A Cyberattack 'the World Isn’t Ready For'

https://www.nytimes.com/2017/06/22/technology/ransomware-attack-nsa-cyberweapons.html?hp&action=click&pgtype=Homepage&clickSource=story-heading&module=second-column-region&region=top-news&WT.nav=top-news

by darod • 9 years ago

400 241 9 years ago

nytimes.com

throwaway911112• 9 years ago

Technical details of DoublePulsar here: https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial...

nulagrithom• 9 years ago

I feel silly saying this, but I sometimes imagine a scenario in which the attackers are not motivated by money but instead are aiming to simply cause as much destruction as possible, like some kind of "cyberterrorism".

Imagine if the creators of WannaCry had decided to brick everything they could, instead of _just_ holding data for ransom. What then?

Ben-Oni (from the article) says he sees it as "life-and-death". I agree. We're simply not prepared for a well-coordinated attack. I think it will take a true catastrophe before anyone really understands just how vulnerable the Internet is.

paradite• 9 years ago

So it's like building weapons of mass destruction without being noticed? Sounds really bad.

blitmap• 9 years ago

I'm imagining a future where systems have become so complex it's impossible to isolate and deactivate a worm. Malware that may not be effective anymore, but persists on the Internet hopping from unmaintained system to unmaintained system forever.

https://www.youtube.com/watch?v=jSospSmAGL4

ams6110• 9 years ago

Malware does that now. There are enough unpatched/vulnerable systems on the internet at any given time that nothing is ever really eradicated.

eob• 9 years ago

When alien archeologists study the third rock from Sol, they will find no life save for IRC C&C bots chattering back and forth. Feels like the end to an interesting sci-fi novel.

throwanem3• 9 years ago

That's actually a major plot element in Peter Watts' ßehemoth trilogy.

jlgaddis2• 9 years ago

Check your web server's access logs. I still see evidence of Code Red [0] on a regular basis.

[0] https://en.m.wikipedia.org/wiki/Code_Red_(computer_worm)

problems• 9 years ago

That's already the case last I checked - plug any machine into the internet directly you'll still get scanned for vulns from early 2000s.

tlrobinson• 9 years ago

That seems pretty inevitable, not unlike biological pathogens.

Actually, I can imagine a future where we use AI to eliminate biological pathogens, but digital pathogens proliferate.

PhasmaFelis• 9 years ago

I feel silly saying this, but I sometimes imagine a scenario in which the attackers are not motivated by money but instead are aiming to simply cause as much destruction as possible, like some kind of "cyberterrorism".

That's pretty much how viruses worked before people figured out how to monetize them. A whole industry was built to defend against bored, malicious teenagers.

virmundi2• 9 years ago

We're not trying to fight it at a legislative level. For example, ISPs could mitigate DDoS attacks through various means [1]. Sadly they just don't want to do the few day worth of labor (maybe more if they haven't properly automated their infrastructure over the last few years). Now look at Congress, they haven't required that. They haven't used the power of the Constitution to regulate interstate commerce, definitionally what happens when you buy things online, to require that ISPs must do reasonable things to limit the affect of such attacks.

1 - https://tools.ietf.org/html/rfc2827

sanderjd2• 9 years ago

I don't think the attitude that it's "a few days worth of work or oh I guess maybe a few more if they don't have everything automated yet..." is very helpful. It diminishes the problem and is incredibly unrealistic. While I don't have experience running an ISP, it's huge infrastructure, which is inevitably incredibly complex and it is almost certainly expensive, time consuming, and extremely risky to roll out major changes. But I don't disagree with you! This is even more of a reason that we need help from regulators on this front. Things that are prohibitively costly for private entities to do but must be done for society to function the way we want it to are the sweet spot for regulation.

I keep hearing that the government is taking cyber security seriously, but I see no evidence. Where is the DHS funded formal verification tool or subsidized penetration testing for critical infrastructure? I'm not saying these are the right ideas, but I don't see anything at all. Perhaps I just don't know of the programs that already exist though - looking forward to being educated here!

ehnto• 9 years ago

It would take a global effort. An ISP level DDoS mitigation doesn't help me access my servers in the UK from Australia while they are being attacked from a wordlwide botnet.

It also raises concerns about traffic control. What if my entirely legitimate but small service in Australia is blocked by US DDoS mitigation? They have no reason to care and I may have no legal or monetarily reasonable recourse.

lcw• 9 years ago

What would legislation look like for DDoS on an ISP level?

You make DDoS mitigation sound easy, but most of what I would call successful attacks are from traffic that looks real at the ISP level and are relatively low bandwidth. Attackers achieve success through locking some aspect of their victims architecture.

Most websites are not prepared for large fluctuations relative to their normal traffic, which look like a drop in the bucket when you are at an ISP level. I don't blame websites for this because mitigation at this level can be expensive.

I think legislation for something like this would be a mess, because it's not simple and it has a technical solution.

Silhouette2• 9 years ago

I think it will take a true catastrophe before anyone really understands just how vulnerable the Internet is.

Or how bad an idea it is to connect anything and everything to that Internet, particularly if it does anything important or potentially dangerous. If the Internet is one of the best ideas humanity ever had, the Internet of Things may prove to be one of the worst.

My personal nightmare involves a vulnerability in a popular model of remotely connected and semi-autonomous or autonomous vehicle. I don't think Western governments have any idea how much harm something like that could do or how plausible it actually is, and I don't think the auto industry executives care enough to stop it.

ElijahLynn2• 9 years ago

Yeah, I think vehicle software is going to be a nightmare. No way are they going to keep patching software after 5 years or maybe 10. I can imagine that a 20 year old vehicle will just be recycled into scrap because it has been compromised.

ocdtrekkie2• 9 years ago

I personally don't really intend to buy any cars with a wireless network connection. I don't know how much longer that will be possible. But at least requiring physical access will help a lot. (And prevent a true horror: Someone figuring out how to make malware spread from car to car.)

Regarding "IoT": There's no reason your light switches should talk to the Internet, even for home automation purposes.

WalterBright8• 9 years ago

Put the car's firmware in ROM. Power cycle the electronics, and the malware is gone.

closeparen• 9 years ago

It doesn't need to be on the internet to be catastrophically exploited. Most buildings have zero defense against tailgating, let alone sophisticated covert entry. Most organizations contain people who can be tricked, bribed, or accidentally hire an adversary.

Disconnection can stop drive-by malware, people trawling for additions to their botnet collections. Someone who wants to launch a coordinated attack will have no problem getting behind the firewall or across the air gap at enough interesting networks to cause serious harm.

We have to actually write secure software.

finolex1• 9 years ago

The Singapore government implemented something similar a year earlier - disconnecting all government office computers from the internet. It's inconvenient, but in certain high risk use cases (power plants, airports, etc.) it might be essential because there will always be vulnerabilities in a system, especially when people are involved, no matter how well the systems are monitored.

paulmd• 9 years ago

My personal nightmare involves a vulnerability in a popular model of remotely connected and semi-autonomous or autonomous vehicle.

The CAN bus is a fundamentally insecure system. Devices accept that you are the device ID you say you are. The only way for a device to vote you out is for it to see its forged ID go out on the bus and then trash the bus. Not remotely failsafe.

Increasingly vehicles are networked systems. Devices need to act like it - encrypt data between themselves and authenticate each other. Without subsystem-level access controls (should the head unit be talking to the brake controller?) there is just too much attack surface.

You can no longer be secure on a "friendly bus", this is now a mini-WAN as far as attack surface, and has been since wifi/bluetooth/cellular basebands were put on the bus. Firmware updates need to be cryptographically signed (or jailbreakable with a user-selectable root CA cert).

Everything else is vehicle manufacturers whistling past the graveyard. The CAN bus is dead, it passed away probably 10 years ago, it's just zombie companies who refuse to re-engineer appropriately when they can just ignore the problem instead (recalls don't happen right?). It's cheaper just to put the new head unit in.

SomeStupidPoint3• 9 years ago

The situation is so scary, I don't even joke about it.

I don't want to discuss it in depth for the same reasons, but joking around with friends has led to feeling physically ill and bouts of drinking because of the extremely dangerous possibilities that exist.

It's a fundamental mistake to network all of society to make it efficient: inefficiency is security. (In a broad, theoretical sense -- from capitalism to government to IT.)

rbosinger• 9 years ago

I bet it would actually end up stimulating the economy like a war does. Not to say I think this scenario would be good.

xyrnoble• 9 years ago

Have you seen the Live Free or Die Hard [1] fire sale? Also, the original Deus Ex has the New Dark Age [2] ending. Both are similar to what you've described.

1: http://diehard.wikia.com/wiki/Fire_Sale

2: http://deusex.wikia.com/wiki/Deus_Ex_endings

paulie_a2• 9 years ago

Have you seen live free or die hard? It was a heist flick and a crappy movie in general.

It utilized scary "cyberweapons" as a plot point but the goal was to steal.

pvg2• 9 years ago

We're simply not prepared for a well-coordinated attack.

Aren't we? We handle natural disasters, large-scale power grid failures, etc. If WannaCry bricked everything it touched, the results would have been much worse and more tragic but would they be worse than an earthquake or hurricane in a major metropolitan area?

Clubber2• 9 years ago

Yes and no. Natural disasters are contained to a region. Imagine a completely undefended attack that bricks all Windows, Linux and Mac OS computers computers worldwide at the same time. It could be all routers. All chips made in say China.

So many people would starve because food couldn't be delivered in the efficiency it takes to feed the population. You've seen grocery stores wiped out during hurricanes, and those have several days lead time to prepare. We are much more dependent on technology than a lot of people realize.

akhilcacharya• 9 years ago

like some kind of "cyberterrorism".

Or even worse, a state actor with nuclear weapons to back it up.

partiallypro• 9 years ago

A fear of mine, that I think wouldn't be too hard (relatively speaking) would be to interrupt bid/ask sizes in markets, since it's largely machines trading now with no humans able to step in like a floor specialist. Effecting the bid/ask sizes could cause a massive over supply of equities and cause it to crater, which could induce more machine selling simply because that's how their algorithms are written. The market could crash 10% before anyone knew what was happening. There are breakers that are built to prevent this but high leverage in ETF securities, etc could exacerbate the event. In effect, causing an '87-like crash from a hack. The '87 crash was also largely machine driven.

phlo• 9 years ago

What you're describing happened to Ethereum this week [1]. On one exchange (GDAX), a large sell order pushed the price down by 30% or so, which in turn triggered a lot of (market) stop loss orders, pushing the price farther down. In the end, a couple of thousand ETH traded hands for $0.10 while the price at other exchanges was around $300.

I share your fear. At the same time, it's also important to remember that most other instruments trade at way deeper order books, with orders of magnitude greater liquidity and massively better controls (e.g. circuit breakers).

[1] https://news.ycombinator.com/item?id=14611333

dsfyu404ed• 9 years ago

As a security guy my long bet is transportation infrastructure. Industrial systems (like cars) typically have some very rudimentary security with no depth.

Someone will get root somewhere and shut down some small percent of light vehicles (i.e. not medium and heavy trucks) on the road at an inconvenient time causing a massive economic panic and screwing up the used car market in a way that makes cash for clunkers seem well thought out.

Even a complicated attack vector that results in a narrow target selection (e.g. android malware -> infotainment system on a particular few model years of one brand) would have a massive psychological impact.

Edit: a similar occurrence could happen by accident (edge cases, poor testing and so on).

Edit: meant to reply to a comment. Oh well.

andygates• 9 years ago

What then? Well, users wouldn't have wasted their time trying to recover unrecoverable systems. They'd just have rebuilt them.

Really properly permanently bricking is much harder, and hardware-specific.

harshaw• 9 years ago

So, in summary. The NSA hordes zero day (not sure if just windows), builds some scary tools to exploit these, and of course doesn't let MS know about them, because zero days are incredibly valuable to the spooks. And because perfect security is impossible these tools get out. Perhaps this was obvious from the WannaCry episode, but this article really hammered it home for me.

Why people run any systems on windows is beyond me (not that others are more secure, but windows is a bigger target)

dota_fanatic• 9 years ago

Why people run any systems on windows is beyond me

games

astebbin• 9 years ago

Same here. I have a Windows PC which I use only for games and media processing. Steam for Mac isn't bad, but the vast preponderance of popular new (and old) games remain Windows exclusives.

ElijahLynn2• 9 years ago

Not the case in enterprise ;)

pixl973• 9 years ago

Routers sound like the bigger target to me. Take over the NAT/Firewall and you can use it to exploit every machine behind it.

flukus4• 9 years ago

Which is why everyone should still be running a firewall on their machines and stop relying completely on the router. It seems way to many people (and companies) rely on a single point of defense. This is especially true of any machines that may be connecting to public networks and home networks where you might let you're friends use wifi.

jgrahamc• 9 years ago

Why people run any systems on windows is beyond me

I'm guessing you've never been near a large company that has a large investment in Windows and applications that run on Windows.

hobs• 9 years ago

This isnt a really good reason to not run windows, they have similar 0days for any nix system as well.

rsync2• 9 years ago

Do they ?

I have watched very closely for 20 years now for any chatter or evidence of a FreeBSD/OpenBSD zero-day vuln that was weaponized or sold or used for state-sponsored covert action and I am not aware of any.

None of the leaked information from Snowden, et. al, gave any evidence of their existence either.

Technically speaking they should exist but I'm not seeing them ...

josu• 9 years ago

Why people run any systems on windows is beyond me

Windows gets hacked because it is the most used desktop OS. If everybody started using Linux, it would get hacked as often as Windows. Quoting your comment again:

because perfect security is impossible

pharrington• 9 years ago

When I worked at a web hosting company, it certainly felt like Linux got hacked as much as Windows.

runeks• 9 years ago

The solution is not that everyone on Windows switch to Linux, just that some of them do. You said it right there: Linux is more secure, right now, not because it has fewer holes in it but because the incentive to find those holes is much less than with Windows. Seems like a good enough reason to switch for me, just don't expect it to last forever.

msisk6• 9 years ago

Like it or not, pretty much all enterprises run on Windows software. Not just desktop, either. Active directory and Exchange are pretty much the standard for all enterprises.

And non-techies in these places couldn't live without Office. I once got an email with an attached Word document that contained an embedded Excel spreadsheet with exactly two cells -- an IP address and a hostname -- for a DNS entry I needed to update.

Something1234• 9 years ago

That seems impressively competent for your average office user being able to embed a spreadsheet. What was wrong with them?

JdeBP• 9 years ago

As the Four Yorkshiremen would say: Luxury!

At least you could copy and paste. In some work environments, you would have been sent a JPG screenshot of the IP address and name.

Now enjoy the discussion of images in mail messages in https://news.ycombinator.com/item?id=14567074 (-:

soundwave106• 9 years ago

Honestly, when it comes to cyberattacks, I think the truly worst area right now is "Internet of Things" devices and similar Internet connected devices like point of sales. At least Windows (and other computer OSes) have slowly become more secure over the last 20+ years. As far as I know, all the major OS players are very good at patching discovered exploits quickly. Malware spread by social engineering (eg tricking someone to execute malicious code) is the most common way things are spread these days.

Many IoT companies, in contrast, have root-level exploits that are laughably trivial to hack, and some don't seem to care that much at all when exploits are discovered (https://www.trustwave.com/Resources/SpiderLabs-Blog/Undocume...). Windows is imperfect I'm sure, but I'd rather connect a Windows machine to the public network than any so-called "smart" appliance at this point.

pavement3• 9 years ago

There's something about Windows exploits that just feels like a canned hunt by now.

With stuxnet, there developed the sense that Windows received conspicuous attention from a special class of mysterious operators.

At this point, given the tiny cottage industry that feeds a handful of starving security analysts, I feel it's reasonable to presume that Windows is built to be a secure as possible, and that what's possible is mostly intentional and understood as a known quantity for special populations.

topranks• 9 years ago

There will always be flaws in software systems, it's inevitable.

You're basically saying Microsoft have perfected security to the point the can't overlook something or make a mistake with something????

pavement3• 9 years ago

I am not saying the thing you added four question marks onto.

jdc05892• 9 years ago

given the tiny cottage industry that feeds a handful of starving security analysts

you may not have enough information.

pavement3• 9 years ago

I'd almost rather not know.

willstrafach• 9 years ago

This is certainly a serious issue, but a few aspects of this article are very strange.

Worse, the assault, which has never been reported before, was not spotted by some of the nation’s leading cybersecurity products, the top security engineers at its biggest tech companies, government intelligence analysts or the F.B.I., which remains consumed with the WannaCry attack.
“The world is burning about WannaCry, but this is a nuclear bomb compared to WannaCry,” Mr. Ben-Oni said. “This is different. It’s a lot worse. It steals credentials. You can’t catch it, and it’s happening right under our noses.”

This attack and WannaCry use the same exploitation vector (EternalBlue). It seems that his company was targeted with a custom payload, which is definitely unfortunate, but that is not related to the exploit itself, it is just another form of custom code being used to perform further actions (Instead of simply encrypting files as WannaCry was doing). This is probably even easier for an attacker since there is now even a Metasploit module for MS17-010.

The attack on IDT went a step further with another stolen N.S.A. cyberweapon, called DoublePulsar. The N.S.A. used DoublePulsar to penetrate computer systems without tripping security alarms. It allowed N.S.A. spies to inject their tools into the nerve center of a target’s computer system, called the kernel, which manages communications between a computer’s hardware and its software.

This is not a "step further" though. DoublePulsar is the implant injected EternalBlue and was certainly used in WannaCry. I am not sure why they had not even taken the time to try to verify this, even the WannaCry Wikipedia page states this (https://en.wikipedia.org/wiki/WannaCry_ransomware_attack). Again, this is the same exploitation vector and same implant, but with a modified payload to specifically target IDT it seems.

For his part, Mr. Ben-Oni said he had rolled out Microsoft’s patches as soon as they became available, but attackers still managed to get in through the IDT contractor’s home modem.

This tells me: 1. Even though machines internally were patched, a contractor was allowed to connect to the network with an unpatched machine. 2. If machines were internally patched, how would an infected contractor be able to do damage? I am not clear on this. They might be saying the network itself was not attacked, but rather the attacker was able to login with the legitimate employee's credentials and cause damage that way (In which case, something is very wrong internally if this was possible).

I know it is not nice to victim-shame regarding security issues, and I am trying not to do so, but it seems like the story here is phrased in a slightly disingenuous manner. It is essentially this: An IDT contractor with an unpatched machine and privileged network access was targeted using EternalBlue to steal their credentials with a custom payload. It worked. After this, it is unclear if the stated network intrusion occurred because EternalBlue spread (Would not make sense if patched) or the contractor credentials were used "legitimately" (Indicates poor access control and monitoring).

RachelF• 9 years ago

After nuclear weapons were first invented, the big powers spent a lot of effort in non-proliferation, to stop smaller countries building them.

Cyber weapons are not as dangerous as nukes, but much easier to copy, and much harder to know who attacked you.

The NSA/CIA has been very lax in allowing their weapons to be copied.

ocschwar2• 9 years ago

Cyber weapons mean that during a crisis, nuclear militaries have to consider whether their chain of command has been compromised.

WHich means they are, in fact, as dangerous as nukes.

flukus4• 9 years ago

Only if cyber weapons are built to target the military. I'd wager they're built to wage economic warfare rather than any military role, the corporate/commercial world is a much softer target. Imagine doing the economic/industrial damage of carpet bombing cities but without firing a shot.

nickpsecurity5• 9 years ago

Launching a pile of nukes can kill tens to hundreds of millions of people. People have been launching cyberweapons since they were invented with death toll low enough that folks still reference THERAC in software deaths. Don't play: the two are barely comparable in how many they kill.

rl3• 9 years ago

Cyber weapons mean that during a crisis, nuclear militaries have to consider whether their chain of command has been compromised.

Good luck compromising nuclear arms C&C. There's a reason a lot of it runs on systems from the 70s.

WalterBright8• 9 years ago

The attack surface could be greatly reduced by putting a lot of code in ROMs (Read Only Memory) where it won't survive a reboot.

themodelplumber• 9 years ago

That's an interesting idea. Has this been tried before, for this kind of network security purpose?

WalterBright8• 9 years ago

Not that I know of. I suggest it every time the subject comes up of hardening internet connected devices. Nobody has ever replied with an instance of it.

Back in the 80's, most devices used ROMs, PROMs or EPROMS. ROMs were burned at the factory. PROMs could be user programmed once. EPROMs were erasable and reprogrammable, if you put the chip under a UV lamp. As far I can tell, this is a forgotten technology.

Later on came EEPROMS, electrically erasable programmable read only memory. Then someone had the bright (!) idea of connecting the write-enable line to the internet so anybody in the world could update anybody else's firmware, and welcome to the hell we have today.

chmike• 9 years ago

Early PC had all their OS in Rom. Apples (Mac, etc) for instance. It was abandoned because it was difficult to patch the OS. The patch were needed to fix unpleasants "features" of the program. The back side is that it also allows to install backdoors or snooping extensions.

A better approach would be to create simpler systems that are easier to verify and monitor, and harder to corrupt. Another approach is to use micro kernel architecture and a container oriented system.

Finally, the backdoor strategy of the NSA is now proven to be harmful. With all their tools, they should know who is behind it.

thomasahle• 9 years ago

Putting it in ROM also makes it unpatchable, meaning it will immediately be infected again when it boots up.

WalterBright8• 9 years ago

Not necessarily. A physical write-enable switch can work, too. (Not a software switch!)

WalterBright8• 9 years ago

Current setup: I click on bad link, malware installed on my computer that infects my disk firmware. I remove the malware from my computer. My disk remains compromised.

Suggested setup: I click on bad link, malware installed on my computer that infects my disk firmware. I remove the malware from my computer. My disk is no longer compromised.

Also, I plug a USB stick into my computer. It gets compromised. I unplug it. It gets uncompromised. No more USB spread malware.

WalterBright8• 9 years ago

The exponential growth of the infection will be either blunted or stopped if a significant percentage of the infected machines keep getting uninfected. It's "herd immunity".

zby• 9 years ago

QubesOS boots vms from templates, only /home changes survive.

zyxzevn• 9 years ago

So we are investing dollars in NSA so they make tools that bring us damage? I think there should be a limit on how long they can keep their "secrets". Snowden already showed that information can go outside, so any information will be leaked at some time. The society has much more to win when the software defects are repaired instead of used for hacking.

I think that all these NSA problems show bad management. They should be reorganized, or maybe even abandoned. They cost more than they deliver, and even costed us our privacy. Probably they are still breaking US and international laws on that. Breaking up NSA can allow the FBI and (open) security companies to take over the cybersecurity.

I suspect that we will soon have leaks of CIA tools too. But thanks to wikileaks companies can prepare for these future problems.

We can go deeper into who got these tools and who is using them. Some may even argue that the CIA leaked the NSA tools to weaken the NSA. Or worse, that some in the NSA want to create cyber chaos to push for more control over the internet in the future.

The article mentions the popular political scapegoats, and as usual this is just speculation. To solve NSA's problem we have to request very concrete evidence, otherwise we are just being played with.

Article: > The Shadow Brokers resurfaced last month, promising a fresh load of N.S.A. attack tools, even offering to supply them for monthly paying subscribers — like a wine-of-the-month club for cyberweapon enthusiasts.

This shows how we are being played with. The NSA could already have published the security details of all leaked tools, so we could all have protected our computer systems. We could have prevented Wannacry.

SomeStupidPoint3• 9 years ago

The NSA did contact the appropriate vendor in time to patch WannaCry.

People didn't (or couldn't) update their systems with the appropriate patch.

wybiral2• 9 years ago

Some may even argue that the CIA leaked the NSA tools to weaken the NSA. Or worse, that some in the NSA want to create cyber chaos to push for more control over the internet in the future.

Some may argue a lot of things that may or may not be true.

This will probably always be an issue so long as there are classified operations... Everyone who isn't privy will have their own interpretation of what really happened.

jlgaddis2• 9 years ago

I suspect that we will soon have leaks of CIA tools too.

All of the stuff recently leaked by Wikileaks (including today) was from CIA.

imron• 9 years ago

But they purposefully didn't release the tools or the source code for the tools, despite receiving them.

adekok• 9 years ago

I think that all these NSA problems show bad management. They should be reorganized, or maybe even abandoned. They cost more than they deliver, and even costed us our privacy.

I.e. the average citizen.

Q: Is the NSA there to support the average citizen, or are they there to support the bureaucracy / power structures?

Q: depending on the previous answer, does your security or privacy matter to the NSA?

Probably they are still breaking US and international laws on that.

Do the people who enforce the law get punished when they break it? On the whole, I don't think that's a clear "Yes". More of a "maybe, sometimes".

pbhjpbhj3• 9 years ago

Do the people who enforce the law get punished when they break it?

In a democracy they do ...

ebcode• 9 years ago

I'll see your "maybe, sometimes", and raise you a "rarely, if ever".

nyolfen• 9 years ago

This shows how we are being played with. The NSA could already have published the security details of all leaked tools, so we could all have protected our computer systems. We could have prevented Wannacry.

NSA did exactly what you said and went to MS months before wcry hit, once it was clear what shadowbrokers had, in order to patch the vulnerability that wcry exploited: https://technet.microsoft.com/en-us/library/security/ms17-01...

unfortunately, not everyone keeps their systems totally up to date for various reasons.

athenot• 9 years ago

unfortunately, not everyone keeps their systems totally up to date for various reasons

Because patching requires a quick risk calculation. Should I patch to the bleeding edge and get the latests security but risk a regression bug, or do I wait a bit so I can run a full regression test?

On my machines, sure I like to stay on the latest and greatest. But I'm sure there are plenty of companies that got bitten because some critical software they rely on didn't play well with the latest OS upgrade. Blame game notwithstanding, it comes down to a business disruption risk.

Of course, the right answer is to test the patches as they come out in a non-production environment, and go from there based on results. But I can see where some companies wouldn't have the resources devoted to do that on a frequent basis, which is unfortunate.

macrael3• 9 years ago

I believe it was compounded in this case by the fact that Microsoft did not release the patch to all users. That OS was no longer supported so they only made the patch available to customers who pay for long term support.

mtgx• 9 years ago

What about Stuxnet? Did they go to companies and told them to patch against that once it was out? We don't even know how many more times these things have happened in the underground and used by criminals. We have just one example of NSA doing this, and even that wasn't sufficient because the "horse was already out of the barn."

nobodyorother• 9 years ago

I've just been waiting for someone to send them a bill.

How much money have their tools cost folks in time, money, hardware, and personnel, even in just the last year? How much money have their unpatched exploits cost?

How's that all compare to their (mostly undocumented) annual budget, anyway?

cube00• 9 years ago

“I don’t pursue every attacker, just the ones that piss me off,”

Why paint a target on your back saying things like this?

jacobolus• 9 years ago

By Mr. Ben-Oni’s estimate, IDT experiences hundreds of attacks a day on its businesses, but perhaps only four each year that give him pause.

There’s not enough time to pursue hundreds of new attackers every day, most of whom are not competent enough to be a serious threat. Presumably a big part of Ben-Oni’s job is to figure out which attackers can safely be ignored and which ones he needs to worry about tracking down.

6stringmerc• 9 years ago

What's the real math, a full-scope attack might do what, cripple 30% of the Modernized World at any given time? Maybe for a week? Shit, y'all need to catch up on nature a little bit. Sometimes a forest fire burning things to the ground inspires new, stronger life and recovery. Also, if you think I'm being a dick, I'm paraphrasing Tim Berners Lee about his views on the modern Internet.

tomek_zemla• 9 years ago

That would be nice, but the sad reality is that most likely a lot of people would die during this 'catching up on nature' time...

glial• 9 years ago

Messing up the global food supply chain would be no joke.

microcolonel• 9 years ago

In the pecking order of a computer system, the kernel is at the very top, allowing anyone with secret access to it to take full control of a machine. It is also a dangerous blind spot for most security software, allowing attackers to do what they want and go unnoticed.

Why do journalists even try to explain things like this? Do they ever get it right? Does it ever not just go over people's heads?

bradknowles• 9 years ago

Got a non-paywall link?

dredmorbius4• 9 years ago

Outline.com or archive.is

exabrial• 9 years ago

Aka 'Live free or Die Hard'. Saw it. Bruce Willis runs out of bullets and shoots a helicopter down with a car

ozzmotik• 9 years ago

why can't i just up vote this a million times

droopybuns• 9 years ago

Most companies hiring and empowering decent security people would have avoided this bullshit, due to all the twitter signaling.

Noobs: follow @hackerfantastic

rjblackman• 9 years ago

I am quite surprised no one has used an exploit for rompager yet and used to it take down most of the internet.

rqmedes• 9 years ago

Critical infrastructure, Economic stability, nation states preparing/probing for war/advantage?

BatFastard3• 9 years ago

Give the NSA a break, they handle more secrets than I can imagine. And at least they managed to hold onto the Russian Golden Shower video!

Suggesting that the USA get rid of the NSA is like saying "Crap, terrorists got a hold of a nuclear weapon, lets unilaterally get rid of all of our weapons and hope for the best!"

Sniffnoy• 9 years ago

But rather than "NSA" or "no NSA", there's another alternative: Defense-only NSA (or at least, defense-heavy NSA, where the vulnerabilities equities process has been altered to heavily favor disclosure). Instead of unilateral disarmament, disarming ourselves while also forcibly disarming others.

BatFastard3• 9 years ago

While I like that idea from it being the "right" thing to do. I can see why they don't want to give up every exploit as soon as it is found.

tracker12• 9 years ago

More like, "Crap, the terrorists just got a working copy of our nuclear arsenal!" Digitally speaking being a much closer comparison. The fact is, had the NSA been responsibly disclosing these details (maybe a 15-30 day hold before a private disclosure then after another 30 days public discloser)

That gives them 30 days to use 0-day exploits, but can still be effective contributors to greater overall security.

BatFastard3• 9 years ago

Good points. But its a fine line on how to deal with leaks 0 day exploits. We can't cripple the NSA, other wise we are bring a wet noodle to a knife fight.

natch• 9 years ago

Now that they lost control of their napalm bombs which are now burning innocent targets, where is the NSA?

A little bit of taking responsibility please? They could at least lead the charge to get this stuff dealt with now.

King-Aaron2• 9 years ago

So does everyone here just subscribe to the NYTimes, or am I missing something when it comes to all these paywalled articles (other than, you know, missing the article itself?)

thirdsun• 9 years ago

If you don't see the article it means that you probably already read 10 other NYTimes articles this month at which point they require a subscription.

King-Aaron2• 9 years ago

Yeah I do realise that - however so many NYT links appear in ycomb every day, it doesn't take much to hit that limit, especially since I launch articles through that 'Panda' chrome extension, so you don't really get much chance to screen the links other than the small link preview in the bottom left.

I was wondering if people go through an alternative site/app to serve the articles - bypassing the paywall - or if everyones just in the same boat as me? Some other forums I'm with tend to make note of a paywalled link.

matt_wulfeck• 9 years ago

Finally, before they left, they encrypted her computer with ransomware, demanding $130 to unlock it, to cover up the more invasive attack on her computer.

Anyone having hard time swallowing this? They broke in and were totally undetected when they planted a... rootkit (unclear from article). While undetected they silently stole user credentials... Then to cover it all up, they ransomware'd the computer?

It's like breaking into a house and putting a bug in the wall, and then to cover the tracks you smash in the front door and leave the water running in the sink.

If the attacker was completely undetected, why intentionally jeopardize that?

tallanvor• 9 years ago

Why is it hard to swallow? Really it's a classic magician's trick - misdirection.

Think of it this way: if you are responsible for security, you never assume that you're fully protected. If you're a smart hacker, it should be the same thing: you never assume that you won't be detected.

Quarrelsome• 9 years ago

No it makes perfect sense. If you want to land an advanced persistent threat but your entry is detectable a distraction is ALWAYS a great psychological tool. The very best and long lasting victories are made when you convince the loser that they've won.

So the premise is that they clear the ransomware and think its over. But its not.

stedaniels• 9 years ago

And the standard way to clear the ransomware is to re-image the machine and restore from backups. So the infection has to be hidden above the operating system level. BIOS/SSD/HDD firmware etc.

Unless of course you don't provision machines, or keep backups. In which case hiding on a machine being "cleaned" would be simples.

davotoula• 9 years ago

"The very best and long lasting victories are made when you convince the loser that they've won"

saved!

logingone• 9 years ago

"The very best and long lasting victories are made when you convince the loser that they've won." -- that's catchy, but I don't agree. Often the result will be "damn that was close, better enhance the defences". Whereas the ignorant just carry on.

ca98am79• 9 years ago

yeah except that they were found out because of this "distraction," so it seems to have been a mistake

richardknop• 9 years ago

It's a classic distraction tactic. You create some big visible threat/situation to focus their attention on. While your real threat is happening unnoticed as they are too busy dealing with the distraction.

vlan02• 9 years ago

It's really just used as a distraction. But I like you Home Alone reference. However, the Wet Bandits weren't very good at their job.

rev_null• 9 years ago

The wet bandits had a great scam. They just didn't account for an improbably skilled child to be alone in a house that should be empty.

ChristianBundy• 9 years ago

It's like breaking into a house and putting a bug in the wall, and then to cover the tracks you smash in the front door and leave the water running in the sink.

I think it's more akin to breaking into a house, putting a bug in the wall, and then stealing some cash in case the homeowner had a silent alarm or nosy neighbors or some other way you could be caught.

SomeStupidPoint3• 9 years ago

It's really like breaking in to steal their passport and spare keys out of the safe, but deciding you're going to make off with some cash, a few TVs, and smash up the place so it's harder to figure out what you stole and find good forensics.

If your shoe prints only led to the safe and back out, it would be obvious what you stole; if they're all over the house and the whole place is a wreck, then it's harder to tell what you were (actually) there for.

chuckdries• 9 years ago

It's like breaking in to plant a bug in the wall, but you had to break a window to get in. They'd notice the broken window, so you steal the TV so they won't be suspicious of a break without an apparent motive.

_ao789• 9 years ago

tldr; someone got hold of NSA a pen-tool and is slowly getting it setup for a big global attack of sorts. And a whole long life story of some other dude..

qb454• 9 years ago

he would not stop until the attacks had been shut down and those responsible were behind bars.

That's cute. I wonder if he means Microsoft, people who use Microsoft products in safety-critical systems or maybe some nuke-capable nation state hiding behind tor, VPN, custom IoT botnet, another layer of tor and another VPN?

deno• 9 years ago

I suspect this “cyberweapon” nomenclature will have serious consequences, if it becomes popular. This is like the reverse of the usual PC language softening, e.g. to murder is to “neutralize,” etc.

Why is NYT using this term? It’s been invented by NSA to redirect defense funding towards their mass surveillance activity. Shouldn’t journalists point out things like that?

mi100hael2• 9 years ago

NYT? Journalists? hah!

mi100hael2• 9 years ago

Metasploit, an automated hacking tool, now allows anyone to carry out these NSA attacks with the click of a button.

What a time to be alive

Kostic• 9 years ago

Actually, that's good. Now that anyone can with ease exploit unmaintained systems, people will need to start caring about security.

conn01• 9 years ago

The root cause is that the more convenience the more danger.

cyberattack can be easily overcome using the steps below:

1) DON'T connect your computer to the internet physically

2) if you want to use the internet, use another pc which has no credential data

3) for bank/shop online,etc. we should use a dedicate device which couldn't be reprogrammed.

To sacrifice a little convenience for the safe. That is it.

jdc05892• 9 years ago

what purpose would an airgap'd computer even serve for 99% of people?

philanthropist• 9 years ago

So from the article, it sounds like DoublePulsar is already patched, but due to computers lacking the patch, it still got in. Have I got that right? Also, what is the attack vector here? Because if, like wannacry, it was an email, then surely the defence is the same as before, be careful what you download?

Swannie• 9 years ago

His attack came on the 29th April - yet there were Snort signatures on the 21st April (42329, 42332, 42340) for DoublePulsar, and before that 14 March (41978) for one of the vulnerabilities.

Despite his much lauded protection, I find it odd to believe that he's not running Snort, and the lack of actual specifics make me believe this is really a piece for the mentioned Israeli security company with a "blackbox" IDS.

A Cyberattack 'the World Isn’t Ready For'

Related Stories