Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

mobile.nytimes.com

Post reply on HN
Print view View original

441–450 of 505 posts

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#441

Post by kpil »

amluto wrote: post #382
skybrian wrote: post #195

Earlier quoted context omitted.

Does this distinction between critical and non-critical systems make sense for medical equipment? Displaying the information to humans (doctors and nurses) is probably life-critical. If the display is broken, it's not working. It's not like medical devices have an entertainment system like cars and airplanes.

The display and the business end of the equipment are critical and should not be network-connected (or even have USB ports, for that matter). The part that uploads to whatever big server should have updates all the time. The critical bit should either be connected to the non-critical bit by a genuinely one-way link (e.g. unidirectional fiber) or should use a very small, very carefully audited stack for communication.…

Yep. That worked fine for the Iranian uranium centrifuge guys...

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#442

Post by Kali909 »

There's the bitcoin ransom aspect, but presumably a worm like this could extract a massive amount of data from infected servers and send that back to someone/somewhere?

Bank transactions, patient medical data, stored passwords/keys/CA info, contacts, emails, configuration files, registry dumps for firewall rules etc etc. (I'm not that creative so there's probably a lot more that's been exfiltrated).

Pretty hellish knowing they'd let that quietly sit there, in the name of espionage. I'm not sure the benefits outweigh the damage they're doing, without even mentioning the chilling effect and lack of confidence this instills in IT everywhere.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#444

Post by 7952 »

amluto wrote: post #382
skybrian wrote: post #195

Earlier quoted context omitted.

Does this distinction between critical and non-critical systems make sense for medical equipment? Displaying the information to humans (doctors and nurses) is probably life-critical. If the display is broken, it's not working. It's not like medical devices have an entertainment system like cars and airplanes.

The display and the business end of the equipment are critical and should not be network-connected (or even have USB ports, for that matter). The part that uploads to whatever big server should have updates all the time. The critical bit should either be connected to the non-critical bit by a genuinely one-way link (e.g. unidirectional fiber) or should use a very small, very carefully audited stack for communication.…

An alternative would be to expose these subsystems on a network and have strict API's, encryption, and authentication between them. This would allow you to audit/update components individually rather than the whole device. So your display would act as a networked display and only have a very limited set of functions.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#445

Post by erikbye »

mgalka wrote: post #396

What exactly does this NSA tool do? Every story I've seen glosses over how it works.

The tools in reference are from the Equation Group dump the Shadow Brokers did. Equation Group is believed to be the NSA (a group within). EG activity dates back to at least 1996.

More info on EG: https://securelist.com/files/2015/02/Equation_group_question...

The dump contains many tools; but the ones used in this attack are two exploits for vulnerabilities in Windows SMB (Server Message Block, a file sharing protocol) implementation. Microsoft patched this in March, but as we all know, many systems remain unpatched. The vulnerabilities allowed for remote code execution.

Practical exploit info: https://www.exploit-db.com/docs/41896.pdf

The two exploits, EternalBlue and EternalChampion targets respectively SMBv2 and SMBv1. That's not how the ransomware gets inside the network in the first place though, that is done by a user executing a file received via email, or downloaded from a received URL. But, through these two exploits, once inside, it can spread through the network (subnet) worm-like. Actually, the ransomware first checks for the existence of the backdoor (also from the same dump of tools) called DoublePulsar. If the ransomware does not find it to be implanted, it will use one of the two aforementioned exploits, based on which ports and protocols it makes a connection to.

The DoublePulsar backdoor is installed on at least 400,000+ systems worldwide.

You can read more about it here: https://countercept.com/our-thinking/analyzing-the-doublepul...

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#446

Post by erikbye »

alltakendamned wrote: post #66
degenerate wrote: post #58

Earlier quoted context omitted.

I disabled SMBv1 on the server. Good enough to protect our network share? Or is there some reason/benefit to disabling SMBv1 on client machines too? (I ran the simple powershell command on server: https://support.microsoft.com/en-us/help/2696547/how-to-enab... )

The main one is to have _all_ machines patched through windows update. That is what will protect you. SMBv1 is an outdated protocol, in which there have been some severe vulnerabilities disclosed in the last few weeks, hence why I recommended to get rid of it at the same time. That being said, the vulnerability being exploited here is in SMBv2, hence why patching all machines is crucial.

If you are working with SCCM and 20,000+ clients (computers), you will know that all machines will never be patched. It just does not happen. On any given large network there will always be a certain number of unpatched clients. There are a myriad of reasons for patching to fail, from advertisement errors to installation issues, to machines simply being offline (and later coming back online).

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#447

Post by erikbye »

pryce wrote: post #383
alltakendamned wrote: post #66

Earlier quoted context omitted.

The main one is to have _all_ machines patched through windows update. That is what will protect you. SMBv1 is an outdated protocol, in which there have been some severe vulnerabilities disclosed in the last few weeks, hence why I recommended to get rid of it at the same time. That being said, the vulnerability being exploited here is in SMBv2, hence why patching all machines is crucial.

I notice that Microsoft is claiming the exploit is in SMBv1 in their patch description [1]. [1] https://support.microsoft.com/en-us/help/4012598/title

There are two exploits. One targets SMBv1 and the other SMBv2. Then there's the backdoor.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#450

Post by mirimir »

whatnotests wrote: post #411
arthurfm wrote: post #407

Earlier quoted context omitted.

MalwareTech found the kill switch for WannaCrypt too. https://www.theguardian.com/technology/2017/may/13/accidenta... https://twitter.com/MalwareTechBlog/status/86318710471668531... https://twitter.com/MalwareTechBlog/status/86318907784311603...

This sounds like something straight out of a James Bond movie.

That was a dumb move by the malware coder ;)

Wouldn't you want to hide a kill switch?

Post reply on HN