Former NSA analyst Blake Darche, who has been studying the leak, says the tools appear to be legitimate. Darche, CTO and co-founder of Area 1, says the backdoors and exploits in the dump include a tool called SecondDate that runs on Cisco PIX631 firewalls.
http://www.darkreading.com/threat-intelligence/strong-connection-between-files-leaked-by-shadowbrokers-and-the-equation-group/d/d-id/1326641Called SecondDate, the capability was described in a 2012 NSA document as a tool “to influence real-time communications between client and server.” It has the ability to redirect Web browsers to the NSA’s FoxAcid malware servers, and it may have been used as part of an attack on Tor users. SecondDate can serve as part of a targeted attack, but it can also be used, according to NSA documents, for “mass exploitation potential for clients passing through network choke points.” In other words, SecondDate can be used in concert with the NSA’s other systems to attack whole swaths of the Internet, infecting systems with surveillance malware.
http://arstechnica.com/information-technology/2014/03/nsas-automated-hacking-engine-offers-hands-free-pwning-of-the-world/A top-secret NSA presentation from 2012 reveals that the agency developed a man-in-the-middle capability called SECONDDATE to “influence real-time communications between client and server” and to “quietly redirect web-browsers” to NSA malware servers called FOXACID. In October, details about the FOXACID system werereported by the Guardian, which revealed its links to attacks against users of the Internet anonymity service Tor.
But SECONDDATE is tailored not only for “surgical” surveillance attacks on individual suspects. It can also be used to launch bulk malware attacks against computers.
According to the 2012 presentation, the tactic has “mass exploitation potential for clients passing through network choke points.”
Blaze, the University of Pennsylvania surveillance expert, says the potential use of man-in-the-middle attacks on such a scale “seems very disturbing.” Such an approach would involve indiscriminately monitoring entire networks as opposed to targeting individual suspects.
https://theintercept.com/2014/03/12/nsa-plans-infect-millions-computers-malware/
