Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

mobile.nytimes.com

Post reply on HN
Print view View original

111–120 of 505 posts

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#111

Post by pwagland »

betenoire wrote: post #82
slashcom wrote: post #75

Earlier quoted context omitted.

I worry that they might sell it as a reason backdoors are necessary: if only we had backdoors, we could've saved those patients! The flaw of this logic would be lost on most lawmakers.

Humor me... if encryption had a backdoor, then ransomware could be effectively mitigated.... Though I'm not a proponent of backdoors by any means, I don't see the logical flaw here.

Well, the bigger problem would be ensuring that the criminals used known broken encryption. The only advantage is that many of these attacks are copy-cat, so if you released the source code for a broken ransomware implementation, it will probably get used more or less verbatim… as has been shown in the past. (https://threatpost.com/bitcrypt-ransomware-deploying-weak-cr..., https://www.utkusen.com/blog/destroying-the-encryption-of-hi...)

Anyone who actually knows what they are doing, and are prepared to break the law, would just use AES. All of those law-abiding institutions would be forced to use a weak encryption scheme.

Sure, it might help stop script kiddies, but it won't help to stop professionals, and professionals are the ones that you have to worry about, since they end up hosing 45,000+ installations in a day.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#113

Post by Angostura »

stonogo wrote: post #22
dekhn wrote: post #11

Earlier quoted context omitted.

If you run a large installation of computers, taking updates can be a huge risk. Often they can break things, and then you're in the position of being blamed for running an update. Not updating can often lead to much higher stability. In previous environments I've worked that were "regulated", any change to the environent, such as a firmware upgrade, triggered an entire re-regulation process (testing, paperwork, etc)…

That's wrong. If you run a large installation of computers, and you do not have a plan and a process for quickly deploying security patches, you should be fired with cause. In this specific case, there are mitigations available that do not require installation of software, but merely a configuration change. Also in this specific case, the people who run IT at NHS are completely incompetent, and this has been well-doc…

When you say 'the people who run IT at the NHS' you are aware that thanks to recent governments attempts to break up central structures, each hospital trust, each GP surgery is likely to have someone different handling IT - market forces are good etc.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#114

Post by kevindqc »

devrandomguy wrote: post #38
mhogomchungu wrote: post #4

I am in Tanzania(East Africa) and my father's computer is infected. All he did to get infected was plugging his laptop on the network at work(University of Dar Es Salaam). The laptop is next to me and my task this night is to try to remove this thing.

This malware is well written, and uses strong encryption. I would suggest that you and your father spend the evening reading up on backup practices, and reconsider the value proposition of open source software. I hope I am not coming off as a smug jerk. My hope is that rather than becoming frustrated and demoralized after an evening of fruitless hacking, you and your uni will recover, and become resilient against fut…

I understand that people love open source, but how is that relevant here? For example OpenSSL is open source, yet it didn't prevent Heartbleed and other exploits from happening?

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#115

Post by hackuser »

ComodoHacker wrote: post #53

Edit: Botnet stats and spread (switch to 24H to see full picture): https://intel.malwaretech.com/botnet/wcrypt Live map: https://intel.malwaretech.com/WannaCrypt.html Relevant MS security bulletin: https://technet.microsoft.com/en-us/library/security/ms17-01... Edit: Analysis from Kaspersky Lab: https://securelist.com/blog/incidents/78351/wannacry-ransomw...

> from Kaspersky Lab

... the lab with ties to Russian intelligence, who are suspected of leaking the NSA tools.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#116

Post by devrandomguy »

AdeptusAquinas wrote: post #91
devrandomguy wrote: post #79

Earlier quoted context omitted.

Thank God for backups! And thank you for making sure people make backups. My mother is in a similar situation. She is an elementary school teacher, and has little time for unrelated endeavors like this. What time she does have, is spent in the garden, as it should be. Nevertheless, we are now seeing that the time-cost of closed source software, is greater than that of open-source software. My solution has been to pre…

How quickly some forget heartbleed. The solution to malware is obscurity. Have an OS that no one wants to break into, and you won't be broken into.

I think you are referring to diversity, not obscurity. Diversity does indeed increase the resilience of the network, but there will always be enough common factors across the board, that diversity alone will not suffice.

In the end, the software that we depend on, must be reviewable by anyone who is concerned about it. A prerequisite for that, is that software should be as small, clean, and simple as possible, to encourage such scrutiny. IIRC, the real problem with heartbleed, is that the OpenSSL codebase was a mess, and no-one wanted to work on it.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#117

Post by jdironman »

dhimes wrote: post #70
ComodoHacker wrote: post #53

Edit: Botnet stats and spread (switch to 24H to see full picture): https://intel.malwaretech.com/botnet/wcrypt Live map: https://intel.malwaretech.com/WannaCrypt.html Relevant MS security bulletin: https://technet.microsoft.com/en-us/library/security/ms17-01... Edit: Analysis from Kaspersky Lab: https://securelist.com/blog/incidents/78351/wannacry-ransomw...

Are we watching this thing wake up right now?

If so, that is both scary and exciting.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#118

Post by ctrl-j »

maerF0x0 wrote: post #99
turnip123942 wrote: post #60

I think this is an excellent example that we can all reference the next time someone says that governments should be allowed to have backdoors to encryption etc. This shows that no agency is immune from leaks and when these tools fall into the wrong hands the results are truly catastrophic.

To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. The ethical concern here is whether the NSA should have reported the holes to the manufacturers and the failure to handle its privileged knowledge in a safe manner.

> ... it's not the NSA's fault that software has faults.

But every time they ask for there to be legally mandated backdoors - they need to be reminded of these incidents.

The NSA actively wants there to be "faults" like these. They just only want the "good" guys to have access to them.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#119

Post by problems »

degenerate wrote: post #72
ComodoHacker wrote: post #62

Earlier quoted context omitted.

Proper backup system?

Well yes that's obvious, I meant more along the lines of: Are there any ways to detect and stop it from happening in 2017? Third party software? New group policies from MS?

Not really, ultimately if someone has write to your network drive, it's not any different than malware having it. The best solution is a good backup and protecting your hosts from being infected as much as possible.

I believe some people were trying to do rate limiting and traversal detection, which should be possible, but also is common in many tools, like running grep or find on a network share, so it's far from a perfect solution. It could also probably be avoided by clever malware if it were to be widely deployed.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#120

Post by devrandomguy »

kevindqc wrote: post #114
devrandomguy wrote: post #38

Earlier quoted context omitted.

This malware is well written, and uses strong encryption. I would suggest that you and your father spend the evening reading up on backup practices, and reconsider the value proposition of open source software. I hope I am not coming off as a smug jerk. My hope is that rather than becoming frustrated and demoralized after an evening of fruitless hacking, you and your uni will recover, and become resilient against fut…

I understand that people love open source, but how is that relevant here? For example OpenSSL is open source, yet it didn't prevent Heartbleed and other exploits from happening?

OpenSSL was an example of open source done badly; neither of our communities can claim to be universally perfect. The solution, was to fork and replace OpenSSL with a superior project: LibreSSL. That part of the story, is a success for open source. It shows us recovering quickly and permanently from the worst catastrophe imaginable.
Post reply on HN