12 ms·

The quote bombshell here, and what hasnt yet gotten much attention since sysadmins the world over are busy dealing with fallout, is that the NSA and therefore t

by loteck 9y ago

The quote bombshell here, and what hasnt yet gotten much attention since sysadmins the world over are busy dealing with fallout, is that the NSA and therefore the US government is directly responsible for the current global cyber-carnage. We developed the capability, we chose to keep it unpatched, we tried to keep it secret, we lost control of it. This has similarities in type, if not in horror, to the development and subsequent spread of nuclear weapons. When we lost control of those secrets, it was a BFD [0]. [0] https://en.m.wikipedia.org/wiki/Atomic_spies https://en.m.wikipedia.org/wiki/Atomic_spies

deleted 9y ago
[deleted]
SomeStupidPoint 9y ago
MS issued a patch ahead of the usage of the lost exploit by a wide enough margin that I'm loathe to blame the government for the mere existence. The problem lies in our defensive infrastructure and our ability to roll out patches responding to incidents. It also lies in our security infrastructure: that cryptoworms are a danger speaks to a fundamental lapse in permission and process management systems.
- CydeWeys 9y ago
  The margin would've been much wider still with responsible disclosure from the NSA, however. This means that fewer people would have been affected.
  - mastax 9y ago
    Unless the NSA reported it to MS back when XP was still supported, not much would change. People can (and do) reverse-engineer exploits from windows updates, and they could still take advantage of the large number of unpatched XP machines.
    - muricula 9y ago
      In an unusual move, after the worm statrted spreading MS released a patch to XP for this exploit.
  - SomeStupidPoint 9y ago
    Based on what? The NSA likely gave MS months of lead once they determined what SB stole. A patch was pushed out before the release of the vulns. There's no reason to suspect that people wouldn't have reverse engineered the vuln from the patch and had similar timelines of unpatched systems being exposed. In fact, we see exactly that play out over and over with security patches.
- gutnor 9y ago
  Well a US government agency in charge of US Security decided that keeping the US and its allies vulnerable. They definitively need to answer if the benefit was really worth it.
  - drakonandor 9y ago
    How many times do people need to be told that XP machines should not be connected to the internet, especially if they're not keeping up with patches?
- flukus 9y ago
  > The problem lies in our defensive infrastructure and our ability to roll out patches responding to incidents. The problem is corporate IT (or management) think they can create some sort of stable environment, driven by fear of having things break. Organizationally they need to accept that they are operating in a dynamic and hostile ecosystem and that the risk of worms is higher than the risk of some random app breaking on a windows patch.
  - CamperBob2 9y ago
    Organizationally they need to accept that they are operating in a dynamic and hostile ecosystem and that the risk of worms is higher than the risk of some random app breaking on a windows patch. Except it's not. The account used by the hackers has supposedly earned about 4 Bitcoins so far. Meanwhile, many people from home users to professional IT personnel can recall incidents where Windows Update has broken something that worked fine before. Up to and including installing a completely new version of Windows, force-fed to unwilling customers with intentionally-deceptive practices.
    - 21 9y ago
      I know more times when updating Ubuntu made the machine unbootable than for Windows.
      - dotancohen 9y ago
        I'm a CentOS desktop user at work and Ubuntu at home. I love my Linux. Objectively, the parent poster is correct. For all MS's faults, I've had no less problems updating Ubuntu systems than I've had or seen with MS systems. That said, CentOS is _rock solid_. The packages are old, but maintained by Redhat upstream and do not break on updates. The only thing I recall seeing break on a CentOS update, including point releases, are Firefox and Thunderbird extensions as Mozilla apps are updated eight version numbers from one ESL release to the next.
        flukus 9y ago
- askvictor 9y ago
  MS also has to share some blame here for updates that break things, and updates that restart at random times (such as when you're doing some really urgent work). This has trained a whole lot of users to believe that windows updates are a risk to their use of the computer, and now just click away any update prompts.
  - tallanvor 9y ago
    Honestly, though, updates breaking things are quite rare. Sure, I know of "a friend of a friend of a friend" who had something break, but honestly, aside from patch installations sometimes being started at inopportune times, I haven't personally encountered things breaking on any of my systems or those of friends or family. More things get broken because people hear that there are problems and try to stop the updates.
Kholo 9y ago
Complete BS. This is what happens when you have top class PR at your disposal to define the narrative. Microsoft is responsible for their shit software getting exploited first and foremost. Seriously fine Microsoft and by day after tomorrow that 3500 security engineer number will jump to something realistic. Instead what will happen is more tightening of the walled garden, overcharging of support/security contracts and propping up of another billionaire or two. I can hear the whisky glasses clinking. Corporations do not get to set the agenda and the narrative. When they are allowed to, the results are very predictable - in this case Microsoft will make more than they loose. Who here disagrees that is going to happen? And who here believes that is right? The answer is simple whether its Microsoft today or Facebook and Google tomorrow win-win should not be an option when such things happen.
- Shinkirou 9y ago
  No system is perfect. Remember Heartbleed? Microsoft released a patch to correct this particular issue in March, however the IT infrastructure in companies is slow, the whole process is convoluted, yada yada. The point is: the NSA caused this particular problem. Steps should be taken be everyone to ensure something like this doesn't happen ever again.
  - mrmondo 9y ago
    Just because the media (including Microsoft) tagged those projects (that were maintained by small groups of core develops and are free (unpaid) software) with fancy names - those problems weren't anything like the massive, global impact of just one of Microsoft's ticking timebombs due to poor software design and lack of emphasis on security in their products. OpenSSL doesn't and didn't have the PR powerhouse of Microsoft and people didn't pay for their software let alone fund its development.
    - threeseed 9y ago
      > Microsoft's ticking timebombs due to poor software design and lack of emphasis on security in their products I assume you know nothing about software with flippant comments like this. Completely securing software is an incredibly difficult thing to do and merely throwing resources isn't going to change that. It is just as likely to affect well designed software as it is poorly designed. Especially given that all of us rely heavily on third party libraries and underlying infrastructure.
panzer_wyrm 9y ago
I am not exactly sure what dark powers were US government using to force people to leave 3389 on public facing ips. I thought that CIA mind control experiments failed.
- phs318u 9y ago
  According to CERT [0], the original infection vector is still unclear but possibly phishing, however once a computer is infected, any vulnerable machines on the local network are targets. [0] https://www.us-cert.gov/ncas/alerts/TA17-132A https://www.us-cert.gov/ncas/alerts/TA17-132A
  - syshum 9y ago
    Yep, too many companies still use the Ring Fence approach to security, in a day where Mobile Devices and laptops are moving all the time this is very very very bad. All it takes is one infected machine to get behind the permitter defenses and it is game over.
- deleted 9y ago
  [deleted]
youdontknowtho 9y ago
Agreed. The NSA has known about the shadow brokers beach for 4 or 5 months. They should have warned industry sooner. They ostensibly maintain their capability to protect us, but this is a clear example of them failing to protect us. The focus on offensive posture is all macho and typical military industrial bluster. My point is that the offensive cyber capability is more about dick length than keeping the country safer. Nevermind that the internet is a global shared resource that works best when we work together. Also, MS haters are doing some pretty fantastic replays of the hits in this thread. I get that you don't like them, but "kill Microsoft" isn't the answer. Maybe there needs to be a model for assigning cost to vulnerabilities like this...to Microsoft and the NSA. Make them account for this in monetary terms and you will see change.
yoaviram 9y ago
Another point which hasn't yet gotten much attention is the valuable role Wikileaks played as an early working system. Without Wikileaks it is likely that Microsoft wouldn't have had the chance to release a patch ahead of any attacks.
- tallanvor 9y ago
  The exploit was released in April. Microsoft patched it in March. How did Wikileaks play any role in the problem getting fixed?
3chelon 9y ago
I agree completely. People can blame MS for their insecure OS, or users who don't know any better for running outdated systems (or even for running Windows at all), but the stark reality is that all OSes have vulnerabilities because they are huge and complex and it is impossible to make them 100% secure. But the NSA are - by definition - supposed to be security experts, so what are they doing letting themselves get hacked? They have effectively given away the nuclear football. I'm shocked we're not seeing more blame in their direction on this one.
- nthcolumn 9y ago
  A bit rich from Microsoft to talk about hoarding when the patches they released over the weekend were all signed back in February... i.e. they are hoarding fixes to their own shit for their $$$ extended support agreements.
  - yread 9y ago
    maybe they were testing them?
    - rbanffy 9y ago
      For three months? That says a lot about the overall testability of their stuff.
  - ralphie02 9y ago
    "The chaos surprised many security watchers because Microsoft issued an update in March that patched the underlying vulnerability in Windows 7 and most other supported versions of Windows. (Windows 10 was never vulnerable.)" source: https://arstechnica.co.uk/security/2017/05/wcry-microsoft-issues-patch-for-3-unsupported-windows-versions/ https://arstechnica.co.uk/security/2017/05/wcry-microsoft-is... So I don't really know what you mean by 'hoarding the fix'. The patch was not initially released to some OS versions because they are NO LONGER supported.
    - bm98 9y ago
Angostura 9y ago
> we chose to keep it unpatched Are you saying that the choice was made my the NSA whole failed to report it, or suggesting that Microsoft colluded in keeping a known exploit open?
yig 9y ago
We would be in the exact same situation if the NSA had immediately disclosed the vulnerability to Microsoft. Old software wouldn't have been updated and someone would have exploited it.
rbanffy 9y ago
Sorry, but I can't agree with this. If it weren't the NSA discovering it and losing control of it, some other group would eventually get to it. The problem is Microsoft, who wrote the exploitable software in the first place.
bigbugbag 9y ago
How is that a surprise ? Warnings have been around left and right since before Snowden about this kind of scenario. Has happened before, will happen again. What's new here is that a suspicious group named Shadow Brokers went public about it and the release while this usually happens in private.

by loteck 9y ago

deleted 9y ago

[deleted]

SomeStupidPoint 9y ago

MS issued a patch ahead of the usage of the lost exploit by a wide enough margin that I'm loathe to blame the government for the mere existence. The problem lies in our defensive infrastructure and our ability to roll out patches responding to incidents. It also lies in our security infrastructure: that cryptoworms are a danger speaks to a fundamental lapse in permission and process management systems.

CydeWeys 9y ago
The margin would've been much wider still with responsible disclosure from the NSA, however. This means that fewer people would have been affected.
- mastax 9y ago
  Unless the NSA reported it to MS back when XP was still supported, not much would change. People can (and do) reverse-engineer exploits from windows updates, and they could still take advantage of the large number of unpatched XP machines.
  - muricula 9y ago
    In an unusual move, after the worm statrted spreading MS released a patch to XP for this exploit.
- SomeStupidPoint 9y ago
  Based on what? The NSA likely gave MS months of lead once they determined what SB stole. A patch was pushed out before the release of the vulns. There's no reason to suspect that people wouldn't have reverse engineered the vuln from the patch and had similar timelines of unpatched systems being exposed. In fact, we see exactly that play out over and over with security patches.
gutnor 9y ago
Well a US government agency in charge of US Security decided that keeping the US and its allies vulnerable. They definitively need to answer if the benefit was really worth it.
- drakonandor 9y ago
  How many times do people need to be told that XP machines should not be connected to the internet, especially if they're not keeping up with patches?
flukus 9y ago
> The problem lies in our defensive infrastructure and our ability to roll out patches responding to incidents. The problem is corporate IT (or management) think they can create some sort of stable environment, driven by fear of having things break. Organizationally they need to accept that they are operating in a dynamic and hostile ecosystem and that the risk of worms is higher than the risk of some random app breaking on a windows patch.
- CamperBob2 9y ago
  Organizationally they need to accept that they are operating in a dynamic and hostile ecosystem and that the risk of worms is higher than the risk of some random app breaking on a windows patch. Except it's not. The account used by the hackers has supposedly earned about 4 Bitcoins so far. Meanwhile, many people from home users to professional IT personnel can recall incidents where Windows Update has broken something that worked fine before. Up to and including installing a completely new version of Windows, force-fed to unwilling customers with intentionally-deceptive practices.
  - 21 9y ago
    I know more times when updating Ubuntu made the machine unbootable than for Windows.
    - dotancohen 9y ago
      I'm a CentOS desktop user at work and Ubuntu at home. I love my Linux. Objectively, the parent poster is correct. For all MS's faults, I've had no less problems updating Ubuntu systems than I've had or seen with MS systems. That said, CentOS is _rock solid_. The packages are old, but maintained by Redhat upstream and do not break on updates. The only thing I recall seeing break on a CentOS update, including point releases, are Firefox and Thunderbird extensions as Mozilla apps are updated eight version numbers from one ESL release to the next.
      - flukus 9y ago
askvictor 9y ago
MS also has to share some blame here for updates that break things, and updates that restart at random times (such as when you're doing some really urgent work). This has trained a whole lot of users to believe that windows updates are a risk to their use of the computer, and now just click away any update prompts.
- tallanvor 9y ago
  Honestly, though, updates breaking things are quite rare. Sure, I know of "a friend of a friend of a friend" who had something break, but honestly, aside from patch installations sometimes being started at inopportune times, I haven't personally encountered things breaking on any of my systems or those of friends or family. More things get broken because people hear that there are problems and try to stop the updates.

Kholo 9y ago

Complete BS. This is what happens when you have top class PR at your disposal to define the narrative. Microsoft is responsible for their shit software getting exploited first and foremost. Seriously fine Microsoft and by day after tomorrow that 3500 security engineer number will jump to something realistic. Instead what will happen is more tightening of the walled garden, overcharging of support/security contracts and propping up of another billionaire or two. I can hear the whisky glasses clinking. Corporations do not get to set the agenda and the narrative. When they are allowed to, the results are very predictable - in this case Microsoft will make more than they loose. Who here disagrees that is going to happen? And who here believes that is right? The answer is simple whether its Microsoft today or Facebook and Google tomorrow win-win should not be an option when such things happen.

Shinkirou 9y ago
No system is perfect. Remember Heartbleed? Microsoft released a patch to correct this particular issue in March, however the IT infrastructure in companies is slow, the whole process is convoluted, yada yada. The point is: the NSA caused this particular problem. Steps should be taken be everyone to ensure something like this doesn't happen ever again.
- mrmondo 9y ago
  Just because the media (including Microsoft) tagged those projects (that were maintained by small groups of core develops and are free (unpaid) software) with fancy names - those problems weren't anything like the massive, global impact of just one of Microsoft's ticking timebombs due to poor software design and lack of emphasis on security in their products. OpenSSL doesn't and didn't have the PR powerhouse of Microsoft and people didn't pay for their software let alone fund its development.
  - threeseed 9y ago
    > Microsoft's ticking timebombs due to poor software design and lack of emphasis on security in their products I assume you know nothing about software with flippant comments like this. Completely securing software is an incredibly difficult thing to do and merely throwing resources isn't going to change that. It is just as likely to affect well designed software as it is poorly designed. Especially given that all of us rely heavily on third party libraries and underlying infrastructure.

panzer_wyrm 9y ago

I am not exactly sure what dark powers were US government using to force people to leave 3389 on public facing ips. I thought that CIA mind control experiments failed.

phs318u 9y ago
According to CERT [0], the original infection vector is still unclear but possibly phishing, however once a computer is infected, any vulnerable machines on the local network are targets. [0] https://www.us-cert.gov/ncas/alerts/TA17-132A https://www.us-cert.gov/ncas/alerts/TA17-132A
- syshum 9y ago
  Yep, too many companies still use the Ring Fence approach to security, in a day where Mobile Devices and laptops are moving all the time this is very very very bad. All it takes is one infected machine to get behind the permitter defenses and it is game over.
deleted 9y ago
[deleted]

youdontknowtho 9y ago

Agreed. The NSA has known about the shadow brokers beach for 4 or 5 months. They should have warned industry sooner. They ostensibly maintain their capability to protect us, but this is a clear example of them failing to protect us. The focus on offensive posture is all macho and typical military industrial bluster. My point is that the offensive cyber capability is more about dick length than keeping the country safer. Nevermind that the internet is a global shared resource that works best when we work together. Also, MS haters are doing some pretty fantastic replays of the hits in this thread. I get that you don't like them, but "kill Microsoft" isn't the answer. Maybe there needs to be a model for assigning cost to vulnerabilities like this...to Microsoft and the NSA. Make them account for this in monetary terms and you will see change.

yoaviram 9y ago

Another point which hasn't yet gotten much attention is the valuable role Wikileaks played as an early working system. Without Wikileaks it is likely that Microsoft wouldn't have had the chance to release a patch ahead of any attacks.

tallanvor 9y ago
The exploit was released in April. Microsoft patched it in March. How did Wikileaks play any role in the problem getting fixed?

3chelon 9y ago

I agree completely. People can blame MS for their insecure OS, or users who don't know any better for running outdated systems (or even for running Windows at all), but the stark reality is that all OSes have vulnerabilities because they are huge and complex and it is impossible to make them 100% secure. But the NSA are - by definition - supposed to be security experts, so what are they doing letting themselves get hacked? They have effectively given away the nuclear football. I'm shocked we're not seeing more blame in their direction on this one.

nthcolumn 9y ago
A bit rich from Microsoft to talk about hoarding when the patches they released over the weekend were all signed back in February... i.e. they are hoarding fixes to their own shit for their $$$ extended support agreements.
- yread 9y ago
  maybe they were testing them?
  - rbanffy 9y ago
    For three months? That says a lot about the overall testability of their stuff.
- ralphie02 9y ago
  "The chaos surprised many security watchers because Microsoft issued an update in March that patched the underlying vulnerability in Windows 7 and most other supported versions of Windows. (Windows 10 was never vulnerable.)" source: https://arstechnica.co.uk/security/2017/05/wcry-microsoft-issues-patch-for-3-unsupported-windows-versions/ https://arstechnica.co.uk/security/2017/05/wcry-microsoft-is... So I don't really know what you mean by 'hoarding the fix'. The patch was not initially released to some OS versions because they are NO LONGER supported.
  - bm98 9y ago

Angostura 9y ago

> we chose to keep it unpatched Are you saying that the choice was made my the NSA whole failed to report it, or suggesting that Microsoft colluded in keeping a known exploit open?

yig 9y ago

We would be in the exact same situation if the NSA had immediately disclosed the vulnerability to Microsoft. Old software wouldn't have been updated and someone would have exploited it.

rbanffy 9y ago

Sorry, but I can't agree with this. If it weren't the NSA discovering it and losing control of it, some other group would eventually get to it. The problem is Microsoft, who wrote the exploitable software in the first place.

bigbugbag 9y ago

How is that a surprise ? Warnings have been around left and right since before Snowden about this kind of scenario. Has happened before, will happen again. What's new here is that a suspicious group named Shadow Brokers went public about it and the release while this usually happens in private.