In his spare time, Joe enjoys reading news relevant to information security, blogging, bass fishing, and flying his drone in addition to tinkering with and testing scripts in R and Python.