8 ms·
Hacks Raise Fear Over N.S.A.’s Hold on Cyberweapons
- 45h34jh53k4j 9y agoWith the initial vector being some widely used Ukranian tax software, and the network vector as psexec/wmic mimikatz harvested credentials, the actual usage of 'NSA cyberweapons' was just a backup. I suspect this attack would have had a similar number of victims without EtBl/DoPu and EtRo. The existence of 'nation state' offensive tools has little baring on exploitability for poorly configured enterprise network, when most victims were exploited by open source offensive tools, even when patched.
- willstrafach 9y agoYou are correct regarding the most recent ransomware not actually needing EternalBlue and just adding it if needed (As proof of concept code is widely available for it). I think concerns include things like WannaCry too though, which did indeed rely primarily on use of EternalBlue.
- tomglynch 9y agoHopefully these issues will also put a stop to government's requesting software backdoor access.
- mtgx 9y agoFive Eyes are meeting this week to develop a backdoor plan...There should definitely be a big backlash against it, especially in light of recent events. Backdoors in US infrastructure = invitation to Russia and China to go right through it.
- apeace 9y agoThis is merely a taste of what is to come. When President Obama stated in December[0] that we will deliver a "proportional response" to Russian hacking at the "time and place of our own choosing", it seemed that most of the country was proud, almost gleeful at the thought that we would be striking back. I for one was mortified. We should not be escalating cyberwar, even if we do have proof of who attacked us. People are going to die. We can see from this article that hacking can cause serious real-world problems. When we strike back, does Russia then strike back again? What does it look like after four or five volleys? Will entire power grids be down for days or weeks? Will the stock market crash? It's time for the American people to demand that the N.S.A. become a defensive organization, not an offensive one. And it's time for us to demand peace in general. Cyberwar is war. [0] http://www.cnn.com/2016/12/15/politics/obama-russia-hacking-election/index.html http://www.cnn.com/2016/12/15/politics/obama-russia-hacking-...
- jameskegel 9y agoOh what a world we live in where cyberwarfare could result in death. I would have never thought, as a kid, that life (and death) would end up this "real".
- NumberCruncher 9y agoThe hacker Karl Koch [1] thought being responsible for the disaster at Chernobyl [2] back in 1986 causing 2M deaths in the last 30 years. I think we will never know whether he was right or not. [1] https://en.wikipedia.org/wiki/Karl_Koch_(hacker) https://en.wikipedia.org/wiki/Karl_Koch_(hacker) [2] (German) https://de.wikipedia.org/wiki/KGB-Hack https://de.wikipedia.org/wiki/KGB-Hack
- peterwaller 9y agoI'm confused what the connection is with Chernobyl. But 2M deaths in the last 30 years is not likely correct - this interesting WHO report on the matter suggests the final toll from the radiation would be more like "up to 4k": http://www.who.int/mediacentre/news/releases/2005/pr38/en/ http://www.who.int/mediacentre/news/releases/2005/pr38/en/ http://www.who.int/ionizing_radiation/chernobyl/chernobyl_digest_report_EN.pdf http://www.who.int/ionizing_radiation/chernobyl/chernobyl_di... > The main causes of death in the Chernobyl-affected region are the same as those nationwide — cardiovascular diseases, injuries and poisonings — rather than any radiation-related illnesses
- NumberCruncher 9y ago>> The main causes of death in the Chernobyl-affected region... The Chernobyl-affected region includes big parts of Western Europe. Back then in 1986 my godfather was cleaning trains coming from Russia through Ukraine (but not directly from the Chernobyl region) and was contaminated. He lost his teeth and hair. We lived ca. 800 km away from Chernobyl. On the other hand thanks the river Dnepr the Chernobyl region is connected to the Ukraine ground water system. The astimation of 2M deaths caused by long time effects of contamination comes from a friend from Kiew. She never drunk tap water.
- snarfy 9y agoIf history has told us anything, it's that this won't be fixed until we wake up one day and the majority of the computers in the world are bricked. Then the government will act. Not before.
- omginternets 9y agoPrediction: as this becomes more frequent, the only thing that will substantively change is the frequency at which newspapers report that fear is raised.
- Pigo 9y agoTwo questions 1. Why do they not simply take the weapons of a network? Maybe store it on some physical media, or a computer not networked unless it's time to take a Kim down a notch? 2. Are these "weapons" really that dastardly? Most of these common ransom-ware and viruses are easily avoided, and only succeed because of naive users. Backdoors aren't a weapon, they're there on purpose. Sniffing, spying, and logging can potentially cause some chaos. But are these really some kind of Zero-cool level hyrda's that they can sink oil-tankers with?
- naibafo 9y ago> Most of these common ransom-ware and viruses are easily avoided, and only succeed because of naive users. The problem is that the large majority of the users is naive.
- Pigo 9y agoSo you think this stockpile is mostly viruses/trojans that would target random users and hope it spreads to important systems, or hope there's important systems manned by naive people? These kind of exploits are everywhere, and I'd say the NSA is hardly the biggest threat in that arena.
- castis 9y agoIt's probably not a stockpile of viruses/trojans. It's more likely a list of exploits across different devices that give you various levels of access to do as you wish with. Some are probably nothing to worry about, some might be something that gives you the ability to get into the machine and encrypt whole sections.
- mysterydip 9y agoNot trying to claim whataboutism, but I think there's an elephant in the room. The end result of the NSA saying "ok, as of today we've completely disarmed our cyberweapon stockpile and released patches for all vulnerabilities to the appropriate software companies" wouldn't be the end of cyberattacks. It would just be someone else doing them. I don't know what the real solution is. Maybe there is none.
- wu-ikkyu 9y ago>wouldn't be the end of cyberattacks. This is a strawman. No one knowledgeable is saying it would create 100% security, just that it would be a net increase in the security of our infrastructure.
- mysterydip 9y agoThe sentiment I've seen from people is "if we can just stop the NSA from doing these, our problems will go away". What I'm saying is not to do nothing, but rather we need to have a plan for continued attacks (like how spam filters came into being) in addition to trying to get any and all vulns fixed.
- crasp 9y agoSomebody could have done that right now as well, but nobody did make them so far (or used them in any significant way that people know of). Instead of (ab)using somebody else's mistakes to your own advantage (and possibly have it backfire) you could also tell that person about their mistakes so the whole world could benefit and there would be 1 issue less in the world to worry about.
- mysterydip 9y agoPeople have, in the past. The problem is that we will never remove all 0days until we stop releasing software. That's not to say we shouldn't try (to Quarrelsome's point), but eventually the stockpile today will be obsoleted by the stockpile of tomorrow. And if nation states didn't have a pile, the seedy side of the internet would, alongside trading botnets, credit card lists, etc. My point being that while noble efforts, it won't go away and we need to figure out how to deal with it. Here's one reason such a stockpile could be used for good: say a previously unknown vuln is attacking "our" (whomever that is for you) infrastructure. The command and control has been traced back to a cluster that's vulnerable to one of the weapons in your stockpile. Now you can potentially disable it, stop it spreading, tell all of them to run an updated version of the code that essentially does nothing, etc. For all I know, this could have happened already.
- thrillgore 9y agoCyberwar hasn't necessarily led to the massive loss of life associated with nuclear or chemical weapons. Until that happens (or like with nuclear weapons, we can culturally show how much of a zero-sum game it is), ordinary people won't have an incentive to take action. Technically minded people may carry capital, but we're vastly outnumbered by the dwindling working class politically.
- Pigo 9y agoThe only way a nuclear system could be compromised is if there was some idiot surfing the internet on it, or if someone intricately familiar with the systems and network tailored an exploit to target it. If we have teams of people targeting specific systems like this, and just hovering over the execution button, then I'd say this is a huge problem. Nothing in this article really described the nature of the threat these weapons pose.
- crasp 9y ago> White House officials have deflected many questions, and responded to others by arguing that the focus should be on the attackers themselves, not the manufacturer of their weapons. Am i to understand that if somebody would manage to steal nuclear warheads and launch them we don't hold the people who failed to protect them responsible?
- strictnein 9y agoA nuclear weapon is a little different than a patched SMB exploit.
- d33 9y agoHow's that different in terms of responsibility?
- strictnein 9y agoOne kills millions.
- blitmap 9y agoSMB attacks can be used against medical facilities. I would reframe this as "both can kill".
- milkytron 9y agoI agree that's a bit of a stretch for a comparison. I think it would be closer to saying that the NSA found a key to a company's system, didn't inform the company, and then got the key stolen from them by criminals which then brought down the system. Obviously that's extremely simplified, but all parties here are at fault. And all we're seeing is a bunch of finger pointing, with not enough defensive and preventative action being taken.
- pizza 9y agoThe principle should be the same.
- fdanconia21 9y agoHow does one protect themselves, or loved ones? I feel this may come across as a silly question, but if escalation continues, I believe I won't be the only one asking this question.
- r721 9y agoFrequent offline backups, software updates, disabling software features you don't need.
- EGreg 9y agoTerrorism is a problem of technology.
- deleted 9y ago[deleted]
- throwasehasdwi 9y agoThis does NOT bode well for the future of humanity. It seems that war is only war when people on your side are dying. Once everything is sufficiently automated it will be possible to wage war without risking any of your humans. I don't want to know where that leads
- infimum 9y ago> Once everything is sufficiently automated it will be possible to wage war without risking any of your humans. i don't see how that could possibly work. just because people won't die directly from a weapon anymore doesn't mean they aren't negatively impacted in this hypothetical scenario. i'm thinking of attacks crippling key infrastructure which could lead to large scale supply shortages
- valine 9y agoI’ve never liked the term ‘cyberweapon’. It is subtly misleading and gives the non-technical masses misconceptions about how exploits actually work. Cyberweapon implies that exploits are created by governments and let loose on the world, when in reality exploits are existing flaws that were simply discovered by governments or individuals. Exploits are like a serious manufacturing defect in a lock that was only discovered after the fact. I think this misconception has real implications. If you compare exploits to Nuclear weapons, the public reaction will be we need more secrecy and more weapons to protect us from hostile nations. If however you changed the analogy to something like a defective lock, it become obvious that what we really need is openness so exploits can be fixed.
- horsawlarway 9y agoWhile I understand where you're coming from, and I agree with you to some extent, it's not really that simple. While the majority of exploits we currently see in the wild are things I think the "defective lock" analogy works well for, there's a subset of attacks that would be equivalent to cutting the lock with bolt cutters. In those cases, there are specially crafted tools that aren't exploiting a defective lock, they're destroying the basic premise that let the lock work. I'd say that RowHammer fits that description pretty aptly. It's a cyberweapon. It's not an exploit. It's so much of a weapon that (as far as I know, someone please correct me if I'm out of date!) there's still no known mitigation strategy that completely solves the problem. We have lots of partial mitigations, but nothing surefire yet. So... it's both. We certainly have lots of defective locks, but we also have some very nasty tools that exploit some fundamental premises of our tech in clearly malicious ways, and were absolutely designed and implemented to do exactly that.
- wybiral 9y agoIn this case we're talking about the recent NSA exploits leaked by Shadow Brokers and then utilized by WannaCry and the Petya attack. Both of those had a "weapon" (the ransomware itself) that spread by way of an exploit found by NSA (a defect in Windows that people failed to patch). In this case, I feel that blaming NSA for the exploit and calling those "cyberweapons" is wrong. The entity who put the ransomware on top of them and deployed them built a weapon.
- deleted 9y ago[deleted]
- microcolonel 9y agoFor what it's worth, NSA is not the only agency with a stockpile of 0days. I figure they should give 'em up only when everyone else does.
- alinspired 9y agoi'd speculate that nsa might be working on some hardware solution to secure their tools, ie purpose built chips/compilers
- flyweight 9y agoClosed source vs open source. Why are such exploits not so evident on mac, linux, bsd etc? Is it only because microsoft dominates the desktop market? Edward snowden clearly showed MS relation to the NSA. I do not believe at all such exploits are ${Discovered} by the NSA. But the exploits are backdoors that MS provides. That is why they are now blaming the NSA and putting on a marketing campain to show how much they care about everyone ${Security}. So what if this is the case? To me its pretty obvious who created this mess.
- Qub3d 9y agoFor all his quirks, RMS has made points in the past that I'm kicking myself for not taking seriously. I just wish that the FSF wasn't so tied up in minutiae -- it turns people off. It's a sad fact that the face of proprietary tech is that of a handsome young generic "disruptor", while Open Source / Free Software / Libre / GNU//blah is less-cheerful Steve Wozniak.
- r721 9y agoRelated thread by Rob Graham: https://twitter.com/ErrataRob/status/880536274913771521 https://twitter.com/ErrataRob/status/880536274913771521