16 ms·

Microsoft will make the most from WannaCry

41 points by dberhane 9y ago

hrnnnnnn 9y ago
Paywalled. Workaround it by pasting the URL into Google and clicking the link there.
- Kiro 9y ago
  You can click "web" as well.
  - Beltiras 9y ago
    This bookmarklet works as well: javascript:window.location.href='https://m.facebook.com/l.php?u='+encodeURIComponent(window.location.href);
revmoo 9y ago
Don't post paywalled content
- bpicolo 9y ago
  The "web" button below title is intended for paywalled content.
jdironman 9y ago
Only way I got around the paywall was pasting the URL into Google then clicking 'Cached' version.
- jaimex2 9y ago
  why bother? Just click back and move on to other news.
  - LyndsySimon 9y ago
    Yep. I no longer visit news sites with paywalls, no matter how easily circumvented.
    - jdironman 9y ago
      True, however, while it's inconvenient it does give those who want to read it an option.
    - pjmlp 9y ago
      I hope you also don't complain about lack of quality of free content.
      - LyndsySimon 9y ago
        Nope. The quality of free content is quite good, and general the bias of that content is more apparent.
    - duke360 9y ago
      totally agree
- elorant 9y ago
  That's what the "web" link under each title is for. You can just do it from here.
dtnewman 9y ago
TLDR: Microsoft is using WannaCry as an opportunity to complain about the NSA and as an opportunity to tell people they need to update their software. I personally think that it's great to get the message across that people need to keep their operating systems up-to-date. I see too many non-technical people thinking in dangerous ways: * "I don't want to update software, because the new software could have bugs which might be a security risk." I used to work for a well-known Fortune 500 that thought this way. But _all_ software is vulnerable in one way or another and by keeping it up to date, you also get the most recent security patches. Software vendors generally aren't putting major resources into securing old versions of their software. * "I've got anti-virus software installed on my computer and we've got a firewall on our network". And maybe that will help you at some point, but if you don't update your OS, that's like having bullet-proof windows and leaving your front door unlocked.
- mstade 9y ago
  I wonder how much of the never-upgrade mentality is down to Microsoft insisting on being backwards compatible back till basically the Jurassic period, and providing support for obsolete software for years and years. Their intention is commendable, but there's something to be said for sometimes breaking things for what is hopefully the greater good. The rust package manager issue that was on HN the other week comes to mind, where a package called NUL (I think) wreaked havoc on Windows systems because of backwards compatibility with DOS. My point is: why rush to upgrade when you've got "support" anyway? For varying definitions of support.
  - ambulancechaser 9y ago
    I'm not sure that your point makes sense. If Microsoft insists on backwards compatibility, then you _can_ upgrade with "no worries". This policy seems to encourage people to upgrade as the new OS will honor the old mechanisms. In an OS where there was no commitment to backwards compatibility you would have an incentive to not change anything when it works. > My point is: why rush to upgrade when you've got "support" anyway? This is a different point. But you seem to be criticizing the decision by Microsoft to focus on backwards compatibility and support for old operating systems, two things that seem to be commendable.
mtgx 9y ago
Not a big fan of Microsoft in general, and I generally distrust anything it does, but I'm beginning to like this Brad Smith fellow. He's been pushing for quite a few privacy initiatives inside Microsoft, and he's now also taking on NSA and calling for a Digital Geneva Convention. I also think Microsoft "got lucky" this time. Shadow Brokers sit on EternalBlue for at least 6 months. They could've released it before the NSA even alerted Microsoft that such a bug exists in its operating system (probably earlier this year). That would've hurt Microsoft's image a lot more. So I think this should also be a warning to Microsoft (and other software companies). If there is some other backdoor in Windows or bug on which Microsoft may decide to sit on to give the NSA a few extra months to exploit it, its image could be hurt a lot. Some other group may discover it and and then turn it into another global ransomware attack, before Microsoft even has a chance to patch it. So lesson of the day: don't do back room (or door) deals with the NSA, whether because of fear, for money, "patriotism," or some other reason, because it could come back and hurt you 10 times more when you're put in the spotlight as the main party responsible for a global attack.
- drzaiusapelord 9y ago
  >They could've released it before the NSA They were looking for buyers this whole time. Perhaps you are unaware but there's an entire cottage industry of selling and buying of vulnerabilities out there. There are many zero days being sat on. No one is getting 'lucky.' They will be sold and used as needed by whatever group. There seems to be this narrative developing about how this exploit is some rare thing. There are hundreds of serious exploits discovered in Windows a year and those are the ones we know about. There was no nation state involved with conficker, slammer, codered, heartbleed, etc. So its silly to focus solely on the NSA here. Exploits will be found, forever. We don't have the ability to make defect-free software.
- j_s 9y ago
  EternalBlue CVE-2017-0144 was [edit:allocated/reserved instead of "assigned" per tweet] 2016-09-09. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144 Source: https://twitter.com/_supernothing/status/864021595303456768 https://twitter.com/_supernothing/status/864021595303456768 > MS has known about this bug since 09/2016 (when CVE was assigned) and patched in 03/2017. 240day
tjoff 9y ago
How does wannacry spread? From what I find it's primarily via an SMB exploit, but who on earth can possible receive SMB traffic on the internet today? Is it automatically opened via UPNP or something? (seems doubtful)
- tunap 9y ago
  Initially through an attachment and subsequently throughm the LAN via SMB. SMB is(was?) enabled by default in Windows Features.
  - tjoff 9y ago
    So, if the attack requires you to double-click on virus.exe the NSA exploits everyone is talking about didn't really matter that much did it? Sure, when hitting a large corporation that would obviously help a lot but home networks (which for some reason have been hit quite hard as well) don't even have that many machines to begin with.
    - devopsproject 9y ago
      The NSA exploits matter because they would be one of the few orgs to have access to multiple zero days. Imagine wannacry paired with a drive by browser exploit.
      - tjoff 9y ago
        Of course, I meant that it didn't matter much in this particular case. Every news outlet as well as technical sites seems to agree that it was NSA that enabled this attack, but if it all boils down to users opening email attachments that's something else entirely.
        xg15 9y ago
        The email attachment is the matchstick, the NSA has soaked everything in gasoline, so to speak. Thanks to the zero day, you need one person opening the attachment to infect every machine on the LAN. You're right about the point of home networks though. Some wild guesses: - Infected machines that are moved between networks - e.g. a laptop that's used in both public and a private networks BYOD-style. - The worm also didn't use broadcasts to spread but simply tried out all IP addresses in its subnet. So if an ISP isn't properly isolating its customers, the worm might spread from customer to customer behind the ISP's NAT. - People are actually that stupid and clicked on the attachment a lot.
WalterBright 9y ago
For developers, the takeaway is to use memory safe programming languages.
jkh1 9y ago
Despite their posturing, how can we trust Microsoft (and other companies like it) ? Windows is a black box. How do we know that there are no backdoors/spying routines to please some governments ? How can we trust that it behaves ethically with all the data it collects ? We only have their word for it.
- tunap 9y ago
  The Pro-MS downvoters are in force this morning. I will take the downs b/c I have not added any substance, but this trend is getting out of hand.
- thr0waway1239 9y ago
  What are you even talking about? Don't you know that they do so much open source these days?
  - devopsproject 9y ago
    You can contribute to open source and still do bad things: https://theintercept.com/2015/12/28/recently-bought-a-windows-computer-microsoft-probably-has-your-encryption-key/ https://theintercept.com/2015/12/28/recently-bought-a-window...
    - infinityplus1 9y ago
      I believe it was a sarcasm. Look at the italic part.
      - thr0waway1239 9y ago
        Yes it was. But I am enjoying it. No one group has a monopoly on knee-jerk reactions, you see.
      - devopsproject 9y ago
        You are correct. Unfortunately I have seen this sentiment used non-sarcastically. what a time to be alive.
vengefulduck 9y ago
Non-paywalled link: https://webcache.googleusercontent.com/search?q=cache:28gvJsnYhf4J:https://www.ft.com/content/b25e5c5e-3a34-11e7-821a-6027b8a20f23+&cd=4&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:28gvJs...
a_b_c_d 9y ago
True or false? Microsoft is a company that actively tries to prevent any comparisons of its products with other products, sometimes through threats of filing legal proceedings. True or false? Only government agencies are capabale of discovering flaws in Microsoft Windows. True or false? A closed source kernel is more secure than an open source kernel. (For the avoidance of doubt, here "open source" means open to public inspection free of charges, terms or conditions, such as various UNIX-like kernels. It also means the right to make changes, re-compile and re-distribute without charges.) True or false? This determination can be made without comparing the source code for both kernels. Hypothetical and questions: Product A has 5000-6000 new vulnerabilities per year, about 15 per day. Product B has 5-20 new vulnerabilities per year. Can we explain this difference by focusing on the parties who find the problems that require patching? Alternatively, should we focus instead on the products? What if Product A is more complex is than Product B? Does this make any difference? What if Product B can perform many of the same functions as Product A, particularly the functions that are most often used to exploit a vulnerability. For example handling data to be sent or recieved from the an untrustowrthy network such as the internet. In other words, networking with remote computers ("internet") as opposed to only networking with local computers ("IBM-compatible PC LAN"). Unlike BSD UNIX, Windows was originally designed for only local networking, where very little if any security is required. True or false? Windows still retains some of this original design and source code. That is a trick question because the Windows source code is not open source. How would anyone verify what is still in that source code? Keeping the source code from the eyes of its users does not protect them. It may be possible to reverse engineer Microsoft products or patches to learn how Windows works. "Good guys" may do this as well as "bad guys". A vulnerability could be discovered by someone who is not even old enough to work for a government. Repeat question: Should we focus on who finds flaws in Windows or should we focus on the Windows product itself?

41 points by dberhane 9y ago

hrnnnnnn 9y ago

Paywalled. Workaround it by pasting the URL into Google and clicking the link there.

Kiro 9y ago
You can click "web" as well.
- Beltiras 9y ago
  This bookmarklet works as well: javascript:window.location.href='https://m.facebook.com/l.php?u='+encodeURIComponent(window.location.href);

revmoo 9y ago

Don't post paywalled content

bpicolo 9y ago
The "web" button below title is intended for paywalled content.

jdironman 9y ago

Only way I got around the paywall was pasting the URL into Google then clicking 'Cached' version.

jaimex2 9y ago
why bother? Just click back and move on to other news.
- LyndsySimon 9y ago
  Yep. I no longer visit news sites with paywalls, no matter how easily circumvented.
  - jdironman 9y ago
    True, however, while it's inconvenient it does give those who want to read it an option.
  - pjmlp 9y ago
    I hope you also don't complain about lack of quality of free content.
    - LyndsySimon 9y ago
      Nope. The quality of free content is quite good, and general the bias of that content is more apparent.
  - duke360 9y ago
    totally agree
elorant 9y ago
That's what the "web" link under each title is for. You can just do it from here.

dtnewman 9y ago

TLDR: Microsoft is using WannaCry as an opportunity to complain about the NSA and as an opportunity to tell people they need to update their software. I personally think that it's great to get the message across that people need to keep their operating systems up-to-date. I see too many non-technical people thinking in dangerous ways: * "I don't want to update software, because the new software could have bugs which might be a security risk." I used to work for a well-known Fortune 500 that thought this way. But _all_ software is vulnerable in one way or another and by keeping it up to date, you also get the most recent security patches. Software vendors generally aren't putting major resources into securing old versions of their software. * "I've got anti-virus software installed on my computer and we've got a firewall on our network". And maybe that will help you at some point, but if you don't update your OS, that's like having bullet-proof windows and leaving your front door unlocked.

mstade 9y ago
I wonder how much of the never-upgrade mentality is down to Microsoft insisting on being backwards compatible back till basically the Jurassic period, and providing support for obsolete software for years and years. Their intention is commendable, but there's something to be said for sometimes breaking things for what is hopefully the greater good. The rust package manager issue that was on HN the other week comes to mind, where a package called NUL (I think) wreaked havoc on Windows systems because of backwards compatibility with DOS. My point is: why rush to upgrade when you've got "support" anyway? For varying definitions of support.
- ambulancechaser 9y ago
  I'm not sure that your point makes sense. If Microsoft insists on backwards compatibility, then you _can_ upgrade with "no worries". This policy seems to encourage people to upgrade as the new OS will honor the old mechanisms. In an OS where there was no commitment to backwards compatibility you would have an incentive to not change anything when it works. > My point is: why rush to upgrade when you've got "support" anyway? This is a different point. But you seem to be criticizing the decision by Microsoft to focus on backwards compatibility and support for old operating systems, two things that seem to be commendable.

mtgx 9y ago

Not a big fan of Microsoft in general, and I generally distrust anything it does, but I'm beginning to like this Brad Smith fellow. He's been pushing for quite a few privacy initiatives inside Microsoft, and he's now also taking on NSA and calling for a Digital Geneva Convention. I also think Microsoft "got lucky" this time. Shadow Brokers sit on EternalBlue for at least 6 months. They could've released it before the NSA even alerted Microsoft that such a bug exists in its operating system (probably earlier this year). That would've hurt Microsoft's image a lot more. So I think this should also be a warning to Microsoft (and other software companies). If there is some other backdoor in Windows or bug on which Microsoft may decide to sit on to give the NSA a few extra months to exploit it, its image could be hurt a lot. Some other group may discover it and and then turn it into another global ransomware attack, before Microsoft even has a chance to patch it. So lesson of the day: don't do back room (or door) deals with the NSA, whether because of fear, for money, "patriotism," or some other reason, because it could come back and hurt you 10 times more when you're put in the spotlight as the main party responsible for a global attack.

drzaiusapelord 9y ago
>They could've released it before the NSA They were looking for buyers this whole time. Perhaps you are unaware but there's an entire cottage industry of selling and buying of vulnerabilities out there. There are many zero days being sat on. No one is getting 'lucky.' They will be sold and used as needed by whatever group. There seems to be this narrative developing about how this exploit is some rare thing. There are hundreds of serious exploits discovered in Windows a year and those are the ones we know about. There was no nation state involved with conficker, slammer, codered, heartbleed, etc. So its silly to focus solely on the NSA here. Exploits will be found, forever. We don't have the ability to make defect-free software.
j_s 9y ago
EternalBlue CVE-2017-0144 was [edit:allocated/reserved instead of "assigned" per tweet] 2016-09-09. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144 Source: https://twitter.com/_supernothing/status/864021595303456768 https://twitter.com/_supernothing/status/864021595303456768 > MS has known about this bug since 09/2016 (when CVE was assigned) and patched in 03/2017. 240day

tjoff 9y ago

How does wannacry spread? From what I find it's primarily via an SMB exploit, but who on earth can possible receive SMB traffic on the internet today? Is it automatically opened via UPNP or something? (seems doubtful)

tunap 9y ago
Initially through an attachment and subsequently throughm the LAN via SMB. SMB is(was?) enabled by default in Windows Features.
- tjoff 9y ago
  So, if the attack requires you to double-click on virus.exe the NSA exploits everyone is talking about didn't really matter that much did it? Sure, when hitting a large corporation that would obviously help a lot but home networks (which for some reason have been hit quite hard as well) don't even have that many machines to begin with.
  - devopsproject 9y ago
    The NSA exploits matter because they would be one of the few orgs to have access to multiple zero days. Imagine wannacry paired with a drive by browser exploit.
    - tjoff 9y ago
      Of course, I meant that it didn't matter much in this particular case. Every news outlet as well as technical sites seems to agree that it was NSA that enabled this attack, but if it all boils down to users opening email attachments that's something else entirely.
      - xg15 9y ago
        The email attachment is the matchstick, the NSA has soaked everything in gasoline, so to speak. Thanks to the zero day, you need one person opening the attachment to infect every machine on the LAN. You're right about the point of home networks though. Some wild guesses: - Infected machines that are moved between networks - e.g. a laptop that's used in both public and a private networks BYOD-style. - The worm also didn't use broadcasts to spread but simply tried out all IP addresses in its subnet. So if an ISP isn't properly isolating its customers, the worm might spread from customer to customer behind the ISP's NAT. - People are actually that stupid and clicked on the attachment a lot.

WalterBright 9y ago

For developers, the takeaway is to use memory safe programming languages.

jkh1 9y ago

Despite their posturing, how can we trust Microsoft (and other companies like it) ? Windows is a black box. How do we know that there are no backdoors/spying routines to please some governments ? How can we trust that it behaves ethically with all the data it collects ? We only have their word for it.

tunap 9y ago
The Pro-MS downvoters are in force this morning. I will take the downs b/c I have not added any substance, but this trend is getting out of hand.
thr0waway1239 9y ago
What are you even talking about? Don't you know that they do so much open source these days?
- devopsproject 9y ago
  You can contribute to open source and still do bad things: https://theintercept.com/2015/12/28/recently-bought-a-windows-computer-microsoft-probably-has-your-encryption-key/ https://theintercept.com/2015/12/28/recently-bought-a-window...
  - infinityplus1 9y ago
    I believe it was a sarcasm. Look at the italic part.
    - thr0waway1239 9y ago
      Yes it was. But I am enjoying it. No one group has a monopoly on knee-jerk reactions, you see.
    - devopsproject 9y ago
      You are correct. Unfortunately I have seen this sentiment used non-sarcastically. what a time to be alive.

vengefulduck 9y ago

Non-paywalled link: https://webcache.googleusercontent.com/search?q=cache:28gvJsnYhf4J:https://www.ft.com/content/b25e5c5e-3a34-11e7-821a-6027b8a20f23+&cd=4&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:28gvJs...

a_b_c_d 9y ago

True or false? Microsoft is a company that actively tries to prevent any comparisons of its products with other products, sometimes through threats of filing legal proceedings. True or false? Only government agencies are capabale of discovering flaws in Microsoft Windows. True or false? A closed source kernel is more secure than an open source kernel. (For the avoidance of doubt, here "open source" means open to public inspection free of charges, terms or conditions, such as various UNIX-like kernels. It also means the right to make changes, re-compile and re-distribute without charges.) True or false? This determination can be made without comparing the source code for both kernels. Hypothetical and questions: Product A has 5000-6000 new vulnerabilities per year, about 15 per day. Product B has 5-20 new vulnerabilities per year. Can we explain this difference by focusing on the parties who find the problems that require patching? Alternatively, should we focus instead on the products? What if Product A is more complex is than Product B? Does this make any difference? What if Product B can perform many of the same functions as Product A, particularly the functions that are most often used to exploit a vulnerability. For example handling data to be sent or recieved from the an untrustowrthy network such as the internet. In other words, networking with remote computers ("internet") as opposed to only networking with local computers ("IBM-compatible PC LAN"). Unlike BSD UNIX, Windows was originally designed for only local networking, where very little if any security is required. True or false? Windows still retains some of this original design and source code. That is a trick question because the Windows source code is not open source. How would anyone verify what is still in that source code? Keeping the source code from the eyes of its users does not protect them. It may be possible to reverse engineer Microsoft products or patches to learn how Windows works. "Good guys" may do this as well as "bad guys". A vulnerability could be discovered by someone who is not even old enough to work for a government. Repeat question: Should we focus on who finds flaws in Windows or should we focus on the Windows product itself?