Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

mobile.nytimes.com

Post reply on HN
Print view View original

171–180 of 505 posts

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#171

Post by Bjartr »

MichaelGG wrote: post #30
jbob2000 wrote: post #27

Earlier quoted context omitted.

Your analogy doesn't really work because you can't copy a gun. These tools are way more dangerous than a gun because you can replicate them very quickly. You can never destroy the tools once they are created, someone always has a copy. This is what scares me more than nuclear weapons. A nuke requires a huge amount of people and infrastructure to maintain and launch. But a digital weapon? Pfft, copy that shit onto a U…

Why are power stations on the same network with some guy with a USB key?

Because you left an infected usb key or ten in the power station parking lot, the power of human curiosity, and the marginal cost of proactively protecting against something "very unlikely" by e.g. epoxying usb slots because procedure says it can't happen.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#172

Post by lazaroclapp »

bluGill wrote: post #34
eggbrain wrote: post #19

Earlier quoted context omitted.

> It sounds like the basic (?) security practices recommended by professionals - keep systems up-to-date, pay attention to whether an email is suspicious - would have covered your network. This is secondhand information (so take it for what it's worth, there could be pieces I'm missing), but I talked with a startup that was focusing on this problem, and the issue was not quite the computers and servers that IT were u…

In defense of these medical devices, that is actually a FDA requirement. The entire combination of the system is certified to work, and even one patch for a security vulnerability leaves open the possibility that the patch breaks something and people die! Of course it goes without saying that you need to ensure that a virus cannot run on this machine by some other means. If these machines can get infected they automa…

In offense of these medical devices, they should never have been running Windows or any general purpose OS in the first place! A lot easier to guarantee security if the entire thing is a well tested 10-50KLOC Rust daemon on top of seL4. I am not even asking them to do formal verification themselves, just a small trusted base and reasonable secure coding practices. I mean, come on, a critical medical device running the entirety of Windows XP (or say, Ubuntu with Apache, an X server and GNOME[1]) should be considered actual negligence. The FDA should make it outright impossible to certify such contraption.

Basically, the rule should be: if you are using general purpose consumer software, then you should be doing updates; if you are in an environment where updates are considered too risky, then running commodity software should also be considered too risky and you should be building very small locked down systems instead. Ideally without a direct internet connection (they can always connect through an updatable system that can't actually cause the medical device to malfunction, but can be reasonably protected against outgoing malware as well).

[1] I would be ok with some of these devices running a stripped down Linux (or NT) kernel, just not a full desktop OS. If you need a fancy UI, then that can be in an external (hopefully wired, not IoT) component that can be updated.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#173

Post by placeybordeaux »

Going through their wallets it looks like they've gotten 32 pay outs, some for more than 300 USD. Are there any addresses that they are using outside of the four listed int he article?

It'd be an interesting project to try and track where these funds go and where they came from.

https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6N... - 11 https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNX... - 4 https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8is... - 6 https://blockchain.info/address/1QAc9S5EmycqjzzWDc1yiWzr9jJL... - 11

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#174

Post by AdeptusAquinas »

hackuser wrote: post #130
AdeptusAquinas wrote: post #91

Earlier quoted context omitted.

How quickly some forget heartbleed. The solution to malware is obscurity. Have an OS that no one wants to break into, and you won't be broken into.

> The solution to malware is obscurity. Have an OS that no one wants to break into ... ... and you'll have an OS for which neither malware authors nor legitimate software developers want to write applications. There's a trade-off involved. We could all use pen an paper and be invulnerable to malware, but then how would we post on HN?

That's my point, as I type this on fully patched Win 10 Pro.

Certainly Windows has its issues, but it's biggest 'flaw' when it comes to malware isn't that it's closed-source, but that it's ubiquitous and therefore a highly attractive target.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#175

Post by boardwaalk »

cryogenspirit wrote: post #159

Q: does anyone know how to disable regular internet access in Windows except through a virtual machine (VMware or Virtualbox)? I have set up my mom to use a live debian cd through VMware, but I would also like to disable networking through Windows Edge and Explorer. I don't know how to do this however. Myself, I follow a similar scheme but using a linux virtual guest and host. Is it easy to disable networking for all…

My first thought would be to clear the routing table on Windows (maybe using a batch script on startup?) and using bridged networking in the VM.

That would totally disable internet access on Windows though, including updates (but you also wouldn't have that attack surface!)

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#176

Post by cryogenspirit »

cryogenspirit wrote: post #159

Q: does anyone know how to disable regular internet access in Windows except through a virtual machine (VMware or Virtualbox)? I have set up my mom to use a live debian cd through VMware, but I would also like to disable networking through Windows Edge and Explorer. I don't know how to do this however. Myself, I follow a similar scheme but using a linux virtual guest and host. Is it easy to disable networking for all…

https://www.linkedin.com/pulse/penetration-testers-guide-win...

The above link seems pretty good for locking down Windows if anyone is looking.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#178

Post by ptr_void »

iotasigma wrote: post #160
ptr_void wrote: post #143

Earlier quoted context omitted.

I don't understand. What exactly do the live map points represents and where does the data come from?

https://www.malwaretech.com/2016/01/exploring-peer-to-peer-b...

That's amazing, thanks for the link.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#179

Post by sergior »

turnip123942 wrote: post #60

I think this is an excellent example that we can all reference the next time someone says that governments should be allowed to have backdoors to encryption etc. This shows that no agency is immune from leaks and when these tools fall into the wrong hands the results are truly catastrophic.

Problem is that people (politician) wanting to push it through simply don't care. They just want to have access and they think there are agencies that can deal with potential consequences. It is frankly all about the money - they want to have ability to access sensitive data and therefore be more attractive to people willing to pay the bribe.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#180

Post by lazaroclapp »

mark-r wrote: post #145
mjevans wrote: post #128

Earlier quoted context omitted.

Yes, it actually is. Life critical systems should be small, fully open stack, fully audited, and mathematically proven to be correct. Non-critical systems, secondary information reporting, and possibly even remote control interfaces for those systems should follow industry best practices and try to do their best to stay up to date and updated. Most likely many modern pieces of medical technology have not been designe…

The problem is that the technology stack required by modern equipment is too large to be satisfied by anything but a general-purpose OS. Good luck trying to get a mathematically proven OS.

Pretty sure you can build an X-Ray/MRI control software in Rust on top of seL4, and do lightweight verification (or, even better: hardware breakers of some sort) around issues like "will output lethal doses of radiation". That is a general purpose enough kernel and a general purpose enough programming language, without having to drag in tens of millions of lines of code intended for personal GUI systems... Then for malware issues you simply don't plug that device directly into the internet, nor allow it to run any new code (e.g. your only +X mounted filesystem is a ROM and memory is strictly W^X).
Post reply on HN