36 ms·

Thousands of computers now compromised with leaked NSA tools, researchers say

374 points by remx 9y ago

LoSboccacc 9y ago
shower thought: have them been infected now, or now are known to be infected?
- iraklism 9y ago
  I was about to comment something similar , but then I saw your post. Btw I don't know why people are down voting it. This is an important point. This research comes after 10 days of the leak. I have been following the leak closely, I've even compiled a list with all the analysis and resources on a gist. Good guys, bad guys, kids, bored Blackhats, had enough time to practically follow the step by step instructions in order to implant the backdoor. It doesn't take more than 30-40 mins for the first read till a successful exploit. The short answer is that we have no idea of knowing how many of those were backdoored by the NSA. Also worth noting is that the leak happened 3-4 months ago. A lot of people had access to this privately.
  - TACIXAT 9y ago
    I was thinking this created great plausible deniability for the NSA.
arca_vorago 9y ago
Which is exactly what we crazy cookoo conspiracy theorists have been warning about. It's the same slipperly slope we already went through in the 90's crypto wars, but SV gets amnesia when it gets lots of stupid company valuations and forgets all those lessons apparently. Bottom line is this. If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massively weakened infrastructure, corporate, and government security... basically all the things important to national security in general. So while I don't disagree that triple letters need some cool tools to get shit done, I think this function needs some technocratic oversight specifically for this issue. It's time for a new Church committee.
- sillysaurus3 9y ago
  The antidote seems to be for the NSA to maintain a security report for each discovered zero day. If it ever leaks, they can send the target company the report, which explains both what the exploit is and how to fix it. That seems fair enough. The NSA needs to exploit flaws, but they can be a bit less evil about it by being ready to fix them if necessary. That doesn't solve the fact that NSA's competitors could find and exploit the same flaws, or that sometimes it's hard to tell whether any leaks have happened, but it's an improvement. At the end of it, it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military. But we can think of ways to reduce the impact without getting in the way of their job.
  - icefo 9y ago
    If the 0 day is in an open source project this seems doable but I don't know if the NSA has access to the Microsoft or Cisco source code.
    - Natsu 9y ago
      They very likely do have access to the Windows source code. Microsoft does share that with certain governments & educational institutions. I think the Chinese government also has access, FWIW, but it's been a long time since I looked into this.
      - MichaelGG 9y ago
        I got personal access to the Windows source along with many others via the MS MVP program. And it's unlikely that even if MS was secretive that the USG cannot get multiple people working at MS with access.
    - sillysaurus3 9y ago
      True, but blackbox pentesting is pretty common. If a company is informed of a flaw in their XYZ service with details of how the flaw operates, it would probably be enough.
wslh 9y ago
Are the added to a popular antivirus list?
- deleted 9y ago
  [deleted]
rapjs 9y ago
Thanks Apple, for not caving to public pressure.
awarer 9y ago
Side topic: How can the free market/enterprise work properly if there are backdoors and zero days all over the place?
- JumpCrisscross 9y ago
  Customers start demanding security? Validation of security auditing isn't something I commonly see in purchasing.
- iraklism 9y ago
  If your threat model includes 3 letter agencies, the short answer is that you cannot.
  - quantumhobbit 9y ago
    Problem is that the 3-letter agencies tools get leaked and then are open for script Kidd to use. So you're threat model has a dristributive connection to the 3-letters no matter what.
eternalvision 9y ago
Tech security has been an afterthought for too long. The core technologies we use are putting us at grave risk in ways we simply cannot imagine. As we now are starting to realize, that all of our digital lives are permanently centrally recorded carries currently unimaginable risks down the road. That we have centralized global social networks carries risks that the majority of people are not able to experience or understand. We're progressing too fast technologically, and there's way too much of a gap between morphing cultural norms and a system of government that will be, by default, always out of date with respect to these evolving norms. That we connect directly to a worldwide network with minimum consideration for security is very troubling. In decades to come, we'll look back in humility and realize that the manners in which we used technology added grave risks to our health. In 2017, we are not in the "wild wild west" age of technology. Rather, we are firmly in the dark ages. We're so far away from having an understanding regarding the lack of social maturity in our technological growth that we fail to properly consider the downside risks. This is a tough nut to crack because technology is simply too good for the majority, even the technically inclined majority. I recall efforts by very very talented folks to build decentralized technologies to help mitigate some of these long term risks, but such efforts will remain firmly at the fringes of intellectual superiority for a long time. Meanwhile, Goliath will simply grow stronger in time, unless there is some major cultural shift. Is there any such shift happening, beyond the fringe?
- TheSpiceIsLife 9y ago
  Poetic, but you shot yourself in the foot in the first paragraph. "That we have centralized global social networks carries risks that the majority of people are not able to experience" If the majority of people do not experience the consequences of the risks of whatever-it-is-your-railing-against, if those risks are never realised by the majority, your argument evaporates.
  - eternalvision 9y ago
    Point taken. The majority are not able to experience it because it has not happened for the majority, yet. The data is there, the technology to use that data in the future has not been employed.
noja 9y ago
"now"
c0achmcguirk 9y ago
"Once installed, DOUBLEPULSAR is a stealthy backdoor that’s difficult to detect and continuously relays new information back to its controller." Seems to contradict itself? If it's continuously relaying information, wouldn't that make it easy to detect?
- TheSpiceIsLife 9y ago
  If it's detectable at all doesn't that make it easy to detect?
- chongli 9y ago
  I think what that means is that it's difficult to detect on the infected host machine. It's easy to detect at the network level, however.
  - jessaustin 9y ago
    Depending on the implementation of "continuously", it might not be easy there either. Most hosts have some reason to be on the internet. Therefore, with some cleverness, attack traffic can be hidden within normal, expected traffic.
sebow 9y ago
shocking news indeed, seems like you need researchers and studies about everything nowadays, otherwise you're called names
Pica_soO 9y ago
The zero-day NSA Pensionfund congratulates John & Jane Doe to his retirement and wishes him/her a nice golden autumn in his Florida beach villa.
ChuckMcM 9y ago
It would be interesting (although I expect impossible) to figure out how many of those thousands were compromised by the NSA vs those compromised by people who got the tools through the leak. It was nice that Microsoft had already fixed a bunch of them (almost like they were told ahead of time they were coming). It is also interesting to read the outrage about the tools and the presentations on how to use them. If you have ever read the user's manual for a cluster bomb which no doubt tells you in detail how to maximize the number of people it will kill, you get a sense of how destructive and outrageous war can be. Why should cyber war be any different? And how is it any different to use a zero day to compromise a system than it is to use an architectural feature of a building to bring it down on top of its occupants (other than the obvious loss of life). Exploiting defects in the deployed system to maximize the effectiveness of a munition, not a new thing at all. Just the reality of warfare. We're pretty clearly already in a form of warfare and it is having visible effects on things like infrastructure and elections. So how do we make the battles visible to the common folks? How do convince Mom & Dad to patch their router so that they don't inadvertently aid the 'badguys' in their quest for dominance on the digital battlefield? Definitely feels like Phase III of the Internet has begun to me.
- deleted 9y ago
  [deleted]
- dmix 9y ago
  > Definitely feels like Phase III of the Internet has begun to me. I knew it wouldn't be that semantic web babble nonsense. I really hope it is the realization that infosec is important and we become closer to real engineers that factor in risk. My only fear is that it results in more useless regulatory oversight with marginal ROI. The recent controls put on zero day sales are a good example. They will do nothing to prevent the proliferation of malware and only punish honest companies helping to secure systems with practical attacks. It's like how the city I live in (Toronto) just enacted another round of rent control to deal with a lack of affordable housing. Rent control makes people happy by seeming to address the problem but ultimately historically has always resulted in less development of affordable housing by disincentivizing investment rather than helping developers build more buildings cheaper, by reducing red tape. This is what we need to do with security research. Stop villianizing researching exploits and sending innocent kids to jail and start paying them good money for their (often profitless) energy expenditure.
mirimir 9y ago
> “Shodan has currently indexed more than 2 million IPs running a public SMB service on port 445. ..." OK, I understand SMB on LAN. But SMB on the Internet? Is that likely accidental?
- thomastjeffery 9y ago
  Or a stupid way to make your data available on the go.
  - mirimir 9y ago
    I did Google for "remote SMB". And your point was made in most of the top forum threads. But sure, people like the easy fix.
balgan 9y ago
For more details on this and regular updated on the infection numbers check:https://blog.binaryedge.io/2017/04/21/doublepulsar/ https://blog.binaryedge.io/2017/04/21/doublepulsar/
awqrre 9y ago
At the very least, they should at least create some honeypots to know when those exploits are being used by others...
lend000 9y ago
I like the idea of the agencies being allowed to use a zero-day with some asterisks. * The zero-day has to be powerful enough to allow the agency to gain full access & remotely patch the zero day -- i.e. if the zero-day gets out, and the agency didn't warn the manufacturer ahead of time and instead used it for its own purposes, it must have the capability to "immediately" scan the internet for the vulnerability and patch it where accessible. * If the above condition is not satisfied, or if the agency can't/won't dedicate the resources to develop a backup patch, it should be required to alert the manufacturer immediately. Does this cost more? Yes. Does it limit some of the monitoring capabilities they will have? Yes. The second seems like a pro. The first one seems like a worthy compromise for questionable activity with high potential for collateral damage.
- cosinetau 9y ago
  At some point, they'd make the patch, and discover they need access again for some reason. We'd be right back where we started.
thomastjeffery 9y ago
Just thousands? I think that is a few orders of magnitude shy...
spyall 9y ago
I would prefer to be spied by China. So that if they devolop a new operating system for mobiles I would use that.
godmodus 9y ago
Good, the will jolt national and global security standards.
1001101 9y ago
I have heard the NSA mission in this regard characterized as both defensive, and offensive. Defensive in that they protect our infrastructure (a counter-intel role), and offensive in that they attempt to exploit the infrastructure of our adversaries (and others) for sigint. They trick is finding the right balance, and I don't think there's much hope for agreement on that at the moment. I also find the debate a difficult one to engage in because there are large information asymmetries and much of what we're trying to discuss is obscured by secret courts, classified documents, etc. My impression is that even the people who are tasked with oversight don't get the full picture, so what do we hope to know about it. I've had experiences in industry that I can't talk about that maybe you (in the general sense) haven't had that also inform my views. Personally, my view is that we should be putting the focus on the defensive side. Protect infrastructure, IP, etc. I believe the reputation of technology in general is harmed by the offensive mission, and US companies disproportionately so. There is now even greater incentives for our adversaries (and friends) to foster development of technologies that compete directly with US products in their own jurisdictions (where they can get a look under the hood).
davidf18 9y ago
I am worried about the firmware of Intel processors which I believe have had firmware since the mid-1990s or a bit later. Is this possible and are there tools "in the wild" that are capable of doing this? Does Intel do some sort of checksum to ensure that this cannot happen?
- i336_ 9y ago
  Not sure whether you're referring to CPU microcode or the OS in the management engine. Microcode is remarkably tiny and heavily encrypted. I've never heard of anyone dropping hints as to what's in it, so if that's permeable at all I get the impression you'd probably have to have some rather nice friends to learn about it. Regarding ME security, here's some interesting info I found a while ago: https://news.ycombinator.com/item?id=13782508 https://news.ycombinator.com/item?id=13782508
  - davidf18 9y ago
    Thank you. I was thinking about CPU microcode, but the problem would apply to the ME, I'd guess. Seems to me the CPU microcode could be hackable given NSA or Israeli govt resources.
squozzer 9y ago
"The sheer number of computers infected with DOUBLEPULSAR is likely the work of amateurish hackers, experts said." A huge assumption.

374 points by remx 9y ago

LoSboccacc 9y ago

shower thought: have them been infected now, or now are known to be infected?

iraklism 9y ago
I was about to comment something similar , but then I saw your post. Btw I don't know why people are down voting it. This is an important point. This research comes after 10 days of the leak. I have been following the leak closely, I've even compiled a list with all the analysis and resources on a gist. Good guys, bad guys, kids, bored Blackhats, had enough time to practically follow the step by step instructions in order to implant the backdoor. It doesn't take more than 30-40 mins for the first read till a successful exploit. The short answer is that we have no idea of knowing how many of those were backdoored by the NSA. Also worth noting is that the leak happened 3-4 months ago. A lot of people had access to this privately.
- TACIXAT 9y ago
  I was thinking this created great plausible deniability for the NSA.

arca_vorago 9y ago

Which is exactly what we crazy cookoo conspiracy theorists have been warning about. It's the same slipperly slope we already went through in the 90's crypto wars, but SV gets amnesia when it gets lots of stupid company valuations and forgets all those lessons apparently. Bottom line is this. If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massively weakened infrastructure, corporate, and government security... basically all the things important to national security in general. So while I don't disagree that triple letters need some cool tools to get shit done, I think this function needs some technocratic oversight specifically for this issue. It's time for a new Church committee.

sillysaurus3 9y ago
The antidote seems to be for the NSA to maintain a security report for each discovered zero day. If it ever leaks, they can send the target company the report, which explains both what the exploit is and how to fix it. That seems fair enough. The NSA needs to exploit flaws, but they can be a bit less evil about it by being ready to fix them if necessary. That doesn't solve the fact that NSA's competitors could find and exploit the same flaws, or that sometimes it's hard to tell whether any leaks have happened, but it's an improvement. At the end of it, it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military. But we can think of ways to reduce the impact without getting in the way of their job.
- icefo 9y ago
  If the 0 day is in an open source project this seems doable but I don't know if the NSA has access to the Microsoft or Cisco source code.
  - Natsu 9y ago
    They very likely do have access to the Windows source code. Microsoft does share that with certain governments & educational institutions. I think the Chinese government also has access, FWIW, but it's been a long time since I looked into this.
    - MichaelGG 9y ago
      I got personal access to the Windows source along with many others via the MS MVP program. And it's unlikely that even if MS was secretive that the USG cannot get multiple people working at MS with access.
  - sillysaurus3 9y ago
    True, but blackbox pentesting is pretty common. If a company is informed of a flaw in their XYZ service with details of how the flaw operates, it would probably be enough.

wslh 9y ago

Are the added to a popular antivirus list?

deleted 9y ago
[deleted]

rapjs 9y ago

Thanks Apple, for not caving to public pressure.

awarer 9y ago

Side topic: How can the free market/enterprise work properly if there are backdoors and zero days all over the place?

JumpCrisscross 9y ago
Customers start demanding security? Validation of security auditing isn't something I commonly see in purchasing.
iraklism 9y ago
If your threat model includes 3 letter agencies, the short answer is that you cannot.
- quantumhobbit 9y ago
  Problem is that the 3-letter agencies tools get leaked and then are open for script Kidd to use. So you're threat model has a dristributive connection to the 3-letters no matter what.

eternalvision 9y ago

Tech security has been an afterthought for too long. The core technologies we use are putting us at grave risk in ways we simply cannot imagine. As we now are starting to realize, that all of our digital lives are permanently centrally recorded carries currently unimaginable risks down the road. That we have centralized global social networks carries risks that the majority of people are not able to experience or understand. We're progressing too fast technologically, and there's way too much of a gap between morphing cultural norms and a system of government that will be, by default, always out of date with respect to these evolving norms. That we connect directly to a worldwide network with minimum consideration for security is very troubling. In decades to come, we'll look back in humility and realize that the manners in which we used technology added grave risks to our health. In 2017, we are not in the "wild wild west" age of technology. Rather, we are firmly in the dark ages. We're so far away from having an understanding regarding the lack of social maturity in our technological growth that we fail to properly consider the downside risks. This is a tough nut to crack because technology is simply too good for the majority, even the technically inclined majority. I recall efforts by very very talented folks to build decentralized technologies to help mitigate some of these long term risks, but such efforts will remain firmly at the fringes of intellectual superiority for a long time. Meanwhile, Goliath will simply grow stronger in time, unless there is some major cultural shift. Is there any such shift happening, beyond the fringe?

TheSpiceIsLife 9y ago
Poetic, but you shot yourself in the foot in the first paragraph. "That we have centralized global social networks carries risks that the majority of people are not able to experience" If the majority of people do not experience the consequences of the risks of whatever-it-is-your-railing-against, if those risks are never realised by the majority, your argument evaporates.
- eternalvision 9y ago
  Point taken. The majority are not able to experience it because it has not happened for the majority, yet. The data is there, the technology to use that data in the future has not been employed.

noja 9y ago

"now"

c0achmcguirk 9y ago

"Once installed, DOUBLEPULSAR is a stealthy backdoor that’s difficult to detect and continuously relays new information back to its controller." Seems to contradict itself? If it's continuously relaying information, wouldn't that make it easy to detect?

TheSpiceIsLife 9y ago
If it's detectable at all doesn't that make it easy to detect?
chongli 9y ago
I think what that means is that it's difficult to detect on the infected host machine. It's easy to detect at the network level, however.
- jessaustin 9y ago
  Depending on the implementation of "continuously", it might not be easy there either. Most hosts have some reason to be on the internet. Therefore, with some cleverness, attack traffic can be hidden within normal, expected traffic.

sebow 9y ago

shocking news indeed, seems like you need researchers and studies about everything nowadays, otherwise you're called names

Pica_soO 9y ago

The zero-day NSA Pensionfund congratulates John & Jane Doe to his retirement and wishes him/her a nice golden autumn in his Florida beach villa.

ChuckMcM 9y ago

It would be interesting (although I expect impossible) to figure out how many of those thousands were compromised by the NSA vs those compromised by people who got the tools through the leak. It was nice that Microsoft had already fixed a bunch of them (almost like they were told ahead of time they were coming). It is also interesting to read the outrage about the tools and the presentations on how to use them. If you have ever read the user's manual for a cluster bomb which no doubt tells you in detail how to maximize the number of people it will kill, you get a sense of how destructive and outrageous war can be. Why should cyber war be any different? And how is it any different to use a zero day to compromise a system than it is to use an architectural feature of a building to bring it down on top of its occupants (other than the obvious loss of life). Exploiting defects in the deployed system to maximize the effectiveness of a munition, not a new thing at all. Just the reality of warfare. We're pretty clearly already in a form of warfare and it is having visible effects on things like infrastructure and elections. So how do we make the battles visible to the common folks? How do convince Mom & Dad to patch their router so that they don't inadvertently aid the 'badguys' in their quest for dominance on the digital battlefield? Definitely feels like Phase III of the Internet has begun to me.

deleted 9y ago
[deleted]
dmix 9y ago
> Definitely feels like Phase III of the Internet has begun to me. I knew it wouldn't be that semantic web babble nonsense. I really hope it is the realization that infosec is important and we become closer to real engineers that factor in risk. My only fear is that it results in more useless regulatory oversight with marginal ROI. The recent controls put on zero day sales are a good example. They will do nothing to prevent the proliferation of malware and only punish honest companies helping to secure systems with practical attacks. It's like how the city I live in (Toronto) just enacted another round of rent control to deal with a lack of affordable housing. Rent control makes people happy by seeming to address the problem but ultimately historically has always resulted in less development of affordable housing by disincentivizing investment rather than helping developers build more buildings cheaper, by reducing red tape. This is what we need to do with security research. Stop villianizing researching exploits and sending innocent kids to jail and start paying them good money for their (often profitless) energy expenditure.

mirimir 9y ago

> “Shodan has currently indexed more than 2 million IPs running a public SMB service on port 445. ..." OK, I understand SMB on LAN. But SMB on the Internet? Is that likely accidental?

thomastjeffery 9y ago
Or a stupid way to make your data available on the go.
- mirimir 9y ago
  I did Google for "remote SMB". And your point was made in most of the top forum threads. But sure, people like the easy fix.

balgan 9y ago

For more details on this and regular updated on the infection numbers check:https://blog.binaryedge.io/2017/04/21/doublepulsar/ https://blog.binaryedge.io/2017/04/21/doublepulsar/

awqrre 9y ago

At the very least, they should at least create some honeypots to know when those exploits are being used by others...

lend000 9y ago

I like the idea of the agencies being allowed to use a zero-day with some asterisks. * The zero-day has to be powerful enough to allow the agency to gain full access & remotely patch the zero day -- i.e. if the zero-day gets out, and the agency didn't warn the manufacturer ahead of time and instead used it for its own purposes, it must have the capability to "immediately" scan the internet for the vulnerability and patch it where accessible. * If the above condition is not satisfied, or if the agency can't/won't dedicate the resources to develop a backup patch, it should be required to alert the manufacturer immediately. Does this cost more? Yes. Does it limit some of the monitoring capabilities they will have? Yes. The second seems like a pro. The first one seems like a worthy compromise for questionable activity with high potential for collateral damage.

cosinetau 9y ago
At some point, they'd make the patch, and discover they need access again for some reason. We'd be right back where we started.

thomastjeffery 9y ago

Just thousands? I think that is a few orders of magnitude shy...

spyall 9y ago

I would prefer to be spied by China. So that if they devolop a new operating system for mobiles I would use that.

godmodus 9y ago

Good, the will jolt national and global security standards.

1001101 9y ago

I have heard the NSA mission in this regard characterized as both defensive, and offensive. Defensive in that they protect our infrastructure (a counter-intel role), and offensive in that they attempt to exploit the infrastructure of our adversaries (and others) for sigint. They trick is finding the right balance, and I don't think there's much hope for agreement on that at the moment. I also find the debate a difficult one to engage in because there are large information asymmetries and much of what we're trying to discuss is obscured by secret courts, classified documents, etc. My impression is that even the people who are tasked with oversight don't get the full picture, so what do we hope to know about it. I've had experiences in industry that I can't talk about that maybe you (in the general sense) haven't had that also inform my views. Personally, my view is that we should be putting the focus on the defensive side. Protect infrastructure, IP, etc. I believe the reputation of technology in general is harmed by the offensive mission, and US companies disproportionately so. There is now even greater incentives for our adversaries (and friends) to foster development of technologies that compete directly with US products in their own jurisdictions (where they can get a look under the hood).

davidf18 9y ago

I am worried about the firmware of Intel processors which I believe have had firmware since the mid-1990s or a bit later. Is this possible and are there tools "in the wild" that are capable of doing this? Does Intel do some sort of checksum to ensure that this cannot happen?

i336_ 9y ago
Not sure whether you're referring to CPU microcode or the OS in the management engine. Microcode is remarkably tiny and heavily encrypted. I've never heard of anyone dropping hints as to what's in it, so if that's permeable at all I get the impression you'd probably have to have some rather nice friends to learn about it. Regarding ME security, here's some interesting info I found a while ago: https://news.ycombinator.com/item?id=13782508 https://news.ycombinator.com/item?id=13782508
- davidf18 9y ago
  Thank you. I was thinking about CPU microcode, but the problem would apply to the ME, I'd guess. Seems to me the CPU microcode could be hackable given NSA or Israeli govt resources.

squozzer 9y ago

"The sheer number of computers infected with DOUBLEPULSAR is likely the work of amateurish hackers, experts said." A huge assumption.