More evidence surfaced this week that computer surveillance tools belonging to the mysterious Equation hacking group are linked to the US National Security Agency.
Cyber-security experts were divided on the origin of the hacking code, which was leaked on Monday by another hacking group called calling itself the "Shadow Brokers." But The Intercept reported on Friday that a specific 16-character string found in a leaked NSA instruction manual also appears in the Shadow Brokers code.
The manual, a 31-page document entitled "FOXACID SOP for Operational Management," describes administrative tools for tracking surveillance targets, including a set of tags used to catalogue servers, according to The Intercept. The tags are used to trick Internet users into thinking they're browsing a safe website when in fact they've been sent a malicious payload from an NSA server.
Although it appears to show a link between the Shadow Brokers hack and the NSA, The Intercept acknowledges its findings don't necessarily mean that the NSA itself was hacked. The code could have been stolen from third-party hackers, a possibility Edward Snowden alluded to on Monday.
"NSA malware staging servers getting hacked by a rival is not new," he wrote in a tweet, referring to private servers that are occasionally controlled by NSA agents, but not owned by the agency itself.
Some of the servers in the Shadow Brokers leak used software from Cisco, including the company's Adaptive Security Appliance (ASA) operating system, which powers data center firewalls. Cisco announced on Thursday that it had identified the exploits that allowed the hack and was working on an update.
"The exploit of this vulnerability was publicly disclosed by the alleged Shadow Brokers group," Cisco wrote in an advisory posted to its website. "All Cisco ASA releases are affected. Cisco is working on fixes for supported releases."
Fortinet and Juniper Networks, which also make server firewall software, told Forbes on Wednesday that their products were also involved in the hack. Juniper said it was looking for vulnerabilities, while Fortinet said it found holes in a legacy firmware version and recommended that customers update to the latest version.