31 ms·
Lessons learnt by ransomware developers - rather than using a single pretty arbitrary test, always rely on a more robust statistical model to detect whether you
by dis-sys 9y ago
Lessons learnt by ransomware developers - rather than using a single pretty arbitrary test, always rely on a more robust statistical model to detect whether your code is running inside a sandbox.
Lessons learnt by NSA - never over estimate the skill level of your network admins.
Lessons learnt by Microsoft - never under estimate the loyalty of your Chinese Windows XP users, both XP and Win10 have 18% of the Chinese market [1].
Lessons learnt by the Chinese central government - NSA is a partner not a threat, they build tools which can make the coming annual China-US cyber security talk smooth.
[1] http://gs.statcounter.com/os-version-market-share/windows/desktop/china http://gs.statcounter.com/os-version-market-share/windows/de...
- frik 9y ago> Re your Statscounter link http://gs.statcounter.com/os-version-market-share/windows/desktop/china http://gs.statcounter.com/os-version-market-share/windows/de... Win 7 is rising again for months Win10 and WinXP are shrinking
- dis-sys 9y agoIt is normal to see such data move +/-1% in a few months time. It is far more shocking to see 18% windows users in China are still running their XP. Must be very easy for NSA to do their job.
- tomc1985 9y agoThen you really don't want to see South America... a few years ago every PC I saw at a business ran XP.
- lovich 9y agoWhen I visited a firm we had contracted out with in India they also had machines running xp right next to machines running Windows 10 for our project
- toyg 9y agoThe elephant in the room is that XP was the last version of Windows that was relatively trivial to pirate. Activation procedures got stricter from 2008 onwards.
- rangibaby 9y agoWhat makes you think that? Win 7 is simple to activate using Daz loader etc. my theory is that Win XP is the last version of Windows that will run comfortably on true toaster <1GB RAM computers.
- collinmanderson 9y agoSee, I would have said that with Windows 2000. It came out only two years earlier and was pretty similar. I definitely am still holding on to my install cds.
- dagenleg 9y agoLessons learned in school: overestimate and underestimate are both just one word, no spaces needed.
- smb06 9y agoI don't get why you are being downvoted (also one word). I thought your comment was quite funny
- dagenleg 9y agoI guess some people interpreted the joke as confrontational and admittedly it does not contribute to the conversation. Nonetheless, I just could not resist.
- flycaliguy 9y agoThing with HN is you get a lot of english second language posters... who actually didn't learn those words in school.
- dagenleg 9y agoHuh, I would suspect that in modern times English is widely taught at schools all over the world, unless I am horribly mistaken. The quality of teaching is quite another issue and it's usually lacking - to which I can testify from my own experiences with post-Soviet secondary education system. Regardless, I am not starting a grammar crusade here, more like making a small remark.
- Pxtl 9y agoMs should release one last security patch for XP, even pirate copies: a firewall that kills every protocol except HTTP/HTTPS and email. Close all the ports.
- lexicality 9y agoI'm pretty sure remotely disabling computers is covered under the computer misuse act in the UK and every similar law in all countries that have them.
- Natanael_L 9y agoTunneling still works
- supergreg 9y agoPirates don't install security patches.
- fredley 9y agoNeither does the NHS
- stuartd 9y agoThere was no patch for XP until today, so how could they?
- TheCoelacanth 9y agoXP has been out of support for over three years. Continuing to use it is gross negligence. It was only a matter of time until something like this happened.
- murkle 9y ago2 years for NHS, but your point stands :) http://www.v3.co.uk/v3-uk/news/2406304/windows-xp-government-support-deal-ends-leaving-pcs-open-to-attack http://www.v3.co.uk/v3-uk/news/2406304/windows-xp-government...
- lumberjack 9y agoI don't think the malware developers wanted this kind of heat directed towards them. If anything they will learn to automatically disable any nodes that are clearly operating out of a public office building.
- ufmace 9y agoI wonder if something like that might be the case - that this malware escaped early or spread much farther and faster than the authors intended. That would explain the sloppy attempt at an analysis countermeasure that made it trivially easy to shut down the whole thing.
- Bartweiss 9y agoThere is a pretty long history of worms proving way more aggressive (either in damage or spread) than intended. I wouldn't be shocked if a slow-and-profitable infection went wrong and set off a crisis response.
- jahabrewer 9y ago> Lessons learnt by ransomware developers - rather than using a single pretty arbitrary test, always rely on a more robust statistical model to detect whether your code is running inside a sandbox. I like to imagine that one of the developers on that team filed a tech debt item to do exactly this, was never able to get their manager to prioritize it, and is now pulling out their hair saying, "I told you so!"
- haburka 9y agoI'm that developer but instead of working on malware, I just want to make sure that iPhones can actually use the website.
- lithos 9y agoMalware is more interesting. The site itself doesn't seem to have enough ads or well placed enough ads to be "income as a goal". So I'm guessing it's a " proof I can do stuff " or "trophy room" blog, which doesn't care (HR and recruiting will happily use worse websites to judge canidate value, or trophy rooms will be put in a room no one else wants/cabin so far from everyone it doesn't have electricity)
- dis-sys 9y agowill he/she be called into a HR meeting to make a Performance Improvement Plan? ;)
- walshemj 9y agoProbaly get a pair of concrete over shoes
- jessaustin 9y agoPotato, potahto.
- 13of40 9y agoI like to think that they know anything they implement will eventually get blocked, so they have a big collection of unexploited evasion tricks and just introduce them one by one.
- gumby 9y ago> Lessons learnt by the Chinese central government - NSA is a partner not a threat, they build tools which can make the coming annual China-US cyber security talk smooth. Wow, +1 Insightful!
- gumby 9y agoI guess this came off (unintentionally) as sarcastic. I had always assumed the risk of the NSA leak was from non-state actors (as this case) and it hasn't occurred to me that governments will find it just as handy -- in retrospect of course they will.
- nonbel 9y agoI'm kind of confused as to what the role of agencies like NSA, GHCQ, etc are in situations like this. Are they supposed to put an end to the attack? If so, how is it that a single researcher beat them to it (presumably with a budget many orders of magnitude less)? Or maybe this story isn't really accurate and there was no accident... EDIT: And if it isn't the role of those agencies to defend the public health IT infrastructure, which agencies are responsible, if any?
- JshWright 9y agoThe NSA knew about this vulnerability and decided to use it offensively, rather than notifying Microsoft about it. Then, due to lax controls, the exploit got leaked and used by the ransomware developers. Their culpability goes back a lot further than not noticing a kill switch.
- nonbel 9y agoIf previously aware, shouldn't they have been even more prepared to stop the attack then?
- JshWright 9y agoThe attackers used the NSA's exploit as a means to distribute their payload. It was the payload that was inadvertently disabled.
- nonbel 9y agoI honestly don't know the details, I am just wondering what government agencies have the responsibility of defending against attacks like this. Even in this case though, you would think the NSA, etc have to do less analysis of the payload since they got to inspect and play with it for much longer than anyone else. Therefore they could waste less time on that and more quickly focus on the rest of the issue.
- 9y ago
- Buge 9y agoI don't understand your Chinese government point. The post never said anything about China. And the only thing about the NSA was that it was an NSA-developed exploit. That doesn't make the NSA look friendly.
- gwu78 9y ago"Lessons learnt by ransomware developers..." If you are suggesting that developers, regardless whether they develop mobile apps or ransomware, will start relying less on DNS, I respectfully disagree. Someone else in this thread commented how reliance on DNS makes systems "fragile". With that I strongly agree. The same old assumptions will continue to be made, such as the one that DNS, specifcally, ICANN DNS, is always going to be used. How to break unwanted software? Do not follow the assumptions. For example, to break a very large quantity of shellcode change the name or location of the shell to something other than "/bin/sh".[1] Will shellcoders switch to a "robust statistical model" instead of hard coding "/bin/sh"? Someone once said that programmers are lazy. Was he joking? 1. Yes, I know it may also break wanted third party software. When I first edited init.c, renamed and moved sh I was seeking to learn about dependencies. I expected things to break. That was the point: an experiment. I wanted to see what would break and what would not.
- kccqzy 9y agoIf you change the name or location of the shell to something other than "/bin/sh", plenty of legitimate software would break too. Even though the POSIX standard says: > Applications should note that the standard PATH to the shell cannot be assumed to be either /bin/sh or /usr/bin/sh, and should be determined by interrogation of the PATH returned by `getconf PATH`, ensuring that the returned pathname is an absolute pathname and not a shell built-in. > For example, to determine the location of the standard sh utility: command −v sh
- sprafa 9y agoIf you look at cybersecpolitics, a blog written by a former NSA, he specifically says the "we hacked into a server box" story for how these tools got leaked is implausible.
- squarefoot 9y agoLesson more people should learn: dump Windows.