Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

mobile.nytimes.com

Post reply on HN
Print view View original

181–190 of 505 posts

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#181

Post by doomrobo »

placeybordeaux wrote: post #173

Going through their wallets it looks like they've gotten 32 pay outs, some for more than 300 USD. Are there any addresses that they are using outside of the four listed int he article? It'd be an interesting project to try and track where these funds go and where they came from. https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6N... - 11 https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNX... - 4 htt…

They'll probably be tumbled (i.e Bitcoin laundering), meaning that we'll get no info from the transactions at all.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#182

Post by [deleted] »

mjevans wrote: post #128
a2tech wrote: post #78

Earlier quoted context omitted.

This 100x. I know it's extremely easy to Monday morning quarterback hospital IT but it's not as simple as people think. There's legal and, far more importantly, medical implications to updating software at a hospital. Oh you think it's ridiculous we use i.e. 7 in compatibility mode? It's because our mission critical emr only works in that (well it really works in everything but it's certified in 7) and if we use anyt…

Yes, it actually is. Life critical systems should be small, fully open stack, fully audited, and mathematically proven to be correct. Non-critical systems, secondary information reporting, and possibly even remote control interfaces for those systems should follow industry best practices and try to do their best to stay up to date and updated. Most likely many modern pieces of medical technology have not been designe…

[deleted]

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#183

Post by brilliantcode »

tankenmate wrote: post #164
brilliantcode wrote: post #135

Isn't it peculiar that Russia remains the least hit or not even hit at all? It seems like the West was a clear target. Connecting the dots here, it's suffice to say Shadow Brokers serves Russian interests. We are seeing bullet holes from what seem to have been cyber warfare between the former cold war foes.

Time of day, come back in 12 hours and check again. That said the Russian government is trying to move people to local distributions of Linux, like Astra Linux, but I don't think the uptake is enough to explain low infection rate in Russia.

Yeah definitely downvote manipulations going on again...

At this point I'm not even upset or shocked. It just further supports the narrative Russia is seeking to manipulate/exploit the internet to their benefit.

Considering the average Russian is poorer than an Indian, it looks like Putin is going to fuck over his country as his countrymen cheer him on and suffer in poverty and alcoholism.

The West will crush the feeble Russian economy back to Tsar days.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#184

Post by davesque »

turnip123942 wrote: post #60

I think this is an excellent example that we can all reference the next time someone says that governments should be allowed to have backdoors to encryption etc. This shows that no agency is immune from leaks and when these tools fall into the wrong hands the results are truly catastrophic.

If I understand correctly, there were no backdoors used here. Only zero-days. If the NSA is guilty of anything, they're guilty of not informing system designers of exploitable vulnerabilities. But then the argument becomes entirely ideological and naive since we all know the NSA's mission is almost entirely counter to that outcome.

Edit: Apparently, not zero days. Vulnerabilities were patched months ago. I think the point still stands, which is that this outcome really has little to do with debate over encryption backdoors.

2nd Edit: On second thought, there is an argument that, if a backdoor were in place that only government agencies had access to, the means to access it could be leaked just as easily and in a similar manner to the way that information about these vulnerabilities was leaked. Then, we'd really be fucked since a backdoor could likely not be "fixed" with a simple patch (it might be fundamental to the design of a system). Considering this, I'll have to walk back my earlier statement and agree that the topic of backdoors is quite relevant here.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#185

Post by dgregd »

turnip123942 wrote: post #60

I think this is an excellent example that we can all reference the next time someone says that governments should be allowed to have backdoors to encryption etc. This shows that no agency is immune from leaks and when these tools fall into the wrong hands the results are truly catastrophic.

> This shows that no agency is immune from leaks

That's well known for a long time. During cold war a lot of Russian weapons were based on the US designs. There is a TV series, Americans, which shows how to manipulate people and steal secrets. Even atomic bomb secrets were stolen (by Klaus Fuchs and others).

So I guess a lot of people in military complex make a lot of money on these exploits, PRISM and other projects. And they just don't care about whole society.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#186

Post by tomschlick »

a2decrow wrote: post #165
pjc50 wrote: post #107

Earlier quoted context omitted.

Surely that's the point of hooking them up to the network, so you can e.g. get the pictures out of your CT scanner on to the doctor's PC?

The doctors' PC can run just fine on an isolated network and doesn't have to be connected to the internet.

Until that doctor needs to submit patient info to a study, look up an obscure symptoms, talk with others in the medical community, etc.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#187

Post by devrandomguy »

eggbrain wrote: post #19
RangerScience wrote: post #7

> "Microsoft rolled out a patch for the vulnerability last March, but hackers took advantage of the fact that vulnerable targets — particularly hospitals — had yet to update their systems." > "The malware was circulated by email; targets were sent an encrypted, compressed file that, once loaded, allowed the ransomware to infiltrate its targets." It sounds like the basic (?) security practices recommended by professio…

> It sounds like the basic (?) security practices recommended by professionals - keep systems up-to-date, pay attention to whether an email is suspicious - would have covered your network. This is secondhand information (so take it for what it's worth, there could be pieces I'm missing), but I talked with a startup that was focusing on this problem, and the issue was not quite the computers and servers that IT were u…

If it is infeasible to keep certain critical, networked device up to date, then I propose an alternative solution: those devices should only produce output, they should not read anything at all from their external ports. Their only input, should be their physical user interface. Would that work, for, say, an x-ray machine, or an MRI?

We saw a fictional example of a scheme like this on Battlestar Galactica. Officers phoned and faxed orders around the ship, using simple devices that did not execute software. The CIC had its data punched in by radar operators, instead of networking with shipwide sensors. It was a lot of work, but it did keep working in the face of a sophisticated, combined malware/saboteur attack.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#188

Post by cryogenspirit »

boardwaalk wrote: post #175
cryogenspirit wrote: post #159

Q: does anyone know how to disable regular internet access in Windows except through a virtual machine (VMware or Virtualbox)? I have set up my mom to use a live debian cd through VMware, but I would also like to disable networking through Windows Edge and Explorer. I don't know how to do this however. Myself, I follow a similar scheme but using a linux virtual guest and host. Is it easy to disable networking for all…

My first thought would be to clear the routing table on Windows (maybe using a batch script on startup?) and using bridged networking in the VM. That would totally disable internet access on Windows though, including updates (but you also wouldn't have that attack surface!)

Thanks. Had a brief look, seems useful.

Does the VM using the "nat" mode of networking also use Windows routing table? I don't know much about the networking between guest and host, except that the guest uses NetworkManager through its ethernet device. Even though this is a virtual device, I didn't think it would go through Windows' own net stack.

Would the bridged networking be any different than passing through the USB wifi adapter directly to VMware? (at which point the host doesn't have access to internet)

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#189

Post by H4CK3RM4N »

print_r wrote: post #168

While I can understand WikiLeaks position, I feel like it was incredibly short sighted and uninformed of them to release the code itself. Unless you believe that they are working with the Russian (and other?) governments to destabilize the west. Personally, I wouldn't be surprised if this was the case.

My impression was hat the Shadow Brokers already had, or were about to release the tools which Wikileaks ended up leaking. Regardless, these should've been disclosed to the manufacturers under Obama's policies.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#190

Post by jansho »

civilian wrote: post #158
jansho wrote: post #134

Earlier quoted context omitted.

I meant it in a more general way: a group of horrible people taking over a core function of society and saying "If you don't do x we will do y." And they will actually do y. As you may have gathered, my original statement is more eloquent.

It isn't more eloquent, because it's wrong. Wouldn't saying: "The new mafia." or "The new shake-down" be more accurate? Terrorism is done for political reasons and often involves things that involve putting fear into the populace. Your general "If you don't do x we will do y." statement does cover terrorism, but it covers terrorism because it covers _all kinds of threats_. So I suppose what you really meant was: "The…

Ah sorry, I got it wrong twice.

But you got me thinking again: because this ransomware is targeting the infrastructure itself (national healthcare service) isn't this playing with fear too? If I was in hospital, or my friends/family, I would be acutely paranoid that medical devices will go wrong, medicine administration will go wrong, the A&E will go bonkers et cetra. I've worked in healthcare before, and this kind of domino effect is very easy to believe in.

(Funnily enough, my old organisation was making a fuss about upgrading from Windows XP just last year. A lot of my colleagues complained that this was hardly a priority)

Post reply on HN