4 ms·

In the meantime, what are doing the FBI, the NSA, and other agencies that exist precisely to avoid that?

MichaelBurge 9y ago
The ransomware was built from NSA tools, and I think it's illegal for them to comment on leaked classified information. The FBI doesn't publicly comment on on-going investigations. You might be able to ask them if one exists, though.
- faragon 9y ago
  My point was about those agencies catching ransomware authors.
  - rl3 9y ago
    Theoretically there's nothing legally stopping a NSA/GCHQ tag team from mercilessly hunting down and destroying ransomware operations. NSA only has red tape when it comes to U.S. citizens, but GCHQ doesn't. GCHQ's mandate also includes serious organized crime. Moreover, considering the damage ransomware can do to critical government infrastructure (for example NHS), it's not a stretch to imagine that targeting ransomware operations would fall under legitimate national security grounds. Personally I'm surprised they don't just completely fuck these people up to set an example. On the other hand, there's always the possibility WannaCry could be a mud slinging attempt from a state actor, given the much-publicized fact it uses leaked NSA vulns.
    - Freak_NL 9y ago
      > […] fuck these people up to set an example. I don't think it would be very effective. There are three reasons for hunting down and persecuting perpetrators of crime: vengeance, setting an example, and undoing the damage. Only the last reason makes any practical sense here. This attack works, so there will be others in the future, but it will happen regardless of the threat of punishment. Sure, if you set an example some people might be deterred, but surely not the bright hacker in a basement in Yekaterinburg, or the determined gang in Nigeria, or the mobsters in Chengdu City; i.e., anyone, anywhere without much to lose?
      - walshemj 9y ago
        Its also put presure on govemnets that in the past dont coperate with extrdaitions. Puting 50% of your diplomats on a plane with 48 hours notice sends a message - you can also start having the IRS / HMRC invstigate rich expats friedly to the regime.
      - rl3 9y ago
        >Only the last reason makes any practical sense here. Admittedly there's only so much damage SIGINT agencies can do, but if you get other intelligence agencies involved that have a more human side about them, that changes.
    - nol13 9y ago
      At least within the realm of possibility (as far as I'm naively aware) that whoever did this didn't fuck up too badly and they're simply unable to track them.
- zokier 9y ago
  > The ransomware was built from NSA tools I think that is bit disingenuous. The worm spreads through hole that was known to NSA and publicly disclosed and patched few months ago. That is hardly something I'd call "NSA tool", they didn't make the hole (best to our knowledge). Sure, it would have been nicer if the discoverer would have been more forthcoming about the vulnerability, but that would have not really changed the fact that this exploitation happened well after the public disclosure and patch availability.
  - syshum 9y ago
    1. It was more than just a known known flaw, there was actual tools released, it was not simply "hey we know this flaw in SMB is there 2. Timely discloure is very important, and could have infact prevented this, If the NSA knew about this years ago then chances are far far far far more systems including the older XP/2003 system could have been patch, and some systems may have never had the flaw at all. So it is completely false to say that even if the NSA would have disclosed it when they found it everything would have still happened the way it did. The Patches where only released for Win7/10/2008/2012 2 months ago, many companies hold back MS patches for any where from 1 to 3 months because MS has shitty quality control. On top of that MS stopped allowing individual patches instead going to a "update rollup" meaning you take all of MS's shitty patches or none of them Further XP and 2003 Patchs where not released until Sat.
    - zokier 9y ago
      1. I'm not convinced that the tool release was instrumental for the success of this worm, considering the timeline. Besides, having PoC code for public vulnerabilities is not exactly rare. 2. If a worm is based on the disclosure and hits two months after public disclosure of a hole, then it doesn't really matter if that disclosure happens in 2014, 2017, or 2020. Heck, in this case specifically it could be argued that the delay has been beneficial because we are now better equipped in general to manage such attacks. If you can't get critical security patches deployed in two months, then it is your problem, not NSAs or MS'. If you can't deal with MS patch quality then don't frikkin use their software. Running XP/2003 in a non-isolated environment is irresponsible as hell and utterly inexcusable. This sort of infection was completely predictable outcome for XP/2003. Considering that MS was under no obligation to patch XP/2003, I can't imagine what the admins were planning to do in this inevitable situation other than bury their heads into sand.

The ransomware was built from NSA tools, and I think it's illegal for them to comment on leaked classified information. The FBI doesn't publicly comment on on-going investigations. You might be able to ask them if one exists, though.

faragon 9y ago
My point was about those agencies catching ransomware authors.
- rl3 9y ago
  Theoretically there's nothing legally stopping a NSA/GCHQ tag team from mercilessly hunting down and destroying ransomware operations. NSA only has red tape when it comes to U.S. citizens, but GCHQ doesn't. GCHQ's mandate also includes serious organized crime. Moreover, considering the damage ransomware can do to critical government infrastructure (for example NHS), it's not a stretch to imagine that targeting ransomware operations would fall under legitimate national security grounds. Personally I'm surprised they don't just completely fuck these people up to set an example. On the other hand, there's always the possibility WannaCry could be a mud slinging attempt from a state actor, given the much-publicized fact it uses leaked NSA vulns.
  - Freak_NL 9y ago
    > […] fuck these people up to set an example. I don't think it would be very effective. There are three reasons for hunting down and persecuting perpetrators of crime: vengeance, setting an example, and undoing the damage. Only the last reason makes any practical sense here. This attack works, so there will be others in the future, but it will happen regardless of the threat of punishment. Sure, if you set an example some people might be deterred, but surely not the bright hacker in a basement in Yekaterinburg, or the determined gang in Nigeria, or the mobsters in Chengdu City; i.e., anyone, anywhere without much to lose?
    - walshemj 9y ago
      Its also put presure on govemnets that in the past dont coperate with extrdaitions. Puting 50% of your diplomats on a plane with 48 hours notice sends a message - you can also start having the IRS / HMRC invstigate rich expats friedly to the regime.
    - rl3 9y ago
      >Only the last reason makes any practical sense here. Admittedly there's only so much damage SIGINT agencies can do, but if you get other intelligence agencies involved that have a more human side about them, that changes.
  - nol13 9y ago
    At least within the realm of possibility (as far as I'm naively aware) that whoever did this didn't fuck up too badly and they're simply unable to track them.
zokier 9y ago
> The ransomware was built from NSA tools I think that is bit disingenuous. The worm spreads through hole that was known to NSA and publicly disclosed and patched few months ago. That is hardly something I'd call "NSA tool", they didn't make the hole (best to our knowledge). Sure, it would have been nicer if the discoverer would have been more forthcoming about the vulnerability, but that would have not really changed the fact that this exploitation happened well after the public disclosure and patch availability.
- syshum 9y ago
  1. It was more than just a known known flaw, there was actual tools released, it was not simply "hey we know this flaw in SMB is there 2. Timely discloure is very important, and could have infact prevented this, If the NSA knew about this years ago then chances are far far far far more systems including the older XP/2003 system could have been patch, and some systems may have never had the flaw at all. So it is completely false to say that even if the NSA would have disclosed it when they found it everything would have still happened the way it did. The Patches where only released for Win7/10/2008/2012 2 months ago, many companies hold back MS patches for any where from 1 to 3 months because MS has shitty quality control. On top of that MS stopped allowing individual patches instead going to a "update rollup" meaning you take all of MS's shitty patches or none of them Further XP and 2003 Patchs where not released until Sat.
  - zokier 9y ago
    1. I'm not convinced that the tool release was instrumental for the success of this worm, considering the timeline. Besides, having PoC code for public vulnerabilities is not exactly rare. 2. If a worm is based on the disclosure and hits two months after public disclosure of a hole, then it doesn't really matter if that disclosure happens in 2014, 2017, or 2020. Heck, in this case specifically it could be argued that the delay has been beneficial because we are now better equipped in general to manage such attacks. If you can't get critical security patches deployed in two months, then it is your problem, not NSAs or MS'. If you can't deal with MS patch quality then don't frikkin use their software. Running XP/2003 in a non-isolated environment is irresponsible as hell and utterly inexcusable. This sort of infection was completely predictable outcome for XP/2003. Considering that MS was under no obligation to patch XP/2003, I can't imagine what the admins were planning to do in this inevitable situation other than bury their heads into sand.