Cyber Week in Review: August 19, 2016

Here is a quick round-up of this week’s technology headlines and related stories you may have missed:

1. Release of NSA hacking tools raises questions about vulnerability disclosure. A group calling itself the “Shadow Brokers” posted hacking tools online last weekend it claims were created by the Equation Group, a threat actor identified by Kaspersky Labs in 2015 suspected of being the NSA. According to security experts, the claims appear to be legitimate, and the tools are based on major vulnerabilities in software from several major router manufacturers, including Cisco Systems and Juniper Networks. The source of the leaks isn’t clear: some speculate that an insider leaked the tools, while others have claimed that Russian state hackers stole them from an NSA staging server. Either way, it looks bad for the NSA, both because the Shadow Brokers claim to have more such tools, and because it raises questions about the extent to which the NSA actually discloses software vulnerabilities, as the White House claims it does.

2. Guccifer 2.0 strikes again. Guccifer 2.0, a group of hackers believed to be Russian intelligence services, returned from a month-long hiatus last weekend, publishing the contact information of nearly two hundred legislators and congressional staffers. The group leaked a large amount of internal Democratic Party documents earlier this summer that it stole from Democratic National Committee (DNC) and Democratic Congressional Campaign Committee networks. WordPress, where the new documents were published, subsequently took them down, but not before it was too late; individuals whose personal information was leaked suffered spearphishing attacks and harassing messages over the weekend. In response to the hacks, the DNC created an advisory board to improve the party’s cybersecurity, which was summarily mocked for not including any actual security experts.

3. SWIFT long aware of security holes. According to a report from Reuters, SWIFT, a network that helps banks conduct cross-border transactions and which was central to the theft by hackers of $81 million from the central bank of Bangladesh earlier this year, had suspected for years that there were weaknesses in its system that might enable such an attack. Former employees say the organization simply did not consider security a priority. That’s changed now: earlier this week, SWIFT announced a new effort to increase security across its system. Meanwhile, Bangladesh Bank dropped plans to sue SWIFT and the Federal Reserve Bank of New York, which transferred the money to the hackers on orders that were spoofed to look like they’d come from Bangladesh Bank.

4. Privacy Shield up and running. Privacy Shield, an agreement governing data transfers between the European Union and the United States, officially went live this week, with companies self-certifying that they are compliant with EU data protection laws. At the time of this writing, forty-two companies have successfully applied to be covered by the pact (a full list of covered firms can be found here). It may not last, however. Germany’s data protection authority (DPA), which oversees compliance with EU data law, announced earlier this month that it plans to challenge the legality of Safe Harbor in EU courts, arguing that the new agreement does not fix the problems that led the Court of Justice of the European Union to strike down Privacy Shield’s predecessor, Safe Harbor, late last year.