Source code alleged to be Nokia’s is for sale online – Source: www.csoonline.com

Source code and other data purportedly stolen from Nokia is up for sale on BreachForum.

On Monday, BreachForum user IntelBroker made a post on the underground forum, seen by CSOonline, offering to sell the information to top-level BreachForum members or high-reputation individuals with proof of funds.

The post claimed the data had been taken from an unnamed developer who helped Nokia build some internal tools.

IntelBroker’s post went on to say that the compromised data also includes SSH keys, RSA keys, Bitbucket logins, SMTP accounts, webhooks and hardcoded credentials.

If such credentials have indeed been compromised, it could potentially expose Nokia customers and partners to harm.

A Nokia representative said that the company is looking into the claim.

“Nokia is aware of reports that an unauthorized actor has alleged to have gained access to certain third-party contractor data and possibly data of Nokia,” the representative said via email. “Nokia takes this allegation seriously and we are investigating.”

So far that investigation has turned up nothing.

“To date, our investigation has found no evidence that any of our systems or data being impacted,” the representative wrote. “We continue to closely monitor the situation.”

The breach, if confirmed, could affect Nokia’s long list of enterprise customers, including private wireless network subscribers, industrial automation customers, and cloud and data solutions buyers.

Was Vodafone caught in the crossfire?

While Nokia would not confirm the breach, X/Twitter account @IntCyberDigest claimed to have proof in the form of a screenshot of a fragment of a file tree with folder and filenames beginning with the letters v-i-l.

“We have got some proof of the Nokia breach,” the account said. “Their 4G/5G products customer data (Vodafone Idea Limited – VIL) has been leaked.” 

The posting on BreachForum included a link to a sample of the data called “Tree file” (not seen by CSOonline) and invited potential buyers to send offers to an XMPP (extensible messaging and presence protocol) address.

IntelBroker said they carried out the attack with fellow hacker EnergyWeaponUser.

While IntelBroker has built up a formidable hacking profile, having previously compromised prominent organizations including Europol, General Electric, T-Mobile, and Apple, not much is known about EnergyWeaponUser apart from the fact that they assisted in two of IntelBroker’s previous hacks, Cisco and AMD.