16 ms·

A Cyberattack 'the World Isn’t Ready For'

• harshaw 9y ago
  So, in summary. The NSA hordes zero day (not sure if just windows), builds some scary tools to exploit these, and of course doesn't let MS know about them, because zero days are incredibly valuable to the spooks. And because perfect security is impossible these tools get out. Perhaps this was obvious from the WannaCry episode, but this article really hammered it home for me. Why people run any systems on windows is beyond me (not that others are more secure, but windows is a bigger target)
  • dota_fanatic 9y ago
    > Why people run any systems on windows is beyond me games
    • astebbin 9y ago
      Same here. I have a Windows PC which I use only for games and media processing. Steam for Mac isn't bad, but the vast preponderance of popular new (and old) games remain Windows exclusives.
    • ElijahLynn 9y ago
      Not the case in enterprise ;)
      • jjoonathan 9y ago
        > games > Not the case in enterprise ;) tools
        • olewhalehunter 9y ago
          >tools that's a funny way of spelling "subsidies"
          • nickpsecurity 9y ago
            More like tools + a ransom with I.P. laws.
  • pixl97 9y ago
    Routers sound like the bigger target to me. Take over the NAT/Firewall and you can use it to exploit every machine behind it.
    • flukus 9y ago
      Which is why everyone should still be running a firewall on their machines and stop relying completely on the router. It seems way to many people (and companies) rely on a single point of defense. This is especially true of any machines that may be connecting to public networks and home networks where you might let you're friends use wifi.
  • jgrahamc 9y ago
    > Why people run any systems on windows is beyond me I'm guessing you've never been near a large company that has a large investment in Windows and applications that run on Windows.
  • hobs 9y ago
    This isnt a really good reason to not run windows, they have similar 0days for any nix system as well.
    • rsync 9y ago
      Do they ? I have watched very closely for 20 years now for any chatter or evidence of a FreeBSD/OpenBSD zero-day vuln that was weaponized or sold or used for state-sponsored covert action and I am not aware of any. None of the leaked information from Snowden, et. al, gave any evidence of their existence either. Technically speaking they should exist but I'm not seeing them ...
      • jve 9y ago
        Here you are: https://vuxml.freebsd.org/freebsd/6f4d96c0-4062-11e7-b291-b499baebfeaf.html https://vuxml.freebsd.org/freebsd/6f4d96c0-4062-11e7-b291-b4... aka SambaCry
        • rsync 9y ago
          That's a samba vuln, not a FreeBSD vuln in particular ... Further, if you were worried about attackers or hardening a system, etc., you wouldn't be running samba (or anything like it). I'm talking about a remote-root vuln in the FreeBSD kernel or in any of the default system daemons that were bundled with an OS release (like openssh, crond, syslogd, etc.)
          • throwaway91111 9y ago
            In all honesty, there are probably both zero days for both BSDs (the software was written by humans after all) and great reasons to prefer them that don't involve this argument. I'd finger the "security ethos" of OpenBSD in particular.
      • dajt 9y ago
        Because the NSA is keeping those secret so they can still use them. All these recent 'leaks' are just misdirection so when OpenBSD becomes the defacto standard PC OS they still have a way in ;)
  • josu 9y ago
    >Why people run any systems on windows is beyond me Windows gets hacked because it is the most used desktop OS. If everybody started using Linux, it would get hacked as often as Windows. Quoting your comment again: >because perfect security is impossible
    • pharrington 9y ago
      When I worked at a web hosting company, it certainly felt like Linux got hacked as much as Windows.
    • runeks 9y ago
      The solution is not that everyone on Windows switch to Linux, just that some of them do. You said it right there: Linux is more secure, right now, not because it has fewer holes in it but because the incentive to find those holes is much less than with Windows. Seems like a good enough reason to switch for me, just don't expect it to last forever.
      • jl6 9y ago
        Farmers have known for centuries that diversification increases security, for a small cost in efficiency.
        • donmatito 9y ago
          And THAT is my main objection to GMO / seed standardization
  • msisk6 9y ago
    Like it or not, pretty much all enterprises run on Windows software. Not just desktop, either. Active directory and Exchange are pretty much the standard for all enterprises. And non-techies in these places couldn't live without Office. I once got an email with an attached Word document that contained an embedded Excel spreadsheet with exactly two cells -- an IP address and a hostname -- for a DNS entry I needed to update.
    • Something1234 9y ago
      That seems impressively competent for your average office user being able to embed a spreadsheet. What was wrong with them?
      • bmon 9y ago
        I think you can just copy and paste cells from Excel into word
    • JdeBP 9y ago
      As the Four Yorkshiremen would say: Luxury! At least you could copy and paste. In some work environments, you would have been sent a JPG screenshot of the IP address and name. Now enjoy the discussion of images in mail messages in https://news.ycombinator.com/item?id=14567074 https://news.ycombinator.com/item?id=14567074 (-:
  • soundwave106 9y ago
    Honestly, when it comes to cyberattacks, I think the truly worst area right now is "Internet of Things" devices and similar Internet connected devices like point of sales. At least Windows (and other computer OSes) have slowly become more secure over the last 20+ years. As far as I know, all the major OS players are very good at patching discovered exploits quickly. Malware spread by social engineering (eg tricking someone to execute malicious code) is the most common way things are spread these days. Many IoT companies, in contrast, have root-level exploits that are laughably trivial to hack, and some don't seem to care that much at all when exploits are discovered (https://www.trustwave.com/Resources/SpiderLabs-Blog/Undocumented-Backdoor-Account-in-DBLTek-GoIP/ https://www.trustwave.com/Resources/SpiderLabs-Blog/Undocume...). Windows is imperfect I'm sure, but I'd rather connect a Windows machine to the public network than any so-called "smart" appliance at this point.
• throwaway91111 9y ago
  Technical details of DoublePulsar here: https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html?m=1 https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial...
• nulagrithom 9y ago
  I feel silly saying this, but I sometimes imagine a scenario in which the attackers are not motivated by money but instead are aiming to simply cause as much destruction as possible, like some kind of "cyberterrorism". Imagine if the creators of WannaCry had decided to brick everything they could, instead of _just_ holding data for ransom. What then? Ben-Oni (from the article) says he sees it as "life-and-death". I agree. We're simply not prepared for a well-coordinated attack. I think it will take a true catastrophe before anyone really understands just how vulnerable the Internet is.
  • paradite 9y ago
    So it's like building weapons of mass destruction without being noticed? Sounds really bad.
  • blitmap 9y ago
    I'm imagining a future where systems have become so complex it's impossible to isolate and deactivate a worm. Malware that may not be effective anymore, but persists on the Internet hopping from unmaintained system to unmaintained system forever. https://www.youtube.com/watch?v=jSospSmAGL4 https://www.youtube.com/watch?v=jSospSmAGL4
    • ams6110 9y ago
      Malware does that now. There are enough unpatched/vulnerable systems on the internet at any given time that nothing is ever really eradicated.
    • eob 9y ago
      When alien archeologists study the third rock from Sol, they will find no life save for IRC C&C bots chattering back and forth. Feels like the end to an interesting sci-fi novel.
      • DonHopkins 9y ago
        That would be Stanislaw Lem's most depressing but aptly named masterpiece, "Fiasco". https://en.wikipedia.org/wiki/Fiasco_(novel) https://en.wikipedia.org/wiki/Fiasco_(novel) http://garethrees.org/2012/05/31/fiasco/ http://garethrees.org/2012/05/31/fiasco/ 2. Radio static A radiolocation map of the planet showed hundreds of transmitters of white noise, which merged into shapeless blotches. Quinta was emitting noise on all wavelengths. In the Cold War theory: “What came to mind was an image of “radio warfare” taken to the point of absurdity, where no one any longer transmitted anything, because each side drowned out the other… All bands of radio waves were jammed. The entire capacity of the channels of transmission was filled with noise. In a fairly short period of time the race became a contest between the forces of jamming and the forces of intelligence-gathering and command-signaling. But this escalation, too, penetrating the noise with stronger signals and in turn jamming the signals with stronger noise, resulted in an impasse.” Other hypotheses considered: “The noise was either the scrambling of broadcast signals or a kind of coded communication concealed by the semblance of chaos.” [It’s a consequence of the Shannon–Hartley theorem that the maximum information is transferred on a channel in the form of white noise.]
• pavement 9y ago
  There's something about Windows exploits that just feels like a canned hunt by now. With stuxnet, there developed the sense that Windows received conspicuous attention from a special class of mysterious operators. At this point, given the tiny cottage industry that feeds a handful of starving security analysts, I feel it's reasonable to presume that Windows is built to be a secure as possible, and that what's possible is mostly intentional and understood as a known quantity for special populations.
  • deleted 9y ago
    [deleted]
  • topranks 9y ago
    There will always be flaws in software systems, it's inevitable. You're basically saying Microsoft have perfected security to the point the can't overlook something or make a mistake with something????
    • pavement 9y ago
      I am not saying the thing you added four question marks onto.
  • jdc0589 9y ago
    > given the tiny cottage industry that feeds a handful of starving security analysts you may not have enough information.
    • pavement 9y ago
      I'd almost rather not know.
• willstrafach 9y ago
  This is certainly a serious issue, but a few aspects of this article are very strange. > Worse, the assault, which has never been reported before, was not spotted by some of the nation’s leading cybersecurity products, the top security engineers at its biggest tech companies, government intelligence analysts or the F.B.I., which remains consumed with the WannaCry attack. > “The world is burning about WannaCry, but this is a nuclear bomb compared to WannaCry,” Mr. Ben-Oni said. “This is different. It’s a lot worse. It steals credentials. You can’t catch it, and it’s happening right under our noses.” This attack and WannaCry use the same exploitation vector (EternalBlue). It seems that his company was targeted with a custom payload, which is definitely unfortunate, but that is not related to the exploit itself, it is just another form of custom code being used to perform further actions (Instead of simply encrypting files as WannaCry was doing). This is probably even easier for an attacker since there is now even a Metasploit module for MS17-010. > The attack on IDT went a step further with another stolen N.S.A. cyberweapon, called DoublePulsar. The N.S.A. used DoublePulsar to penetrate computer systems without tripping security alarms. It allowed N.S.A. spies to inject their tools into the nerve center of a target’s computer system, called the kernel, which manages communications between a computer’s hardware and its software. This is not a "step further" though. DoublePulsar is the implant injected EternalBlue and was certainly used in WannaCry. I am not sure why they had not even taken the time to try to verify this, even the WannaCry Wikipedia page states this (https://en.wikipedia.org/wiki/WannaCry_ransomware_attack https://en.wikipedia.org/wiki/WannaCry_ransomware_attack). Again, this is the same exploitation vector and same implant, but with a modified payload to specifically target IDT it seems. > For his part, Mr. Ben-Oni said he had rolled out Microsoft’s patches as soon as they became available, but attackers still managed to get in through the IDT contractor’s home modem. This tells me: 1. Even though machines internally were patched, a contractor was allowed to connect to the network with an unpatched machine. 2. If machines were internally patched, how would an infected contractor be able to do damage? I am not clear on this. They might be saying the network itself was not attacked, but rather the attacker was able to login with the legitimate employee's credentials and cause damage that way (In which case, something is very wrong internally if this was possible). I know it is not nice to victim-shame regarding security issues, and I am trying not to do so, but it seems like the story here is phrased in a slightly disingenuous manner. It is essentially this: An IDT contractor with an unpatched machine and privileged network access was targeted using EternalBlue to steal their credentials with a custom payload. It worked. After this, it is unclear if the stated network intrusion occurred because EternalBlue spread (Would not make sense if patched) or the contractor credentials were used "legitimately" (Indicates poor access control and monitoring).
• RachelF 9y ago
  After nuclear weapons were first invented, the big powers spent a lot of effort in non-proliferation, to stop smaller countries building them. Cyber weapons are not as dangerous as nukes, but much easier to copy, and much harder to know who attacked you. The NSA/CIA has been very lax in allowing their weapons to be copied.
  • ocschwar 9y ago
    Cyber weapons mean that during a crisis, nuclear militaries have to consider whether their chain of command has been compromised. WHich means they are, in fact, as dangerous as nukes.
    • flukus 9y ago
      Only if cyber weapons are built to target the military. I'd wager they're built to wage economic warfare rather than any military role, the corporate/commercial world is a much softer target. Imagine doing the economic/industrial damage of carpet bombing cities but without firing a shot.
    • nickpsecurity 9y ago
      Launching a pile of nukes can kill tens to hundreds of millions of people. People have been launching cyberweapons since they were invented with death toll low enough that folks still reference THERAC in software deaths. Don't play: the two are barely comparable in how many they kill.
      • deleted 9y ago
        [deleted]
      • mopierotti 9y ago
        I think the point was that cyber weapons are effectively as dangerous as nukes because they could cause nukes to be launched.
        • nickpsecurity 9y ago
• WalterBright 9y ago
  The attack surface could be greatly reduced by putting a lot of code in ROMs (Read Only Memory) where it won't survive a reboot.
  • themodelplumber 9y ago
    That's an interesting idea. Has this been tried before, for this kind of network security purpose?
    • WalterBright 9y ago
      Not that I know of. I suggest it every time the subject comes up of hardening internet connected devices. Nobody has ever replied with an instance of it. Back in the 80's, most devices used ROMs, PROMs or EPROMS. ROMs were burned at the factory. PROMs could be user programmed once. EPROMs were erasable and reprogrammable, if you put the chip under a UV lamp. As far I can tell, this is a forgotten technology. Later on came EEPROMS, electrically erasable programmable read only memory. Then someone had the bright (!) idea of connecting the write-enable line to the internet so anybody in the world could update anybody else's firmware, and welcome to the hell we have today.
      • aidenn0 9y ago
        Here's my 30 second analysis Option A) What we have now Option B) Code in PROM with physical interlock (e.g. push button to enable write) Option C) Code in ROM Downsides of A are obvious, we see them now. Downside of B is that automatic updates are impossible, so the majority of devices that are network connected will remain vulnerable. At the peak of code red, it took less than 5 minutes for a fresh windows install to be compromised. You also will have people who will forget to disable the network before pushing the button, or who may be tricked into pushing the button which will allow malicious code to persist anyways. C) Absent a hardware recall, people will just use devices that are infected within 5 minutes of bootup.
        • WalterBright 9y ago
• zyxzevn 9y ago
  So we are investing dollars in NSA so they make tools that bring us damage? I think there should be a limit on how long they can keep their "secrets". Snowden already showed that information can go outside, so any information will be leaked at some time. The society has much more to win when the software defects are repaired instead of used for hacking. I think that all these NSA problems show bad management. They should be reorganized, or maybe even abandoned. They cost more than they deliver, and even costed us our privacy. Probably they are still breaking US and international laws on that. Breaking up NSA can allow the FBI and (open) security companies to take over the cybersecurity. I suspect that we will soon have leaks of CIA tools too. But thanks to wikileaks companies can prepare for these future problems. We can go deeper into who got these tools and who is using them. Some may even argue that the CIA leaked the NSA tools to weaken the NSA. Or worse, that some in the NSA want to create cyber chaos to push for more control over the internet in the future. The article mentions the popular political scapegoats, and as usual this is just speculation. To solve NSA's problem we have to request very concrete evidence, otherwise we are just being played with. Article: > The Shadow Brokers resurfaced last month, promising a fresh load of N.S.A. attack tools, even offering to supply them for monthly paying subscribers — like a wine-of-the-month club for cyberweapon enthusiasts. This shows how we are being played with. The NSA could already have published the security details of all leaked tools, so we could all have protected our computer systems. We could have prevented Wannacry.
  • SomeStupidPoint 9y ago
    The NSA did contact the appropriate vendor in time to patch WannaCry. People didn't (or couldn't) update their systems with the appropriate patch.
  • wybiral 9y ago
    > Some may even argue that the CIA leaked the NSA tools to weaken the NSA. Or worse, that some in the NSA want to create cyber chaos to push for more control over the internet in the future. Some may argue a lot of things that may or may not be true. This will probably always be an issue so long as there are classified operations... Everyone who isn't privy will have their own interpretation of what really happened.
  • 9y ago
• cube00 9y ago
  “I don’t pursue every attacker, just the ones that piss me off,” Why paint a target on your back saying things like this?
  • jacobolus 9y ago
    > By Mr. Ben-Oni’s estimate, IDT experiences hundreds of attacks a day on its businesses, but perhaps only four each year that give him pause. There’s not enough time to pursue hundreds of new attackers every day, most of whom are not competent enough to be a serious threat. Presumably a big part of Ben-Oni’s job is to figure out which attackers can safely be ignored and which ones he needs to worry about tracking down.
• 6stringmerc 9y ago
  What's the real math, a full-scope attack might do what, cripple 30% of the Modernized World at any given time? Maybe for a week? Shit, y'all need to catch up on nature a little bit. Sometimes a forest fire burning things to the ground inspires new, stronger life and recovery. Also, if you think I'm being a dick, I'm paraphrasing Tim Berners Lee about his views on the modern Internet.
  • tomek_zemla 9y ago
    That would be nice, but the sad reality is that most likely a lot of people would die during this 'catching up on nature' time...
    • glial 9y ago
      Messing up the global food supply chain would be no joke.
• microcolonel 9y ago
  > In the pecking order of a computer system, the kernel is at the very top, allowing anyone with secret access to it to take full control of a machine. It is also a dangerous blind spot for most security software, allowing attackers to do what they want and go unnoticed. Why do journalists even try to explain things like this? Do they ever get it right? Does it ever not just go over people's heads?
• bradknowles 9y ago
  Got a non-paywall link?
  • dredmorbius 9y ago
    Outline.com or archive.is
• exabrial 9y ago
  Aka 'Live free or Die Hard'. Saw it. Bruce Willis runs out of bullets and shoots a helicopter down with a car
  • ozzmotik 9y ago
    why can't i just up vote this a million times
• droopybuns 9y ago
  Most companies hiring and empowering decent security people would have avoided this bullshit, due to all the twitter signaling. Noobs: follow @hackerfantastic
• rjblackman 9y ago
  I am quite surprised no one has used an exploit for rompager yet and used to it take down most of the internet.
• rqmedes 9y ago
  Critical infrastructure, Economic stability, nation states preparing/probing for war/advantage?
• BatFastard 9y ago
  Give the NSA a break, they handle more secrets than I can imagine. And at least they managed to hold onto the Russian Golden Shower video! Suggesting that the USA get rid of the NSA is like saying "Crap, terrorists got a hold of a nuclear weapon, lets unilaterally get rid of all of our weapons and hope for the best!"
  • Sniffnoy 9y ago
    But rather than "NSA" or "no NSA", there's another alternative: Defense-only NSA (or at least, defense-heavy NSA, where the vulnerabilities equities process has been altered to heavily favor disclosure). Instead of unilateral disarmament, disarming ourselves while also forcibly disarming others.
    • BatFastard 9y ago
      While I like that idea from it being the "right" thing to do. I can see why they don't want to give up every exploit as soon as it is found.
  • tracker1 9y ago
    More like, "Crap, the terrorists just got a working copy of our nuclear arsenal!" Digitally speaking being a much closer comparison. The fact is, had the NSA been responsibly disclosing these details (maybe a 15-30 day hold before a private disclosure then after another 30 days public discloser) That gives them 30 days to use 0-day exploits, but can still be effective contributors to greater overall security.
    • BatFastard 9y ago
      Good points. But its a fine line on how to deal with leaks 0 day exploits. We can't cripple the NSA, other wise we are bring a wet noodle to a knife fight.
      • tracker1 9y ago
        I just mentioned they should be able to hold onto 0-day discoveries for 15-30 days before confidential disclosure. Terrorists WILL do a lot of damage (as demonstrated) with these exploits... the NSA might ... the world, and in particular US interests are far better served with secure systems all around.
• natch 9y ago
  Now that they lost control of their napalm bombs which are now burning innocent targets, where is the NSA? A little bit of taking responsibility please? They could at least lead the charge to get this stuff dealt with now.
• King-Aaron 9y ago
  So does everyone here just subscribe to the NYTimes, or am I missing something when it comes to all these paywalled articles (other than, you know, missing the article itself?)
  • thirdsun 9y ago
    If you don't see the article it means that you probably already read 10 other NYTimes articles this month at which point they require a subscription.
    • King-Aaron 9y ago
      Yeah I do realise that - however so many NYT links appear in ycomb every day, it doesn't take much to hit that limit, especially since I launch articles through that 'Panda' chrome extension, so you don't really get much chance to screen the links other than the small link preview in the bottom left. I was wondering if people go through an alternative site/app to serve the articles - bypassing the paywall - or if everyones just in the same boat as me? Some other forums I'm with tend to make note of a paywalled link.
      • ekips2 9y ago
        If you're consuming that much of their content, maybe it's something you should pay for?
      • tim333 9y ago
        You can always delete the nytimes.com cookies or use another browser.
• matt_wulfeck 9y ago
  > Finally, before they left, they encrypted her computer with ransomware, demanding $130 to unlock it, to cover up the more invasive attack on her computer. Anyone having hard time swallowing this? They broke in and were totally undetected when they planted a... rootkit (unclear from article). While undetected they silently stole user credentials... Then to cover it all up, they ransomware'd the computer? It's like breaking into a house and putting a bug in the wall, and then to cover the tracks you smash in the front door and leave the water running in the sink. If the attacker was completely undetected, why intentionally jeopardize that?
  • tallanvor 9y ago
    Why is it hard to swallow? Really it's a classic magician's trick - misdirection. Think of it this way: if you are responsible for security, you never assume that you're fully protected. If you're a smart hacker, it should be the same thing: you never assume that you won't be detected.
  • Quarrelsome 9y ago
    No it makes perfect sense. If you want to land an advanced persistent threat but your entry is detectable a distraction is ALWAYS a great psychological tool. The very best and long lasting victories are made when you convince the loser that they've won. So the premise is that they clear the ransomware and think its over. But its not.
    • stedaniels 9y ago
      And the standard way to clear the ransomware is to re-image the machine and restore from backups. So the infection has to be hidden above the operating system level. BIOS/SSD/HDD firmware etc. Unless of course you don't provision machines, or keep backups. In which case hiding on a machine being "cleaned" would be simples.
      • SCHiM 9y ago
        If you capture user credentials it doesn't really matter because you can just come back a month later. Especially if they had domain admin access and created a golden ticket. Also if you infect a user as opposed to a machine your infection will be back the moment the user logs in.
• _ao789 9y ago
  tldr; someone got hold of NSA a pen-tool and is slowly getting it setup for a big global attack of sorts. And a whole long life story of some other dude..
• qb45 9y ago
  > he would not stop until the attacks had been shut down and those responsible were behind bars. That's cute. I wonder if he means Microsoft, people who use Microsoft products in safety-critical systems or maybe some nuke-capable nation state hiding behind tor, VPN, custom IoT botnet, another layer of tor and another VPN?
• cryptomonger 9y ago
  http://tessellation.herokuapp.com/news/2017/06/22/couple-used-a-common-tool-to-steal-electricity-from-power-lines-to-mine-ethers.html http://tessellation.herokuapp.com/news/2017/06/22/couple-use...
• cryptomonger 9y ago
  http://tessellation.herokuapp.com/news/2017/06/22/couple-used-a-common-tool-to-steal-electricity-from-power-lines-to-mine-ethereum.html http://tessellation.herokuapp.com/news/2017/06/22/couple-use...
• deno 9y ago
  I suspect this “cyberweapon” nomenclature will have serious consequences, if it becomes popular. This is like the reverse of the usual PC language softening, e.g. to murder is to “neutralize,” etc. Why is NYT using this term? It’s been invented by NSA to redirect defense funding towards their mass surveillance activity. Shouldn’t journalists point out things like that?
  • mi100hael 9y ago
    NYT? Journalists? hah!
• mi100hael 9y ago
  > Metasploit, an automated hacking tool, now allows anyone to carry out these NSA attacks with the click of a button. What a time to be alive
  • Kostic 9y ago
    Actually, that's good. Now that anyone can with ease exploit unmaintained systems, people will need to start caring about security.
• conn01 9y ago
  The root cause is that the more convenience the more danger. cyberattack can be easily overcome using the steps below: 1) DON'T connect your computer to the internet physically 2) if you want to use the internet, use another pc which has no credential data 3) for bank/shop online,etc. we should use a dedicate device which couldn't be reprogrammed. To sacrifice a little convenience for the safe. That is it.
  • jdc0589 9y ago
    what purpose would an airgap'd computer even serve for 99% of people?
• philanthropist 9y ago
  So from the article, it sounds like DoublePulsar is already patched, but due to computers lacking the patch, it still got in. Have I got that right? Also, what is the attack vector here? Because if, like wannacry, it was an email, then surely the defence is the same as before, be careful what you download?
• Swannie 9y ago
  His attack came on the 29th April - yet there were Snort signatures on the 21st April (42329, 42332, 42340) for DoublePulsar, and before that 14 March (41978) for one of the vulnerabilities. Despite his much lauded protection, I find it odd to believe that he's not running Snort, and the lack of actual specifics make me believe this is really a piece for the mentioned Israeli security company with a "blackbox" IDS.