Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool • Hacker News Board

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#191

Post by placeybordeaux » Fri, May 12, 2017, 9:01 PM UTC

doomrobo wrote: post #181

placeybordeaux wrote: post #173

Going through their wallets it looks like they've gotten 32 pay outs, some for more than 300 USD. Are there any addresses that they are using outside of the four listed int he article? It'd be an interesting project to try and track where these funds go and where they came from. https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6N... - 11 https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNX... - 4 htt…

They'll probably be tumbled (i.e Bitcoin laundering), meaning that we'll get no info from the transactions at all.

I haven't looked into tumbling recently, whats the volume look like these days? So far the attack has yielded less than 5 btc, I'd guess that amount can be laundered safely. Whats the current limit?

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#192

Post by djsumdog » Fri, May 12, 2017, 9:01 PM UTC

ablankst wrote: post #154

maerF0x0 wrote: post #99

Earlier quoted context omitted.

To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. The ethical concern here is whether the NSA should have reported the holes to the manufacturers and the failure to handle its privileged knowledge in a safe manner.

I agree about this ethical concern, but this attack also shows that reporting the holes to manufacturers is of limited use -- these exploits have been known to manufacturers since at least March, and while patches have shipped, the computers remain vulnerable. Clearly, automatic security updates are still not aggressive enough to prevent these kinds of problems. Though it isn't clear from the article how out-of-date…

I would be curious about this too. I'd assume many of them would be running Windows 7, maybe? (Let's hope it's not XP).

Also, does Windows 10 Pro attached to a domain controller still have the same aggressive updates? Or do domain admins dictate that policy?

At one company I worked at, everyone in IT could volunteer for the patch group to get security patches a few days before the rest of the machines. That seems to work pretty well. Is there any evidence there might have been a 0 day involved that wasn't patched? I find it disheartening that so many machines in large managed networks like telecos and hospitals could be so far behind on patches! (3 months is A LOT in Internet time).

If people are just doing really basic stuff like order entry for doctors/nurses, we really need to get away from the full PC model. Seems like most of these machines should just be Chromebooks, Linux boxes that boot straight to a browser or something of that nature instead of a full PC/Macs. Lower the attack surface with something that's easy to update. Those machines would be lower cost too and easier to manage/patch -- moving back to the terminal/thin-client model.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#193

Post by PeterisP » Fri, May 12, 2017, 9:03 PM UTC

MichaelGG wrote: post #28

eggbrain wrote: post #19

Earlier quoted context omitted.

> It sounds like the basic (?) security practices recommended by professionals - keep systems up-to-date, pay attention to whether an email is suspicious - would have covered your network. This is secondhand information (so take it for what it's worth, there could be pieces I'm missing), but I talked with a startup that was focusing on this problem, and the issue was not quite the computers and servers that IT were u…

Why are those devices being connected to an unsecure network? Surely they should have super limited data exchange features?

Many of the computerized medical devices are diagnostic, so being able to send digital data to doctors quickly and easily over the internet is a key part of their functionality. Also, the other way around - being able to get patient data to the device without manually re-entering them, which is costly and error-prone and thus dangerous.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#194

Post by bdamm » Fri, May 12, 2017, 9:04 PM UTC

jps359 wrote: post #162

turnip123942 wrote: post #60

I think this is an excellent example that we can all reference the next time someone says that governments should be allowed to have backdoors to encryption etc. This shows that no agency is immune from leaks and when these tools fall into the wrong hands the results are truly catastrophic.

also that it is very unethical for the US government to find some vulnerability in android/windows/whatever and not report it

Is it particularly unethical? Many governments around the world are discovering 0-days in commonly deployed products and not revealing that to the vendor, but instead using it as a weapon for navigating computer networks.

Revealing the vulnerability would place the US Govt at a distinct disadvantage.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#195

Post by skybrian » Fri, May 12, 2017, 9:04 PM UTC

mjevans wrote: post #128

a2tech wrote: post #78

Earlier quoted context omitted.

This 100x. I know it's extremely easy to Monday morning quarterback hospital IT but it's not as simple as people think. There's legal and, far more importantly, medical implications to updating software at a hospital. Oh you think it's ridiculous we use i.e. 7 in compatibility mode? It's because our mission critical emr only works in that (well it really works in everything but it's certified in 7) and if we use anyt…

Yes, it actually is. Life critical systems should be small, fully open stack, fully audited, and mathematically proven to be correct. Non-critical systems, secondary information reporting, and possibly even remote control interfaces for those systems should follow industry best practices and try to do their best to stay up to date and updated. Most likely many modern pieces of medical technology have not been designe…

Does this distinction between critical and non-critical systems make sense for medical equipment? Displaying the information to humans (doctors and nurses) is probably life-critical. If the display is broken, it's not working.

It's not like medical devices have an entertainment system like cars and airplanes.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#196

Post by PeterisP » Fri, May 12, 2017, 9:04 PM UTC

a2decrow wrote: post #165

pjc50 wrote: post #107

Earlier quoted context omitted.

Surely that's the point of hooking them up to the network, so you can e.g. get the pictures out of your CT scanner on to the doctor's PC?

The doctors' PC can run just fine on an isolated network and doesn't have to be connected to the internet.

So you propose a separate, isolated network linking all the medical facilities, doctor's offices and private practices nationwide? Even the military doesn't do that for most of their offices.

Also, the doctor's computer pretty much needs to interface with the system(s) that handles patient billing (and thus non-medical companies) and the system(s) that handle patient scheduling, reminders, etc.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#197

Post by bsder » Fri, May 12, 2017, 9:06 PM UTC

lazaroclapp wrote: post #172

bluGill wrote: post #34

Earlier quoted context omitted.

In defense of these medical devices, that is actually a FDA requirement. The entire combination of the system is certified to work, and even one patch for a security vulnerability leaves open the possibility that the patch breaks something and people die! Of course it goes without saying that you need to ensure that a virus cannot run on this machine by some other means. If these machines can get infected they automa…

In offense of these medical devices, they should never have been running Windows or any general purpose OS in the first place! A lot easier to guarantee security if the entire thing is a well tested 10-50KLOC Rust daemon on top of seL4. I am not even asking them to do formal verification themselves, just a small trusted base and reasonable secure coding practices. I mean, come on, a critical medical device running th…

> In offense of these medical devices, they should never have been running Windows or any general purpose OS in the first place!

Except that people don't want to learn a new GUI for every machine...

Except that people want to be able to use a tablet for the interface...

Except that people want to control things from their phone...

Here's the reality: The end user doesn't give one iota of DAMN about security. People want to control their pacemaker or insulin pump from their PHONE. Ay yai yai.

Even worse: can your security get in the way when someone is trying to save a life? That's going to send you to court.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#198

Post by devrandomguy » Fri, May 12, 2017, 9:08 PM UTC

21 wrote: post #121

ledneb wrote: post #20

Earlier quoted context omitted.

> except for clients that paid for an extended support deal It does have a fix for this, though

Yeah, it's called "install the latest kernel". Upgrading to a new version of Windows was apparently not possible, which also means that upgrading to a new Linux version would also have been out of the books. So the only solution would have been to hire someone to backport whatever fix was needed.

An open source update can be audited much more easily than a closed source update. It is also usually possible, with OSSW, to find the discussion where the software's developers proposed various solutions, and debated their merits and risks.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#199

Post by arca_vorago » Fri, May 12, 2017, 9:08 PM UTC

First of all, while I of all people love to pile onto the anti-NSA bandwagon (within constitutional reason that is, I don't advocate their abolishment, but that's a different conversation), there are quite a few non-three-letter related things that have contributed to this story and ones like it.

The primary issue at the heart of things like this, beyond the backdoors and 0-days is this: bad IT.

That being said though, bad IT is far too often the fault of upper management, and not the IT people themselves. After years of sysadmining, I've seen the inside of hundreds of companies, from fortune 500 oil to medium sized law firms. You know what they have all been doing over the years? Cutting costs by cutting IT. Exept... they completely fail to consider long term consequences, which end up costing more.

I blame things like this on two main groups. Boards of directors, and company executives. Far too often I ran into a situation where a company didn't even have a CIO or a CTO, and you had some senior one man miracle show drowning in technical debt reporting to a CEO or CFO and getting nowhere, and therefore getting no support, no budget, no personell, etc. I've seen exceptions too, but they are far too rare. If it's not technical debt that's drowning the company, it tends to be politics. The bottom line is forward thinking IT personell don't get heard, and inevitably companies hire people or an MSP with all the proprietary, cisco, microsoft, oracle, etc bullshit certs that make the C's feel better, but don't actually produce the wanted results. They inevitably end up providing an inferior product with inferior service at a short term cost just as high as doing it right the first time, and a much higher long term cost.

If I could say one thing that could help prevent issues like this, besides my standard whinging on about FOSS and the four freedoms and such, is that we need better CTO's and CIO's to advocate on behalf of IT departments, and I think senior sysadmins who feel they have hit a ceiling should consider going for their MBA's and transitioning to those titles.

Now, onto the NSA angle of the story. Well... all I can say is I told ya so, with an extra note that HN in the past few years has been surprisingly dismissive of FOSS proponents who have been warning about these things.

First they made fun of us for saying everything was being spied on, and then Snowden happened. (often followed by bullshit like "are you suprised?" or "what do you have to hide?"

Then we warned about proprietary systems, and then NSA/CIA tool leaks happened. (often followed by things like "but its for foreign collection only" and "but the NSA contributes to SElinux")

Ya'll aren't listening until after the fact, and that's not going to fix anything.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#200

Post by djsumdog » Fri, May 12, 2017, 9:08 PM UTC

betenoire wrote: post #82

slashcom wrote: post #75

Earlier quoted context omitted.

I worry that they might sell it as a reason backdoors are necessary: if only we had backdoors, we could've saved those patients! The flaw of this logic would be lost on most lawmakers.

Humor me... if encryption had a backdoor, then ransomware could be effectively mitigated.... Though I'm not a proponent of backdoors by any means, I don't see the logical flaw here.

...Because criminals are going to use state-sanctioned encryption software with mandated backdoors?

Even if everything off the shelf and open source has some built-in escrow unlocking keys compiled in, hackers are just going to find those code paths and remove them. Encryption works because of certain mathematical principals and laws.

Backdoors will only let governments look at legitimately encrypted data and not anything made by criminals who know how technology works.

There's a bigger question here: what if the NSA or CIA or some other intelligence/defence organisation discovers a solution to solve some of these hard problems in polynomial time .. and then doesn't release that information so they can use it to spy.

In that situation you're going even further: you have agents who are literally holding back scientific research that could change the entire field of mathematics and human understanding, research that could advance number theory by orders of magnitude (a jump equal to that of going from the first flight Kitty Hawk to the Saturn 5 rocket), for limited political gain.