9 ms·
This is even more proof how powerful a 0-day in the wrong hands can be. All of the affected companies' should be considered compromised by the NSA. Actually,
by jannes 9y ago
This is even more proof how powerful a 0-day in the wrong hands can be.
All of the affected companies' should be considered compromised by the NSA.
Actually, every single Windows PC with an internet connection that has been used before March 14 should be considered irrevocably compromised. Ransomware is much more visible than spyware. Think about all the spyware-infected PCs/networks that nobody knows about.
- rsync 9y ago"Actually, every single Windows PC with an internet connection that has been used before March 14 should be considered irrevocably compromised." March 14 of what year ? I would say 2000 but I am open to discussion ...
- spacemanmatt 9y agoI sent my first packet-of-death to an unprotected Windows machine in 1996, so...
- samstave 9y ago1997 here :-) hat was that XP xploit app from back then... I cant recall what it was called...
- colecut 9y agoback orifice? subseven?
- freeflight 9y agoSubseven was just a trojan, tho a really fancy one I had lots of fun with as a kid.
- samstave 9y agoBack orifice!
- rhizome 9y agoredbutton?
- KGIII 9y agoTo be clear XP wasn't available in 1997.
- jbergstroem 9y agoteardrop?
- spacemanmatt 9y agolandattack
- pferde 9y agoWinnuke? That was way before XP, though, I remember it crashed windows 95 and 98 first edition.
- dredmorbius 9y agoWinNT 4.0. https://en.m.wikipedia.org/wiki/Windows_NT_4.0 https://en.m.wikipedia.org/wiki/Windows_NT_4.0
- partisan 9y agoI used an IRC client called BootFucker Pro back then that had all of the weaponry built in. Those were the good old days.
- rhaps0dy 9y agoYou're implying that from March 14, 2000, Windows was very secure. I think you're getting this backwards. If you say 2017, you and your children-comments' dates will be covered, because they are before March 14 2017.
- kbenson 9y agoNo, the implication is that Windows prior to that was insecure. That does not mean it's secure afterwards, just that we know it was insecure previously. You are extrapolating without evidence.
- Whitestrake 9y agoI think it's more accurate to say that the comment is explicitly stating that Windows was insecure prior to that date, the implication from which is that it was not as insecure after (else why make the distinction of the date at all).
- kbenson 9y ago> the implication from which is that it was not as insecure after I'm saying there is no specific implication without confirmation from the author as the statement can be taken either way, and any you think you see is more to do with your state of mind than the statement itself. It's a statement about what we know. We know something to be factually true prior to that date. Afterwards is open to debate, and is opinion. Making a statement about that the period we have facts for does not imply anything about the period we do not have facts for.
- Whitestrake 9y agoI feel like you and I are not operating on the same definition of implication. In the above comment when using the word implication my intent was "a conclusion that can be drawn despite not being explicitly stated". To be unambiguous, the explicit statement is that computers prior to a specific date should be considered to be compromised. The conclusion that can be drawn, based on the fact that the writer specified that date, is that later dates did not qualify for the same statement, because the conditions were not sufficient. That is to say, that they were not insecure enough for the writer to include in his comment. That is the implication, despite the writer not saying outright that computers after that date were "secure". The conclusion assumes the credibility of the writer, and the intellectual honesty of their comment (i.e. they didn't put that date there just to be facetious) but I believe that's a fair assumption given the context of questioning the semantics. I also note that the actual implication here is not that computers are secure after that date, or even that computers are insecure but not compromised. The implication is, in fact, that while computers might be compromised after that date, the writer doesn't believe it's worth advising people to ASSUME they are compromised.
- 80211 9y agoPeople who don't run Windows shouldn't get cocky! There are many, many attacks on Linux: Here's one in the news from just last week. A ransomware where the victim agreed to pay the equivalent of US$1MM in bitcoin. https://arstechnica.com/security/2017/06/web-host-agrees-to-pay-1m-after-its-hit-by-linux-targeting-ransomware/ https://arstechnica.com/security/2017/06/web-host-agrees-to-...
- eeeeeeeeeeeee 9y agoSomething to keep in mind. They were running: Apache version 1.3.36 and PHP version 5.1.4 It's not like a brand new Ubuntu installation connected to the open Internet will suddenly be pwned. The owners of this company were beyond inept.
- astrodust 9y agoSeeing Apache 1 in the wild makes me a bit nostalgic. What kind of utter lunatic would use that for their company today?
- deleted 9y ago[deleted]
- H1Supreme 9y agoLord have mercy, Apache 1? That's what you get bro.
- duskwuff 9y agoAnd that was probably the tip of the iceberg with regard to their outdated software -- Apache 1.3.36 and PHP 5.1.4 are both from around 2006, so I'd bet everything else in their stack was similarly old. Failing to update anything for 10+ years will get you in trouble, regardless of what OS it's on.
- Piskvorrr 9y agoThat would be akin to running Windows XP. People running Anfient Monftrosities should not get cocky in general, attacks on old systems are only getting worse with time.
- pyre 9y ago> On Tuesday, March 14, 2017, Microsoft issued security bulletin MS17-010,[7] which detailed the flaw and announced that patches had been released for all Windows versions that were currently supported at that time https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue
- tr1ck5t3r 9y agoMono cultures always die out. You have 3 dominant loop based OS'es that run most of the World, do you see a problem yet?
- spiderfarmer 9y agoCall me paranoid but I consider even a clean, freshly installed and fully updated Windows PC already compromised by the NSA.
- mikegerwitz 9y agoIt's compromised by Microsoft, who would willingly (and would be required to) cooperate with the NSA upon request.
- revmoo 9y agoYep, forced updates + NSL = they don't need 0days anymore.
- willstrafach 9y agoThat would never happen. A network tap would be able to detect a malicious update even if the main PC was implanted very well, and a Microsoft-signed malicious update would be worldwide news. Please correct me if I am wrong, but I don't think there has ever been a single instance of this actually occurring, only "this could possibly happen" theories. I am definitely interested to hear more if this is not the case.
- freeflight 9y ago>a Microsoft-signed malicious update would be worldwide news https://twitter.com/craiu/status/879690795946827776 https://twitter.com/craiu/status/879690795946827776 >only "this could possibly happen" theories Pre-Snowden a lot of things had been considered "could possibly happen" tinfoil hat theories, turned out a lot of them had not been mere theories.
- willstrafach 9y ago> https://twitter.com/craiu/status/879690795946827776 https://twitter.com/craiu/status/879690795946827776 1. That screenshot clearly shows the certificate is being treated as not valid. I assume it is being shared for IOC purposes. 2. I am referring to a software update, in the context of revmoo's "forced updates + NSL" comment. > Pre-Snowden a lot of things had been considered "could possibly happen" tinfoil hat theories, turned out a lot of them had not been mere theories. I could believe that is the case for those outside of the information security community, but nothing novel/tinfoil-hat-worthy was in the leaks, just confirmations of predictable sources/methods used for intelligence gathering and CNE work. Forcing a company to issue a blessed update containing malicious code is very different, and again, I am very interested to hear of any proof of such a thing occurring without detection (It doesn't seem possible for that to happen without it being detected and being discussed very loudly).
- morley 9y agoMaybe I'm missing something, but is there any evidence that this is actually a 0day attack? I didn't study the last outbreak that closely, but it seemed like it was a vulnerability that had been patched, but affected computers that weren't patched. Maybe I'm wrong though. But 0days or no, there will always exist some number of computers that have not been properly kept up-to-date and thus will be vulnerable to security exploits even after they've been disclosed and patched.
- jannes 9y agoNo, it's probably not a 0-day this time. But this exploit used to be a NSA 0-day before it became public. Everything that's happening now is the "lite" version of what the NSA is capable of.
- idlewords 9y agoYeah, and the Department of Defense is capable of nuking major cities. And it's about as relevant to this discussion.
- aaronharder 9y agoEveryone would notice a nuclear attack. NSA exploiting vulnerabilities to their own ends, not so much.
- willstrafach 9y agoThis is absolutely detectable, and IDS signatures already exist for EternalBlue (Let alone the fact that it was patched by Microsoft in March).
- tarsinge 9y agoIt's relevant because it's like the nukes were stolen and that it will continue to happen
- 9y ago
- willstrafach 9y agoIt looks like this was not caused by a 0-day, it is apparently using EternalBlue as execution vector plus another (already fixed) vulnerability for lateral movement. More of a "100-day" at this point.
- 001spartan 9y agoIt also appears to be using common Windows lateral movement techniques based on credential stealing (namely WMI and PsExec), in addition to EternalBlue.
- Jaruzel 9y ago> All of the affected companies' should be considered compromised by the NSA. Which is ironic seeing as the ransomware, like WannaCry, is using the NSA supplied 'EternalBlue' exploit.
- tuxxy 9y agoReally? We're going to blame NSA for the companies leaving SMBv1 open to the public?
- lern_too_spel 9y agoThe article doesn't say that it's using a 0-day vulnerability, nor does it say the NSA is involved.