51–60 of 164 posts
Earlier quoted context omitted.
AIUI they would have been better off if they'd used the latest of any operating system.
If you're talking about an MRI machine, the proper drivers may not exist for a current operating system. The absolute last thing you want is for an image to show up differently on the new system due to changes to OpenGL or something.
Earlier quoted context omitted.
This is what happens when spambot skiddies accidentally acquire a treasure-trove of NSA tools via a C2 server they have pwned. They failed to sell ('broker') them as nobody was stupid enough to touch them, they failed to blackmail with them (omg what a bad move), then they failed to weaponise their own gear with them (wcry 1.0 in February), and even though wcry 2.0 is widespread and very disruptive, really they faile…
A bunch of articles, even Snowden, argued that it's very likely that the NSA tools were stolen by the Russians. https://twitter.com/Snowden/status/765514891813945344
Of course, if you were a nation state and you wanted to attack an adversary but you knew that if you did you would get blowback, you might "lose" some tools that you knew some script kiddies would be able to weaponize.
Interesting times indeed.
Is it possible that multiple variants with randomly-generated kill-switches are being automatically generated?
Uploaded to virustotal MEANS found in the wild. That's what admins do when they discover things.
Earlier quoted context omitted.
How do you mean? Is the malware detecting its in a VM?
And why would they not then use randomly generated domain names, instead of hardcoding domains that could be registered?
Just wait until this hits the files of a Russian mob who then take some Americans hostage and fly to China and end up entangled in an islamic terrorist plot. 'Cause then we're in for a very long and drawn out story involving MI6, the CIA, Canadian smuggling routes, and Christian Isolationist 2nd Amendment fanatics.
Psst, downvoters - https://en.wikipedia.org/wiki/Reamde
Earlier quoted context omitted.
Do you seriously expect criminals are dumb enough to leave any useful information there?
Remember the guy which created Silk Road. People talked about him in mythical terms, that he probably has the op-sec of God, but afterwards facts pointed to major mistakes, like connecting identities to his real name, and suddenly everybody was like "how can he be so stupid, doing this while being the owner of a $100 mil criminal empire"
> A new variant with no kill-switch recovered by Kaspersky as a virustotal.com upload — not detected in the Wild. Uploaded to virustotal MEANS found in the wild. That's what admins do when they discover things.
Earlier quoted context omitted.
If you're talking about an MRI machine, the proper drivers may not exist for a current operating system. The absolute last thing you want is for an image to show up differently on the new system due to changes to OpenGL or something.
If you're talking about an MRI machine, and you put it on the goddamned internet, $300 is actually a pretty cheap security tutorial.
Maybe it would be better to wait until the attackers registered the domain, then sopoeana the registrair for their account info.
I suppose that might be interesting just to see if they're stupid enough to register with traceable info.