3 ms·

Windows 0-days, SWIFT bank hacks among latest Shadow Brokers release

87 points by bootload 9y ago

bootload 9y ago
"It is very significant as it effectively puts cyber weapons in the hands of anyone who downloads it. A number of these attacks appear to be 0-day exploits which have no patch and work completely from a remote network perspective." MS Windows on a network was never really secure. These hacked will makes old Windows based machines toxic. Pretty sure not all, if any of the historic releases will be patched. Read this post, "Microsoft: most ShadowBrokers exploits are already patched" ~ https://news.ycombinator.com/item?id=14119656 https://news.ycombinator.com/item?id=14119656 "Researchers from security firm Kaspersky Lab, meanwhile, have confirmed the leaked code they analysed bears unique signatures tied to Equation Group" Here is a Kaspersky Q&A (pdf) on the Equation Group ~ https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf https://securelist.com/files/2015/02/Equation_group_question...
userbinator 9y ago
From the article: With the exception of Esteemaudit, the exploits should be blocked by most firewalls. And best practices call for remote desktop connections to require use of a virtual private network, a practice that should make the Estememaudit exploit ineffective In other words, if you're behind a firewall/NAT with the relevant ports inaccessible from the Internet, you won't be affected even if you're not running a patched version of Windows. From the exploit list provided and their description, it seems like using Win10 and Win Server 2016 is enough to protect yourself against these attacks. ...except that the telemetry and autoupdate capabilities of those OSs means the NSA doesn't even have to exploit anything; they can just ask MS to hand over the data. The saying about "known unknowns" and "unknown unknowns" comes to mind...
- speeder 9y ago
  According to 8chan one smb2 exploit actually affects Win10, despite being tagged as intended for much older Windows.
  - Paul_S 9y ago
    8chan providing security expertise and 4chan electing presidents and directing bombardments in Syria. What a time to be alive.
- eli 9y ago
  The NSA can't just request information about Americans
  - DennisP 9y ago
    So is that a new change since the massive data collection about Americans that Snowden initially revealed? I don't recall any reforms being all that significant.
    - willstrafach 9y ago
      You might have that mixed up, as most of those leaks pertained to foreign intelligence gathering. The aspect involving Americans was the telephone metadata program, and a bill did indeed get passed as a result to fix that.
      - DennisP 9y ago
        "Most" is correct, but some of the other reported programs sweep up large numbers of Americans. Examples: "The National Security Agency is harvesting hundreds of millions of contact lists from personal e-mail and instant messaging accounts around the world, many of them belonging to Americans" https://www.washingtonpost.com/world/national-security/nsa-collects-millions-of-e-mail-address-books-globally/2013/10/14/8e58b5be-34f9-11e3-80c6-7e6dd8d22d8f_story.html https://www.washingtonpost.com/world/national-security/nsa-c... "NSA was using its metadata troves to build profiles of US citizens' social connections, associations and in some cases location" https://www.theguardian.com/world/2013/sep/30/nsa-americans-metadata-year-documents https://www.theguardian.com/world/2013/sep/30/nsa-americans-... "The N.S.A. is not just intercepting the communications of Americans who are in direct contact with foreigners targeted overseas, a practice that government officials have openly acknowledged. It is also casting a far wider net for people who cite information linked to those foreigners" http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data-abroad-is-seen-by-nsa.html?hp http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data...
- DennisP 9y ago
  The firewall will protect you if it isn't compromised. From the article: "Some of the previous weapons-grade leaks, for instance, exploited unpatched vulnerabilities in Cisco Systems firewalls."
deleted 9y ago
[deleted]
merricksb 9y ago
Other discussions: https://news.ycombinator.com/item?id=14114665 https://news.ycombinator.com/item?id=14114665 https://news.ycombinator.com/item?id=14119656 https://news.ycombinator.com/item?id=14119656 https://news.ycombinator.com/item?id=14116791 https://news.ycombinator.com/item?id=14116791

87 points by bootload 9y ago

"It is very significant as it effectively puts cyber weapons in the hands of anyone who downloads it. A number of these attacks appear to be 0-day exploits which have no patch and work completely from a remote network perspective." MS Windows on a network was never really secure. These hacked will makes old Windows based machines toxic. Pretty sure not all, if any of the historic releases will be patched. Read this post, "Microsoft: most ShadowBrokers exploits are already patched" ~ https://news.ycombinator.com/item?id=14119656 https://news.ycombinator.com/item?id=14119656 "Researchers from security firm Kaspersky Lab, meanwhile, have confirmed the leaked code they analysed bears unique signatures tied to Equation Group" Here is a Kaspersky Q&A (pdf) on the Equation Group ~ https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf https://securelist.com/files/2015/02/Equation_group_question...

userbinator 9y ago

From the article: With the exception of Esteemaudit, the exploits should be blocked by most firewalls. And best practices call for remote desktop connections to require use of a virtual private network, a practice that should make the Estememaudit exploit ineffective In other words, if you're behind a firewall/NAT with the relevant ports inaccessible from the Internet, you won't be affected even if you're not running a patched version of Windows. From the exploit list provided and their description, it seems like using Win10 and Win Server 2016 is enough to protect yourself against these attacks. ...except that the telemetry and autoupdate capabilities of those OSs means the NSA doesn't even have to exploit anything; they can just ask MS to hand over the data. The saying about "known unknowns" and "unknown unknowns" comes to mind...

speeder 9y ago
According to 8chan one smb2 exploit actually affects Win10, despite being tagged as intended for much older Windows.
- Paul_S 9y ago
  8chan providing security expertise and 4chan electing presidents and directing bombardments in Syria. What a time to be alive.
eli 9y ago
The NSA can't just request information about Americans
- DennisP 9y ago
  So is that a new change since the massive data collection about Americans that Snowden initially revealed? I don't recall any reforms being all that significant.
  - willstrafach 9y ago
    You might have that mixed up, as most of those leaks pertained to foreign intelligence gathering. The aspect involving Americans was the telephone metadata program, and a bill did indeed get passed as a result to fix that.
    - DennisP 9y ago
      "Most" is correct, but some of the other reported programs sweep up large numbers of Americans. Examples: "The National Security Agency is harvesting hundreds of millions of contact lists from personal e-mail and instant messaging accounts around the world, many of them belonging to Americans" https://www.washingtonpost.com/world/national-security/nsa-collects-millions-of-e-mail-address-books-globally/2013/10/14/8e58b5be-34f9-11e3-80c6-7e6dd8d22d8f_story.html https://www.washingtonpost.com/world/national-security/nsa-c... "NSA was using its metadata troves to build profiles of US citizens' social connections, associations and in some cases location" https://www.theguardian.com/world/2013/sep/30/nsa-americans-metadata-year-documents https://www.theguardian.com/world/2013/sep/30/nsa-americans-... "The N.S.A. is not just intercepting the communications of Americans who are in direct contact with foreigners targeted overseas, a practice that government officials have openly acknowledged. It is also casting a far wider net for people who cite information linked to those foreigners" http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data-abroad-is-seen-by-nsa.html?hp http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data...
DennisP 9y ago
The firewall will protect you if it isn't compromised. From the article: "Some of the previous weapons-grade leaks, for instance, exploited unpatched vulnerabilities in Cisco Systems firewalls."

deleted 9y ago

[deleted]

merricksb 9y ago

Other discussions: https://news.ycombinator.com/item?id=14114665 https://news.ycombinator.com/item?id=14114665 https://news.ycombinator.com/item?id=14119656 https://news.ycombinator.com/item?id=14119656 https://news.ycombinator.com/item?id=14116791 https://news.ycombinator.com/item?id=14116791