3 ms·

The NSA knew they were burned and these exploits would be used against American interests shortly. I imagine they sent them to MS. Note these particular fixes h

The NSA knew they were burned and these exploits would be used against American interests shortly. I imagine they sent them to MS. Note these particular fixes have no source, which while not uncommon, is very telling considering its multiple items with no credit. They're also very nasty for sysadmins. smb exploits giving SYSTEM level access on servers and domain hacks are pretty much worse case scenarios. I pity any shop who hasn't updated yet. The attacks are weaponized and are in the wild right now packed into trojans, ransomware, crimepacks, etc.

arca_vorago 10y ago
I'm glad I am not doing sysadmin for anyone but myself these days, the tools and knowledge needed to handle this level of mass intrusion available to common sysadmins is abysmal. By the way, has anyone heard anything in the leaks about HIDS exploits? Right now I am leaning towards the position that if "everything is comprimised", the key to security in the future is primarily in log notifications and other auditing measures. I saw some stuff about deleting windows event logs, but if for example the server was running a hids that syslogged to a central log server, or even an encrypted decentralized log server, they would have to comprimise the entire system to prevent the log from existing. Security is about layers.
hashhar 10y ago
No sysadmin should be using SMBv1 in the first place though. I agree completely with your first paragraph though and it seems like a likely situation.
- pixl97 10y ago
  >No sysadmin should be using SMBv1 in the first place though. Oh, I guess you need to talk to apple about this. https://dpron.com/os-x-10-11-5-slow-smb/ https://dpron.com/os-x-10-11-5-slow-smb/ I got bit by this last week. Got a new NAS. Windows clients work fine, OSX is slow and error prone. Solution? Disable SMB2/3. Apple needs to get hammered for this.
- drzaiusapelord 10y ago
  Sysadmins don't make business decisions. Management says 'support this legacy crap' and smb1 stays.
  - hashhar 10y ago
    It's a chicken and egg problem too. As the comment above referring to Apple having issues with SMBv2 and v3, they can't do anything but use SMBv1. It's sad really.

arca_vorago 10y ago

I'm glad I am not doing sysadmin for anyone but myself these days, the tools and knowledge needed to handle this level of mass intrusion available to common sysadmins is abysmal. By the way, has anyone heard anything in the leaks about HIDS exploits? Right now I am leaning towards the position that if "everything is comprimised", the key to security in the future is primarily in log notifications and other auditing measures. I saw some stuff about deleting windows event logs, but if for example the server was running a hids that syslogged to a central log server, or even an encrypted decentralized log server, they would have to comprimise the entire system to prevent the log from existing. Security is about layers.

hashhar 10y ago

No sysadmin should be using SMBv1 in the first place though. I agree completely with your first paragraph though and it seems like a likely situation.

pixl97 10y ago
>No sysadmin should be using SMBv1 in the first place though. Oh, I guess you need to talk to apple about this. https://dpron.com/os-x-10-11-5-slow-smb/ https://dpron.com/os-x-10-11-5-slow-smb/ I got bit by this last week. Got a new NAS. Windows clients work fine, OSX is slow and error prone. Solution? Disable SMB2/3. Apple needs to get hammered for this.
drzaiusapelord 10y ago
Sysadmins don't make business decisions. Management says 'support this legacy crap' and smb1 stays.
- hashhar 10y ago
  It's a chicken and egg problem too. As the comment above referring to Apple having issues with SMBv2 and v3, they can't do anything but use SMBv1. It's sad really.