Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

mobile.nytimes.com

Post reply on HN
Print view View original

121–130 of 505 posts

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#121

Post by 21 »

ledneb wrote: post #20
zigzigzag wrote: post #16

Earlier quoted context omitted.

Linux doesn't have a magic fix for buffer overflows in networking stacks written in C.

> except for clients that paid for an extended support deal It does have a fix for this, though

Yeah, it's called "install the latest kernel".

Upgrading to a new version of Windows was apparently not possible, which also means that upgrading to a new Linux version would also have been out of the books.

So the only solution would have been to hire someone to backport whatever fix was needed.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#122

Post by InclinedPlane »

maerF0x0 wrote: post #99
turnip123942 wrote: post #60

I think this is an excellent example that we can all reference the next time someone says that governments should be allowed to have backdoors to encryption etc. This shows that no agency is immune from leaks and when these tools fall into the wrong hands the results are truly catastrophic.

To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. The ethical concern here is whether the NSA should have reported the holes to the manufacturers and the failure to handle its privileged knowledge in a safe manner.

You may be thinking of the 2nd law of thermodynamics. Possibly.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#123

Post by 21 »

lossolo wrote: post #46
jordan314 wrote: post #32

Can't law enforcement follow the transactions of the public address of the ransom bitcoin wallet until the bitcoin is sold?

There are services that will mix your coins making it impossible to track because he will receive other people coins from the pool.

Not impossible, just hard.

And the cops can go and track each individual person from that pool if they really care. Even if we are talking about thousands.

Remember the story from a few days ago where to track a possible spy they went through all glasses prescriptions from a city.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#124

Post by zigzigzag »

ledneb wrote: post #20
zigzigzag wrote: post #16

Earlier quoted context omitted.

Linux doesn't have a magic fix for buffer overflows in networking stacks written in C.

> except for clients that paid for an extended support deal It does have a fix for this, though

Does Debian still support Woody? Does Red Hat still support whatever OS they were shipping in 2001?

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#125

Post by hackuser »

mhogomchungu wrote: post #4

I am in Tanzania(East Africa) and my father's computer is infected. All he did to get infected was plugging his laptop on the network at work(University of Dar Es Salaam). The laptop is next to me and my task this night is to try to remove this thing.

Tip: Don't spend time trying to remove malware and undo its effects. You'll never know if you succeeded; most malware is designed to hide itself, and likely this particular malware is well-written.

Wipe the laptop and reinstall. It's more certain, and probably won't take much longer than trying to remove the malware. If the malware infects firmware or other subsystems below the OS, and thus won't be removed by a reinstall, buy a new laptop if that's an option.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#126

Post by anigbrowl »

SCHiM wrote: post #98
anigbrowl wrote: post #37

Earlier quoted context omitted.

Your last sentence seems to contradict your first, whereas what you would really prefer is to disarm the police. Sadly I don't think that's so practical, in the same way that it would be impractical for US police to go unarmed given the high incidence of gun ownership in the US. I grew up in a country where police are not normally armed (other than with a small baton or similar personal defense weapon) and much prefe…

The problem with the gun analogy in your particular argument is that a 'cyber weapon' or exploit is the flip side of a flaw in normal software. The NSA is in a very weird position because they have a task to protect the systems of the US (Information Assurance) but also to attack those of adversaries. In this case I think they are legitimately to blame for failing to discharge their assurance duties. They've failed t…

I'm not defending the NSA's poor security of bad strategic choices; the reason I use the gun analogy is that mass -production of weapons is as much the flip side of industrial production as cyber weapons are the flip side of normal software vulnerabilities.

Also, when you're under attack it might be more useful to worry about the identity and source of your attackers than where they stole the weapons from. Weapons facilitate aggression but are not the cause thereof, and we're not the only people who know how or maintain an interest in such weapons.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#127

Post by zigzigzag »

jordan314 wrote: post #32

Can't law enforcement follow the transactions of the public address of the ransom bitcoin wallet until the bitcoin is sold?

There are a handful of Bitcoin exchanges that don't follow anti-money laundering laws and presumably that's how these ransomware guys cash out, as it's been a problem for a while now.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#128

Post by mjevans »

a2tech wrote: post #78
bluGill wrote: post #34

Earlier quoted context omitted.

In defense of these medical devices, that is actually a FDA requirement. The entire combination of the system is certified to work, and even one patch for a security vulnerability leaves open the possibility that the patch breaks something and people die! Of course it goes without saying that you need to ensure that a virus cannot run on this machine by some other means. If these machines can get infected they automa…

This 100x. I know it's extremely easy to Monday morning quarterback hospital IT but it's not as simple as people think. There's legal and, far more importantly, medical implications to updating software at a hospital. Oh you think it's ridiculous we use i.e. 7 in compatibility mode? It's because our mission critical emr only works in that (well it really works in everything but it's certified in 7) and if we use anyt…

Yes, it actually is.

Life critical systems should be small, fully open stack, fully audited, and mathematically proven to be correct.

Non-critical systems, secondary information reporting, and possibly even remote control interfaces for those systems should follow industry best practices and try to do their best to stay up to date and updated.

Most likely many modern pieces of medical technology have not been designed with this isolation between the core critical components that actually do the job and the commodity junk around them that provide convenience for humans.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#129

Post by maerF0x0 »

ctrl-j wrote: post #118
maerF0x0 wrote: post #99

Earlier quoted context omitted.

To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. The ethical concern here is whether the NSA should have reported the holes to the manufacturers and the failure to handle its privileged knowledge in a safe manner.

> ... it's not the NSA's fault that software has faults. But every time they ask for there to be legally mandated backdoors - they need to be reminded of these incidents. The NSA actively wants there to be "faults" like these. They just only want the "good" guys to have access to them.

I definitely agree wrt intentional exploits ("backdoors") to be added. To me this news highlights the need for fundamentally safe software. Just like we might have safety laws in the automotive or airline industry.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#130

Post by hackuser »

AdeptusAquinas wrote: post #91
devrandomguy wrote: post #79

Earlier quoted context omitted.

Thank God for backups! And thank you for making sure people make backups. My mother is in a similar situation. She is an elementary school teacher, and has little time for unrelated endeavors like this. What time she does have, is spent in the garden, as it should be. Nevertheless, we are now seeing that the time-cost of closed source software, is greater than that of open-source software. My solution has been to pre…

How quickly some forget heartbleed. The solution to malware is obscurity. Have an OS that no one wants to break into, and you won't be broken into.

> The solution to malware is obscurity. Have an OS that no one wants to break into ...

... and you'll have an OS for which neither malware authors nor legitimate software developers want to write applications.

There's a trade-off involved. We could all use pen an paper and be invulnerable to malware, but then how would we post on HN?

Post reply on HN