Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

mobile.nytimes.com

Post reply on HN
Print view View original

281–290 of 505 posts

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#281

Post by ghrifter »

brilliantcode wrote: post #183
tankenmate wrote: post #164

Earlier quoted context omitted.

Time of day, come back in 12 hours and check again. That said the Russian government is trying to move people to local distributions of Linux, like Astra Linux, but I don't think the uptake is enough to explain low infection rate in Russia.

Yeah definitely downvote manipulations going on again... At this point I'm not even upset or shocked. It just further supports the narrative Russia is seeking to manipulate/exploit the internet to their benefit. Considering the average Russian is poorer than an Indian, it looks like Putin is going to fuck over his country as his countrymen cheer him on and suffer in poverty and alcoholism. The West will crush the fee…

Bernie's loss still sting?

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#282

Post by devrandomguy »

Cakez0r wrote: post #240
devrandomguy wrote: post #205

Earlier quoted context omitted.

all software is vulnerable This is false, and spreads FUD. It does a great disservice to those who do meticulously maintain their systems, to those who sacrifice convenience and beauty for stability and security, to those who take the time to scrutinize other people's work. It is possible to build and deploy secure software. Linux dominates the datacenter; we are a high value target, and have been for quite some time…

I had a feeling I might get called out on that... I meant that for all practical purposes, all software is theoretically vulnerable. Of course verifiable computing is a thing, but wildly impractical for most applications. Meticulously maintained is not even close to being invulnerable. Everyone would like to say they meticulously maintain the projects they work on, but it would be incredibly arrogant to say that you…

Imagine if your next surgeon had this sort of attitude about the cleanliness of her tools, the operating theater, and her staff's equipment. Cleaning is hard, maintaining cleanliness is hard, and pathogens evolve in amazingly clever ways. Perhaps, it will always be possible to propose a theoretical flaw in the procedure.

This is no reason to give up though! It is no excuse for not following best practices, consistently! That is malpractice, when done by a doctor! And their field is at least as complex as our own.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#284

Post by korethr »

alasdair_ wrote: post #259
maerF0x0 wrote: post #99

Earlier quoted context omitted.

To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. The ethical concern here is whether the NSA should have reported the holes to the manufacturers and the failure to handle its privileged knowledge in a safe manner.

>To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. The NSA has a specific mission to secure the nation's infrastructure. In witholding key information from US companies, it's failing that mission.

That's half the NSA's mission. Tt has another half and that is eavesdropping and getting into things. Those two missions are at odds with each other, and so the NSA has to make decisions about trade-offs. As these incidents show, the trade-offs the NSA has chosen to make have turned out to have been bad ideas.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#285

Post by [deleted] »

maerF0x0 wrote: post #129
ctrl-j wrote: post #118

Earlier quoted context omitted.

> ... it's not the NSA's fault that software has faults. But every time they ask for there to be legally mandated backdoors - they need to be reminded of these incidents. The NSA actively wants there to be "faults" like these. They just only want the "good" guys to have access to them.

I definitely agree wrt intentional exploits ("backdoors") to be added. To me this news highlights the need for fundamentally safe software. Just like we might have safety laws in the automotive or airline industry.

[deleted]

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#286

Post by PeterisP »

degenerate wrote: post #50
soneca wrote: post #31

"Microsoft rolled out a patch for the vulnerability last March, but hackers took advantage of the fact that vulnerable targets — particularly hospitals — had yet to update their systems." What Microsoft's software should be updated now to protect against this particular attack? Windows? Windows at the end user machines? The servers? Could someone share a "What should I do now to protect myself" guide, please? Thanks!

From everything I read last year... as long as someone has write access to a shared network resource, your network is vulnerable. I read about ways to detect it early with FSRM, but never tried it: https://chrisreinking.com/stop-cryptolocker-from-hitting-win... Experts, chime in? What is out there in 2017 (paid or not paid) as a way to protect network drives from ransomware?

The same way you protect those network drives from an employee accidentally or intentionally deleting everything.

Limited permissions work, backups work, journaling data storage systems with an ability to rollback all changes work.

In most environments nowadays I guess there's no valid reason to have a literal "network drive" - if your users don't need to wrangle terabyte-sized data blobs, most environments can afford the overhead to have the company document/file sharing to happen in some system that stores full history of changes, and where normal users can not remove that history even if they're malicious or infected with malware. Probably even Dropbox or its competitors would be sufficient for that, no need to go to the more enterprisy vendors.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#287

Post by cortesoft »

Kholo wrote: post #280
cortesoft wrote: post #216

Earlier quoted context omitted.

He is not talking about the actual flaws as being the example as to why we shouldn't give the NSA backdoor access; he is saying that the leaks prove that even the NSA can't keep their stuff secret. If they couldn't keep their hacking tools secret, why should we think they can keep their backdoor access secret?

Good time to remind folks that gmail, facebook, whatsapp, amazon etc aren't going to be able to protect their data forever at the levels they currently are capable off. A couple of bad business decisions and they are where yahoo is today. So be smart about how you use these services and educate the non-technical folks around you.

What would 'being smart' about using these services mean? It is pretty difficult to get through life in the modern age without using email for sensitive documents (or at least without using ACCESS to your email as a way to gain access to sensitive services, eg password reset emails, proof of ownership, etc)

Since email in the modern world has this type of importance, what should I do? If you say gmail can't protect their data forever, do I not use gmail for email? What do I use then? No service will be free from data leakage, even an email server I run myself.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#288

Post by matt_wulfeck »

uxp wrote: post #237
davesque wrote: post #184

Earlier quoted context omitted.

If I understand correctly, there were no backdoors used here. Only zero-days. If the NSA is guilty of anything, they're guilty of not informing system designers of exploitable vulnerabilities. But then the argument becomes entirely ideological and naive since we all know the NSA's mission is almost entirely counter to that outcome. Edit : Apparently, not zero days. Vulnerabilities were patched months ago. I think the…

> Only zero-days. The exploits released by Wikileaks' Vault 7 dump went public months ago. They're as much a 0-day as JFK's assassination was just a few days ago.

I've seen a lot of security people sticking to "this is not an 0day you idiots" retort, downplaying the importance of the leak. Frankly I think that's a pedantic argument that ignores too much of the real world.

The NSA leaks contained previously undisclosed security vulnerabilities that were patched only because they were stolen. In MSFT's case it was less than 30 days, and they basically skipped a patch week to make it happen.

It's manifestly obvious that 0day and 30day can both be considered extremely dangerous in the real world.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#289

Post by Cakez0r »

devrandomguy wrote: post #282
Cakez0r wrote: post #240

Earlier quoted context omitted.

I had a feeling I might get called out on that... I meant that for all practical purposes, all software is theoretically vulnerable. Of course verifiable computing is a thing, but wildly impractical for most applications. Meticulously maintained is not even close to being invulnerable. Everyone would like to say they meticulously maintain the projects they work on, but it would be incredibly arrogant to say that you…

Imagine if your next surgeon had this sort of attitude about the cleanliness of her tools, the operating theater, and her staff's equipment. Cleaning is hard, maintaining cleanliness is hard, and pathogens evolve in amazingly clever ways. Perhaps, it will always be possible to propose a theoretical flaw in the procedure. This is no reason to give up though! It is no excuse for not following best practices, consistent…

I don't know why you think I'm advocating that attitude. I'm not disagreeing that open source is a good thing for security. I'm just saying it's not the silver bullet that some people are claiming it to be.

I would be equally concerned if my surgeon said "I already know the best possible techniques for surgery. No point in investigating further or exploring better methods."

Post reply on HN