Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

mobile.nytimes.com

Post reply on HN
Print view View original

371–380 of 505 posts

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#371

Post by ajmurmann »

nl wrote: post #359
kartan wrote: post #310

Earlier quoted context omitted.

> Patriotism is both a wonderful and terrible thing I found that hypothesis widely accepted, without so much for it. Patriotism fuses core values like freedom or solidarity with a flag. That's why it is easier to pervert. Patriotism tells people that because there are people born in the same line limits that you, you should be proud of what they do, and you should help them first. Patriotism distorts history. > "Four…

Patriotism can be a way to align the interests of a group ahead of those of the individuals in the group. This can be a wonderful and terrible thing.

The scary thing is that it's about the group as opposed to people not in the group. This tribalism is nothing but scary.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#372

Post by drakonandor »

winkeltripel wrote: post #150
maerF0x0 wrote: post #129

Earlier quoted context omitted.

I definitely agree wrt intentional exploits ("backdoors") to be added. To me this news highlights the need for fundamentally safe software. Just like we might have safety laws in the automotive or airline industry.

If the NHS has been significantly crippled by this, and the NSA is partly at fault, could the NHS successfully sue the NSA in the UK? (edit: my logic and phrasing was really bad)

They've been told for years to get off XP. They weren't paying MS to keep it updated. The exploit was patched months ago. Why were these machines even on the internet?

I'd say the NHS is far more at fault than anyone else here.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#373

Post by FLUX-YOU »

kefabean wrote: post #272
uxp wrote: post #231

Earlier quoted context omitted.

> Let's hope it's not XP BMJ released a report[0] just two days ago alleging that up to 90% of the NHS's computers are still running XP. > Many hospitals use proprietary software that runs on ancient operating systems. Barts Health NHS Trust’s computers attacked by ransomware in January ran Windows XP. Released in 2001, it is now obsolete, yet 90% of NHS trusts run this version of Windows. [0] http://www.bmj.com/cont…

It appears the Theresa May is trying to deflect attention from the fact that there has been massive under investment in NHS IT infrastructure by reinforcing that it is a 'international attack on a number of countries and organisations'. Whilst this is true, it's probably also true that the impact of this attack is highly concentrated across organisations with chronic under-investment and a laissez-faire attitude to s…

>Whilst this is true, it's probably also true that the impact of this attack is highly concentrated across organisations with chronic under-investment and a laissez-faire attitude to security.

Good developers are rare enough, but good IT security and security-minded developers are even more rare. And it's even more rare that they decide to work within healthcare.

There just isn't enough of you to go around and you can't be everywhere.

Even if you can afford to have a dedicated pentesting team (I'd like to work at a healthcare system/hospital network that did), physical security is still a major problem if only because it's very easy to impersonate people.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#374

Post by 3pt14159 »

matt_wulfeck wrote: post #288
uxp wrote: post #237

Earlier quoted context omitted.

> Only zero-days. The exploits released by Wikileaks' Vault 7 dump went public months ago. They're as much a 0-day as JFK's assassination was just a few days ago.

I've seen a lot of security people sticking to "this is not an 0day you idiots" retort, downplaying the importance of the leak. Frankly I think that's a pedantic argument that ignores too much of the real world. The NSA leaks contained previously undisclosed security vulnerabilities that were patched only because they were stolen. In MSFT's case it was less than 30 days, and they basically skipped a patch week to mak…

The difference is that at least five nationstates could have gotten in a 30 day window without much trouble.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#376

Post by agnokapathetic »

tootie wrote: post #366
jps359 wrote: post #162

Earlier quoted context omitted.

also that it is very unethical for the US government to find some vulnerability in android/windows/whatever and not report it

Were all of these unreported?

Not only unreported but weaponized by the US Government.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#377

Post by Animats »

dgregd wrote: post #185
turnip123942 wrote: post #60

I think this is an excellent example that we can all reference the next time someone says that governments should be allowed to have backdoors to encryption etc. This shows that no agency is immune from leaks and when these tools fall into the wrong hands the results are truly catastrophic.

> This shows that no agency is immune from leaks That's well known for a long time. During cold war a lot of Russian weapons were based on the US designs. There is a TV series, Americans, which shows how to manipulate people and steal secrets. Even atomic bomb secrets were stolen (by Klaus Fuchs and others). So I guess a lot of people in military complex make a lot of money on these exploits, PRISM and other projects…

We now know that the USSR A-bomb design was a copy of the US's first implosion design, but the USSR H-bomb design was completely new, very different from the US design.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#378

Post by WalterBright »

lazaroclapp wrote: post #172
bluGill wrote: post #34

Earlier quoted context omitted.

In defense of these medical devices, that is actually a FDA requirement. The entire combination of the system is certified to work, and even one patch for a security vulnerability leaves open the possibility that the patch breaks something and people die! Of course it goes without saying that you need to ensure that a virus cannot run on this machine by some other means. If these machines can get infected they automa…

In offense of these medical devices, they should never have been running Windows or any general purpose OS in the first place! A lot easier to guarantee security if the entire thing is a well tested 10-50KLOC Rust daemon on top of seL4. I am not even asking them to do formal verification themselves, just a small trusted base and reasonable secure coding practices. I mean, come on, a critical medical device running th…

Of course, such devices can put their code in ROM, and so any malware would not survive a reboot.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#379

Post by tetraodonpuffer »

cryogenspirit wrote: post #159

Q: does anyone know how to disable regular internet access in Windows except through a virtual machine (VMware or Virtualbox)? I have set up my mom to use a live debian cd through VMware, but I would also like to disable networking through Windows Edge and Explorer. I don't know how to do this however. Myself, I follow a similar scheme but using a linux virtual guest and host. Is it easy to disable networking for all…

This site [1] discusses pretty much what you are asking (all networking going through a virtualbox pfSense) however it's written for windows 7, not sure if this still works for 8-10

http://timita.org/wordpress/2011/07/29/protect-your-windows-...

I would think if you set up the VM to deny everything coming from windows, and allow anything coming from the other linux VM it should work fine (just set up multiple NICs in the pfSense VM and have the linux VM go in through a different NIC than the host windows)

I personally do something similar with linux on linux where I have the host linux be allowed to only reach my internal network and the debian mirrors directly, and anything else is done through VMs.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#380

Post by em3rgent0rdr »

mark-r wrote: post #145
mjevans wrote: post #128

Earlier quoted context omitted.

Yes, it actually is. Life critical systems should be small, fully open stack, fully audited, and mathematically proven to be correct. Non-critical systems, secondary information reporting, and possibly even remote control interfaces for those systems should follow industry best practices and try to do their best to stay up to date and updated. Most likely many modern pieces of medical technology have not been designe…

The problem is that the technology stack required by modern equipment is too large to be satisfied by anything but a general-purpose OS. Good luck trying to get a mathematically proven OS.

https://sel4.systems/ is a formally verified microkernel.
Post reply on HN