Slashdot Mirror
NSA-Leaking Shadow Brokers Just Dumped Its Most Damaging Release Yet (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: The Shadow Brokers -- the mysterious person or group that over the past eight months has leaked a gigabyte worth of the National Security Agency's weaponized software exploits -- just published its most significant release yet. Friday's dump contains potent exploits and hacking tools that target most versions of Microsoft Windows and evidence of sophisticated hacks on the SWIFT banking system of several banks across the world. Friday's release -- which came as much of the computing world was planning a long weekend to observe the Easter holiday -- contains close to 300 megabytes of materials the leakers said were stolen from the NSA. The contents (a convenient overview is here) included compiled binaries for exploits that targeted vulnerabilities in a long line of Windows operating systems, including Windows 8 and Windows 2012. It also included a framework dubbed Fuzzbunch, a tool that resembles the Metasploit hacking framework that loads the binaries into targeted networks. Independent security experts who reviewed the contents said it was without question the most damaging Shadow Brokers release to date. One of the Windows zero-days flagged by Hickey is dubbed Eternalblue. It exploits a remote code-execution bug in the latest version of Windows 2008 R2 using the server message block and NetBT protocols. Another hacking tool known as Eternalromance contains an easy-to-use interface and "slick" code. Hickey said it exploits Windows systems over TCP ports 445 and 139. The exact cause of the bug is still being identified. Friday's release contains several tools with the word "eternal" in their name that exploit previously unknown flaws in Windows desktops and servers.
Diarrhea!
The NSA has done nothing wrong. It's their duty to protect the United States by spying on threats to national security. Whoever is leaking this information needs to be on the receiving end of a drone strike.
Are they rigging banking computer systems around the world in order to discretely steal money? What is the exact purpose?
I use Windows 10. The safest OS every made. Unbreakable.
The Shadow Brokers advertised the names of these exploits in January. The NSA had 3 months to warn Microsoft. But nope. Enjoy the 0day shitstorm that's about to drop.
And all the other nations are using the same exploits to spy on americans. Deal with that dumbass.
Eventually, right?
Preventing companies from repairing exploitable flaws in major software products is NOT something they should be doing.
Humor from a Genetically Molested Mind
Wow, this code is really old. Almost 10 years old. You can tell by the excessive use of XML.
Exists on W10 unless turned off in Enterprise. Sure they may have patched the hole in question... It's Netbios though.
It's their duty to protect their own goddam security and all Americans.
Given that they know millions of Americans are at risk from exploits they have not reported to the vendors, by your logic, the NSA is a traitor organization and qualifies for a drone strike.
It little behooves the best of us to comment on the rest of us.
"This would make a lot of sense that the NSA compromise this specific SWIFT Service Bureau for Anti-money laundering (AML) reasons in order to retrieve ties with terrorists groups," Suiche wrote.
Sitting on a zero-day vulnerability without telling the maintainers certainly makes the USA less secure and runs afoul of their duty to protect the USA...
...But have they actually prevented a company from fixing exploits? Like a court order telling Microsoft to leave a vulnerability in place?
Anybody else wonder if Microsoft is cooperating with the NSA? Seems like there are a lot of security issues and I wonder why MS hasn't seemed to be able to find them and why the NSA has.
I wonder how many of this "unknown bugs" used by "slick code" where put there on purpose in windows and how much is actual bugs.
And if they don't turn out to be US citizens leaking it, what then? Try to DRM their ass?
I'm glad I use Linux and not have to worry about these exploits and zero day attacks.
The other submission, which mods ignored, contained a better list of the exploits: https://www.bleepingcomputer.c...
And why a certain foreign agent went to Korea a while back.
-- Tigger warning: This post may contain tiggers! --
C'mon, if you're going to hold yourself out as a professional propagandist, at least put in the effort to get your possessive pronoun number agreement correct.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Very interesting dump. From the notes you can see that they completely hacked and downloaded the Oracle databases of SWIFT operators. They use university computers to triangulate. The hacking program into universities that was disclosed a few weeks ago was for having access to unsecured university servers from where to hack higher value targets.
That sounds about right.
On the Oregon Cost born and raised, On the beach is where I spent most of my days
I would say no, but there exist courts whose every detail is secret, and deal with these matters.
So, who knows.
> Much of the code was written when these machines were only networked if the company had a Novell network (yeah, yeah, both of you who ran LANMan can pipe down) and security wasn't even on the RADAR.
Indeed. Historically, it was DISK Operating System (DOS) on a PERSONAL Computer (PC) as opposed to the then-traditional NETWORK operating system on a time-sharing computer (which cost over $100,000). The point of DOS, the difference between Microsoft and what was already common place, was that the Microsoft OS was for cheap little computers used by one person, and not connected to a big corporate network. Instead of requiring many MBs of RAM, DOS could run in as little as 16KB pf RAM by getting rid of all the stuff that wasn't needed on a PERSONAL, DISK-based computer - stuff like security, stuff like isolating the files and processes of one user from the rest of the system.
This was a great idea. It worked brilliantly. Then the internet happened. Microsoft had a shit fit. Not only was their entire company based on PCs rather than the client-server model, but they had just spent millions upgrading Object Linking and Embedding (OLE), and named the new version COM. It was really cool - it let you do things like embed a picture in a Word document, or link a sound file from a picture. It was awesome. Then the web showed up with "img src" and "a href". Oh shit!
Microsoft did exactly the right thing, making an OS for personal, home computers, which weren't on a network and therefore any security was unnecessary overhead that they removed. Then the sudden popularity of the web screwed them and they had to play catch-up for 15 years.
Unfortunately, the NSA and CIA have completely failed in their "jobs". They have not prevented anything or protected a single American, but they do continue to create some odd justification for their jobs. Same can be said for the DEA. The "war" on drugs is not a war, but an income stream for the Drug Enhancement Agency who has no real intention of shutting down drug trafficking.
By keeping these exploits from being patched they are actually harming more Americans than doing good. Just keeping their jobs going, not protecting one single American. Good job people another huge government fail.
I think I'd prefer if the NSA *could* see those bank transactions. I'm not a fan of privacy in banking. If you want to do a transaction privately, that's what cash (and maybe cryptocurrency, that genie's out of the bottle) is for. Any privacy beyond that only provides enhanced convenience to criminals IMO. I'd prefer if all bank transactions were visible to law enforcement and tax authorities.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Yeah, hacks that only work against banks is totally what I need my tax dollars to go towards.
Oh, they aren't killing banks? Then WTF?
Could these tools be responsible of the bangladesh swift fraud case?
The solution is the same. Un-bank.
Damnit 'Bama. You have one job.
Fucking KGB releases more shit into the wild to give them plausible deniability. Fuck I wish the fucking Russians would just make car parts instead of war toys.
No kidding. Besides, how often do you get to use "It's its" in a sentence?
(Score: -1, Stupid)
See subject: The way I setup my system isn't vulnerable to a SINGLE ATTACK there (mostly networking dependent's why) per my security guides I did LONG ago & was paid for (for STAND-ALONE systems that are non-networked) using the HIGHLY esteemed CIS Tool (who took fixes from me to their program too): https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&btnG=Google+Search&gbv=1/
* :)
(In other words? I've been SAFE FROM THEIR SHIT since, oh, around 1998!)
APK
P.S.=> That's what security patching, OS & IP stack tweaking + shutting off services you DO NOT NEED + yes HOSTS FILES USAGE not only speed you up but SECURE you better too (this goes for routers too, that can be done there also @ all those levels)... apk
Along with Intel Management Engine backdoor in place, what else can go wrong? You're pretty much fucked top down, bottom up and sideways.
It's not *just* a matter of money, but compatibilty was / is a huge issue and also user experience. It took ten years for Microsoft to slowly transition not only users, but all of their legacy software, away from essentially running as "root" (Administrator) all the time. Initially on Windows, any program run by any user was allowed to do anything and everything to the computer. Programs did in fact interact with the system, writing registry entries wherever they felt like, putting files in system directories, etc. You can't just suddenly prevent that out the blue - a large percentage of the existing software would stop working.
So Microsoft had to slowly transition away from that. Which put them behind, because before DOS, UNIX users were ALREADY accustomed to running as a non-root user. Most computer users before Microsoft didn't *have* root access - they had a terminal connected to a mainframe. They were accustomed to the idea that they ran their software within their private space, and the user software didn't need system-level access.
So first Microsoft added user login, which *hid* the icons that would link to other people's files. Any "power user" knew how to navigate to the C drive and then back up to any users' files. Slowly they changed the system to where now Windows 8 and Windows 10 have user security similar to what UNIX had in 1979.
In the meantime, UNIX, and more often these days Linux, have moved on from that security model (discretionary access control) to a newer, more secure model (mandatory access control). Microsoft has played around with adding a bit of DAC-like capability to Windows, but essentially nobody uses it and it's not at all complete and ready for prime time.
> The only reason systems like Linux were more secure (hard to say if they are overall now**) is they were part of the front line of attacks which meant a lot of the direct network facing stuff had to be patched ASAP
Remember iitially on Windows, any program run by any user was allowed to do anything and everything to the computer. Programs did in fact interact with the system, writing registry entries wherever they felt like, putting files in system directories, etc. You can't just suddenly prevent that out the blue - a large percentage of the existing software would stop working.
So Microsoft had to slowly transition away from that. Which put them behind, because before DOS, UNIX users were ALREADY accustomed to running as a non-root user. Most computer users before Microsoft didn't *have* root access - they had a terminal connected to a mainframe. They were accustomed to the idea that they ran their software within their private space, and the user software didn't need system-level access.
For quite some time, Windows users were essentially running their browsers as root - including Flash and Java. For some years after that, it *appeared* that they were running as some user, but under the hood there was no real security.
Linux comes from that Unix heritage, from the basic assumption that an individual user shouldn't be able to take down the system even if they tried.
Microsoft didn't have to do anything slowly. They have and have had enough capital to mobilize the economy to do just about whatever the hell they want, even if it was to build bridge out of rainbows and fairy dust to the moon. The simple fact is they foresaw the market for their privacy-raping backdoored crap software.
Once a company goes public, once it hits a certain threshold of market capitalisation, it starts working not for its 'customers' but for its investors. If the investors want to 'cannibalise' one holding as leverage to greatly increase the value of another holding, of course they will do so as long as they can get away with it.
Don't believe their cover stories, the corporations, military, government, and a great many NPOs are all one gang of thugs exploiting the vast majority of the population, robbing them of livelihood and potential to grow - robbing them of their humanity no less.
I love the smell of Russian butthurt and desperation in the morning!!
NT
I do believe President Truman is immune from drone strikes.
Yah. causality is a demon
you idiot, they are spying on innocent americans too. this is the early stages of a supranational surveillance system paid for by idiot whores like you.
Cutting funding that pays for bombs that go off in western cities, dumbass
Yes isn't it nice.
As a Pen Tester I must say thank you ShadowBrokers for the wonderful gifts. I also really enjoy writing in the reports that I hacked your network using taxpayer paid for tools.
Our tax dollars at work.
Well I did get a return on investment.
"... the critical vulnerabilities for four exploits previously believed to be zerodays were patched in March, exactly one month before a group called Shadow Brokers published Friday's latest installment of weapons-grade attacks."
https://arstechnica.com/securi...
No, it is not. The claim that the government "of the people" is also "for the people" is only partially true. Interests of strong social groups - large commercial corporations, the military and the intelligence bureaucracy - usually come before those of the masses.
If you stop thinking of the state as something that serves the people but as one of the meeting points of conflicting social interests things make more sense.
I agree, we should hit every one of their offices at the same time to minimize survivors, and while we're at it, hit the CIA at the same time.
All that money comes from the CIA.
NSA saw it coming and for each vulnerability designed a suggested Microsoft code change that would fix this vuln and open another that is very similar.
NSA makes new dual mode exploits that work for either new or old vulns and installs them in all the places they currently spy on.
NSA tells MS, here are the bugs and the here are the exact fixes we want.
NSA can still hack new PC's and still has access to all their currently hacked PC's.
The world patches to keep the script kiddies out, making the ShadowBroker tools useless except on XP and Vista (and earlier).
If NSA lost anything besides face, they are stupid, and they are not stupid. They are not even angry about this except that more than just the paranoid now know what they actually do.
Somebody should modify the hacks themselves to provide immunity from the unmodified hacks or hand patch the original code to remove the vulns (at least make it crash before permanent install).
The only question in my mind is what does MS do when a programmer finds a vuln the NSA uses? Make sure the vulnerable code is not accessible to review in the first place? Cover the programmer in delays and paperwork while the NSA makes another hack? Being in cahoots with the NSA makes MS very dirty in that they will not fix some known bugs. That alone is enough for me to be so repulsed by the ugliness that is MS, that I won't be using any of their products again.
Could it be the Romanian programmers are doing this with MS software so they can card everyone? HMMM
Yeah! Beat Auburn! Roll Tide!
Learning HOW to think is more important than learning WHAT to think.