Microsoft Blasts Spy Agencies For Leaked Exploits Used By WanaDecrypt0r (engadget.com)

An anonymous reader shares Engadget's report about Microsoft's response to the massive WanaDecrypt0r ransomware attack: Company president Brad Smith has posted a response to the attack that roasts the NSA, CIA and other intelligence agencies for hogging security vulnerabilities instead of disclosing them to be fixed. There's an "emerging pattern" of these stockpiles leaking out, he says, and they cause "widespread damage" when that happens. He goes so far as to liken it to a physical weapons leak -- it's as if the US military had "some of its Tomahawk missiles stolen"... Microsoft had already floated the concept of a "Digital Geneva Convention" that required governments to report security holes, but the idea has gained a new sense of urgency in light of the recent ransomware chaos... While Microsoft makes its own efforts by rushing out patches and sharing concerns with other companies, it also chastises customers who could have closed the WannaCry hole two months earlier but didn't.
BrianFagioli shared a BetaNews article arguing Microsoft "should absolutely not shoulder any of the responsibility. After all, the vulnerability that led to the disaster was patched back in March." But troublemaker_23 notes that ITwire still faults Microsoft for not planning ahead, since in February 150 million people were still using Windows XP.

Comments

Enforcement is the problem

[JoshuaZ]

Any weapon ban treaty has a problem of detecting violations. If one cannot easily detect violations, one cannot enforce the treaty effectively. For pretty much every nuclear weapons treaty the biggest stumbling block has almost always been verification that people are adhering to it. At least there, there's infrastructure to look at. Trying to determine that governments aren't holding back tiny little files stored away somewhere would be much more difficult. In that context, such a treaty would be unlikely to succeed.

Re:Enforcement is the problem

[Anonymous Coward]

House rules:

- The guy with the gun always wins.
- Only the government gets to have guns.

The government only needs to hold up a flimsiest facade that they're "good people", and that's only to keep the house of cards that is the American economy from collapsing into a heap. We're all taught from the youngest age that Mr Policeman is good and you should go to him if you need help. Fast-forward 20 years and you start to understand why you shouldn't. We all need to stop pretending that the government is here for our interests; it isn't.

Re:Enforcement is the problem

[Kjella]

Nothing is going to make IS adhere to the real-world Geneva convention either. The point of such treaties aren't direct enforcement, they're to establish a standard for civilized warfare so that you can apply pressure to other nations to join, be able to chastise those who break it and give reasons to impose sanctions, intervene or join the opposing forces. Take for example the treaty on anti-personnel landmines, if you've promised to disarm it would be a pretty big scandal if you were secretly stockpiling and/or deploying them anyway. Assad kills people every day but start a chemical attack and he got a rather swift response.

If there was a treaty to disclose vulnerabilities in mass market consumer software (because face it they won't give up everything) then leaks like these would show that the US are lying sacks of shit whose words are worth nothing. Being a man of your words and having credibility are very real currencies in international politics. Breaking one treaty would put into question every other treaty the US has signed too. There's no real other force behind it than your own country's promise, there wouldn't be any other direct consequences than a loss of reputation. But that is usually sufficient to do some good, at least it puts a cost on violating it. Today the NSA can just shrug and say they're doing their job.

Re:Enforcement is the problem

[TheRaven64]

As with any law or convention, there's a balance between probability of detection and penalty. Nuclear weapons are an interesting one, because for a small country having nuclear weapons has often been the difference between being invaded by a superpower and not being. The worst-case penalty for not having nuclear weapons is an invasion, the penalty for having them is economic sanctions. There's therefore a big problem in enforcement. Heinlein's (fictional) Space Patrol was a non-national entity that had a monopoly on nuclear weapons and was empowered to enforce this monopoly by deploying nuclear weapons against anyone who violated it: in this situation there's no benefit to owning nuclear weapons, but creating this situation is very hard.

In terms of 'cyber weapons' (horrible term), the penalty for not owning them is much lower. You're unlikely to have ones that are capable of crippling the supply lines of the conventional armed forces of a superpower. You can use them for economic ends, but if you get caught then the penalties are much worse than the benefits.

It doesn't really matter if a country is stockpiling vulnerabilities, it matters if they start using them (and leaking them so that they're used by third parties counts here). The correct response here would be to hold the NSA, and by extension the US government, responsible for all costs associated with this ransomware and then do the same to the next malware that comes from a similar source. If the cost of stockpiling vulnerabilities has the potential to be billions or trillions of dollars if they're leaked, then there's suddenly a big incentive to work with vendors to get them fixed quickly.

Re:Enforcement is the problem

[Anonymous Coward]

"Civilized warfare"

Sounds like "military" and "intelligence". Two words that cannot be part of the same sentence.

Re:Enforcement is the problem

[AmiMoJo]

The EU should just set up a well paid group to look for these vulnerabilities and report them. That's all the NSA does, and there is plenty of talent in the EU that doesn't want to work for GCHQ and the like. A few million Euros a year could fix this, and the EU is big and diverse enough to resist pressure from national agencies like GCHQ (which won't even be in the EU soon).

Re:Enforcement is the problem

[GLMDesigns]

We have rules and many are followed.

We don't use chemical weapons. Even Hitler did not.
We have agreements on bullets and stick to them.

The only part of the geneva convention that is NOT followed are by those people who aren't wearing uniforms and blend back into the civilian population. Hmmm. Wonder why no one mentions that sh!t.

Re:Enforcement is the problem

[courteaudotbiz]

Even Hitler did not.

Are you totally out of your Sean Spicer brainwashed mind? Ever heard of Zyclon B?

Maybe you are being sarcastic, but I just don't get it in your post (English is not my first language)

Re:Enforcement is the problem

[GLMDesigns]

First of all we're talking about treaties regarding combat not concentration camps. This "Even Hitler did not use chemical weapons" phrase has been used since at least the 1980s. I first heard about it when people were talking about chemical weapons being used in the Iraq-Iran war.

Hitler could have used it with great affect in the Battle of Stalingrad, He could have pulled his troops out of the city and used artillery and planes to saturate the city with chemical weapons. He did not.

There is evidence that the Germans used poison gas was used in a few instances. But it was rare, it was not part of their military strategy.

The key point here is not "was chemical weapons used in an isolated case here or there" (Hitler, Iraq, Syria) but whether or not treaties regarding use of military weapons actually work. They surely seem to.

My post was referring back to the statement that "civilized warfare" sounds like "military" and "intelliigence"

Re:Enforcement is the problem

[Doke]

Han shot first. :-)

Re:Enforcement is the problem

[OutOnARock]

Jumbo Shrimp

Re:Enforcement is the problem

[DMJC]

No Treaty stopped Hitler using chemical weapons. It was the knowledge that Churchill had large enough stockpiles to gas every German in Germany multiple times over that stopped him from opening that Pandora's box.

Re:Enforcement is the problem

[GLMDesigns]

Well, most treaties are backed up by more than good intentions. MAD (Mutually Assured Destruction) was the military strategy behind the treaties btwn the US and USSR.

Why?

[nospam007]

I don't see it.
MS tried everything short or threats to get people to upgrade to a secure Win10 version to no avail.

This will bring millions of new licenses for MS.

Re:Why?

[Dunbal]

secure Win10

+1 Funny

You're also ignoring the huge elephant in the room - that Microsoft probably knew about that vulnerability or even better, created it in conjunction with the NSA et al. By the way - WINDOWS 10 ALSO REQUIRED A "FIX". This is not a "zero day vulnerability", it's a back-door plain and simple.

Re:Why?

[Anonymous Coward]

And in response plenty of people disabled automatic patching. That Win10 upgrade was a really good way to destroy that little bit of thrust people might have had left for automatic upgrades.

Re:Why?

[Dutch Gun]

One of the problems is that MS poisoned any good will about upgrading with their own actions... first by more or less tricking people into upgrading to Windows 10, and second, by making that upgrade (and all other upgrades) less trusted by pushing telemetry as required updates, and by making Windows 10 updates incredibly annoying, disruptive, and on occasion, simply broken.

I don't blame MS for not writing perfect code, especially older code. No OS used today has zero exploits, so I think it's disingenuous to bash Microsoft with each new bug found but somehow give Linux a pass when the same damned things happen. But I'm sure as hell going to blame them for encouraging so many people to distrust Microsoft's own security patches in the first place, even going so far as to actively block them. That was all because of their OWN tone-deaf policies of "we know what's best for you, so shut up and update. Oh, and don't mind the telemetry we're slurping up. We promise its benign. What? No, there's no way to turn it off."

Re:Why?

[Errol backfiring]

So the blame is 100% on Microsoft. The whole Windows 10 debacle shows that Microsoft's updates cannot be trusted. So the Windows population now consists of mainly two groups: those who could not switch updates off on time (and now never can switch off again because they have windows 10 involuntarily) and those who could switch them off and dare not install anything from Microsoft ever again. Microsoft itself has made terribly sure that updates are not installed if it can be avoided.

Re: Why?

[Dunbal]

the default configuration of win 10 has the vulnerable protocol handler disabled.

So I'm guessing the NSA has another separate way in on Windows 10 boxes.

Re:Why?

[bluefoxlucid]

Yet Microsoft wasn't proactive because people were still running Windows XP which--like DOS 3.0--didn't get a patch.

I don't see how it's Microsoft's fault that other people didn't upgrade to Vista, 7, 8, 8.1, or 10.

Re:Why?

[Xyrus]

secure Win10

+1 Funny

You're also ignoring the huge elephant in the room - that Microsoft probably knew about that vulnerability or even better, created it in conjunction with the NSA et al. By the way - WINDOWS 10 ALSO REQUIRED A "FIX". This is not a "zero day vulnerability", it's a back-door plain and simple.

No, it isn't a backdoor you moron. It's defect in the old SMBv1 that goes back to XP. No one sane uses it anymore, but the the old code is still there. The worm takes advantage of that fact.

Re:Why?

[angel'o'sphere]

Of course it is MS fault!
Who else?
If Vista, 7 and 8 and now 10 would not be such shitty OSes people would switch.

On top of that, some of those OSes have idiotic minimum requirements and don't even install. Even if the single application/appliance that would later run in it would run just fine.

Re:Why?

[clodney]

So the blame is 100% on Microsoft. The whole Windows 10 debacle shows that Microsoft's updates cannot be trusted. So the Windows population now consists of mainly two groups: those who could not switch updates off on time (and now never can switch off again because they have windows 10 involuntarily) and those who could switch them off and dare not install anything from Microsoft ever again. Microsoft itself has made terribly sure that updates are not installed if it can be avoided.

Given the statistic I recently read that Windows 10 is on over 400 million devices, I think you are missing a third group that contains in excess of 100 million people: those who want Windows 10 and believe that all things considered, it is a better choice for them than earlier versions of Windows.

Microsoft did absolutely everything they could to get Windows 10 into the field, including some sleazy tactics. But auto updating systems are like vaccinations. They provide herd immunity to everyone around them even if some people have bad reactions to vaccines.

Re:Why?

[cm5oom]

So that explains why these people never upgraded to vista, 7 or 8.

Re:Why?

[Wulf2k]

"I think you are missing a third group that contains in excess of 100 million people: those who want Windows 10 and believe that all things considered, it is a better choice for them than earlier versions of Windows."

I think you're misclassifying the group that we call "anybody who has bought a new computer in the past two years".

Re:Why?

[bluefoxlucid]

I remember running Linux on 400MB of RAM. I remember upgrading from 16GB because it was straining. Then, I enabled ZRAM.

Windows 10 has a memory compression system better than ZRAM now. Linux has either Zswap (compressed swap cache, requiring a backing device) or ZRAM (compressed RAM, doesn't act as a first-level cache, so won't move more-stale data to disk and less-stale data to RAM). Windows 10 has in-memory compression; if memory pressure is too high, it swaps compressed pages to disk. The difference is Windows 10 is Zswap-like if you have on-disk swap, ZRAM-like if you don't have on-disk swap, and agnostic to which configuration you're using; Linux requires you to select a strategy and configure the relevant bits.

Even server OSes on Linux need like 2GB of RAM and at least 2GB of disk; and you're going to run out of disk with all the bullshit they do day-to-day stuffing extra kernels and packages in there if you don't ritualistically clean up. Gone are the days of 256MB RAM and 800MB disk installations for a desktop OS.

We've had some pretty severe remote hacks on Linux, BSD, and MacOSX, too; just nobody took over 97% of the Internet with them.

Re:Why?

[Agripa]

I don't see it.
MS tried everything short or threats to get people to upgrade to a secure Win10 version to no avail.

This will bring millions of new licenses for MS.

Microsoft also removed features and crippled functionality in a quest to leverage their desktop monopoly into PDAs and tablets. They never released a successor to Windows XP.

Microsoft is 100% right on this one

[Snotnose]

Nobody is perfect, all software has vulnerabilities. Had our relevant TLAs bothered to tell the relevant companies about the holes they found we would all be a hundredfold safer. But no, they kept them secret, figuring they could hack Some Bad Guy's computer and Stop Some Low Level Bad Thing.

The fault here lies in our countries TLA's deciding it was better to leave 100% of the country at risk hoping they would be able to exploit a hole before someone else could exploit that same hole against us.

Fuck the NSA, CIA, FBI, and everyone else that finds security issues and keeps them private. They are the problem, not Microsoft.

Re:Microsoft is 100% right on this one

[Anonymous Coward]

You need to step back and ask how many employees of Microsoft serve other masters. They use anti-competitive means to shove their products upon people and then take no responsibility for protecting the people.

I recall Microsoft providing the source code to a few countries to get deals signed. Do you really think that only U.S. intelligence agencies are/were aware of undisclosed vulnerabilities? What if we knew they were compromised internally and that disclosing intel about security vulnerabilities was only weaponizing our adversaries?

You make it sound so very simple; when in reality things are complicated.

Re:Microsoft is 100% right on this one

[TWX]

Microsoft is not 100% right; they created something with this vulnerability and sold it for a very long period of time. They're patching XP for chrissakes.

Re:Microsoft is 100% right on this one

[rsmith-mac]

I know this isn't a popular opinion around here, but hear me out.

The NSA is the US's SIGINT operation. Their job is to be both the offense and the defense when it comes to dealing with electronic systems. So developing attacks against other systems is part of their purview, and we want them to continue doing so such that we can spy on, and if necessary attack other nations. The need for an offensive SIGINT group will always exist, even if it's not the NSA.

Back in the days of yore, it used to be that exporting valuable software was restricted. If the Soviets wanted software for controlling gas pipelines, for example, they either had to develop their own or steal it. And exporting useful encryption was right-out banned. The end result was that for SIGINT purposes, there was a very clear line between "us" and "them" in what each side's systems could do, how they worked, and what they ran.

The Internet has put an end to national borders for software. Now everyone runs the same Oracle database, the same Cisco/Juniper routers, the same Microsoft OS, etc. It's allowed commerce to explode on our end by exporting valuable software to new market. However the flip side of that is that the line between "us" and "them" has almost entirely been erased. Now the nations we spy on run much the same software we do; now the nations that we need to be able to attack don't run antiquated little systems that are easy for us to break into. How do you balance offense and defense in that situation, when any weapon you make can be used against you, and any defense to develop can be used by your enemies to shield themselves from you?

Had our relevant TLAs bothered to tell the relevant companies about the holes they found we would all be a hundredfold safer. But no, they kept them secret, figuring they could hack Some Bad Guy's computer and Stop Some Low Level Bad Thing.

If our relevant TLAs informed software vendors about every exploit they found, it would improve the quality of software to be sure. And that definitely has some benefits. But then we'd be committing to an entirely defensive operation, due to the fact that everyone else is running this better-hardened software.

Meanwhile when it comes to offense, we'd have no exploits let which to use to spy on or attack other nations with. But the same is not true for other nations. Their own SIGINT groups would be searching for exploits as well, and since they wouldn't be bound by what we're doing, they'd continue stockpiling them and using them against us as they deem necessary. Our software-hardening efforts would make this task a lot harder, but not even the NSA is going to find every bug in Windows. So at the end of the day, other nations would still be able to attack us, even if we did report all exploits we found.

The problem with a purely defensive operation then, especially in the software sense, is that your defense only has to fail once for you to lose. Once they're in your systems you have no ability to retaliate (since you have no exploits to use as weapons), so hostile forces have very little incentive not to attack you. And while you can clean up afterwards, the damage is done: the blueprints have been stolen, the cyclotron has been busted, and Amazon is shipping everyone 50 gallon drums of lube.

Ultimately Cyber security when both sides have the same systems is little more than a new variant on the Prisoner's Dilemma. We can stop ratting on the other prisoner, but they're not going to stop ratting on us. No matter what we do, it's in the best interests of foreign powers to be able to attack our systems. And that means we need to keep exploits of our own in order to be able to mount a credible (if not overwhelming) offense.

The one problem here - and not to discount it, because it is a real problem - is that the NSA obviously didn't secure

Re:Microsoft is 100% right on this one

[ScentCone]

They're patching XP for chrissakes.

No, they're patching a very old product that they told people - for years straight - to stop using, and they explained why. You do get this, right?

Re:Microsoft is 100% right on this one

[Dutch Gun]

Well, you're brave to defend the TLAs. Hopefully you don't get unfairly mod-bombed because of it, as too often happens to unpopular posts.

The core problem with your scenario is the implicit assumption that only the TLAs know about those particular exploits. There could very well have been other countries' agencies that knew about them as well, or criminals using them judiciously for their own zero-day exploits. Why assume that any other major state player couldn't collect these same bugs? We may know more in the months ahead if anyone discovers new information in old logs relating to these exploits.

The other faulty assumption is that the only way to do offensive intelligence operations is with software exploits. Plenty of attacks, from many different criminal and/or government groups have shown that to absolutely not be the case. Human operators can be fooled into installing malware in targeted phishing attacks, or maybe even bribed into installing it. Or you can use more traditional bugging methods, installing hardware that intercepts information pre-encryption. Etc, etc...

Holding onto an exploit that affects your own country's software (and the world's in fact), is playing a very risky game. And, as you rightly acknowledged, it just blew up in their faces. Given the proven inability of these agencies to hold onto secrets, I think playing a little more defense isn't a bad thing, at least until its been established that they don't leak their own secrets like a sieve.

I fully understand and acknowledge that there are very bad people in the world, and these agencies help to protect the US from them. But I do wonder if, at the moment, that price is becoming a little too steep for what we're getting out of the deal. The problems is, though, that we'll never really know. The leaders at the top of that agency know, but sure as hell they're never going to admit to anyone anything that has a chance of ever reducing the power of their own little government fiefdom.

Re:Microsoft is 100% right on this one

[buss_error]

I know this isn't a popular opinion around here, but hear me out.

I know this isn't a popular opinion, but hear -me- out.

The statue clearly states that US intelligence services are required to divulge security vulnerabilities to vendors in a timely manner. It is blindingly obvious this was not done. So my question is very simple.

Who is going to jail for violating Federal statues?

Oh - silly me. Only chumps and civilians go to jail for violating the law.

Here is the real problem - being able to access a computer is like being able to read their diary or eavesdrop on them. Before computers, this was also done. With computers, it's just easier. So what we are seeing the the degradation of everyone's privacy because it's easier to steal secrets from a computer that it is to, you know, actually do your fsck'ing job.

Enforcing the law isn't about sitting on your fat ass in Virginia - it's about doing the work, the right way, within not just the letter of the law but the spirit of it. Only then is our system of government consistent, valuable, and worth dying to preserve.

Otherwise it's just another big lie.

Re:Microsoft is 100% right on this one

[WaffleMonster]

Nobody is perfect, all software has vulnerabilities.

This isn't a falsifiable statement. Any software defect no matter how egregiously pathetic could be explained away by the same statement. Just saying nobody is perfect doesn't communicate objectively useful information.

NSA's SMB exploit was just another buffer overflow vulnerability.

Buffer overflows like various forms of injection attacks are entirely preventable classes of failure by imposing constraints on software design. You can even get to no overflows for free just by selecting a different programming language with constraints for better or worse already baked in.

While I'm sure it's all quite difficult in practice given codebase MS is dealing with.. it's hardly intractable either. Given scale MS operates with billions of Windows users and decades to get it right I personally don't believe a pass is warranted for this.

Had our relevant TLAs bothered to tell the relevant companies about the holes they found we would all be a hundredfold safer. But no, they kept them secret, figuring they could hack Some Bad Guy's computer and Stop Some Low Level Bad Thing.

TLAs find this shit with the explicit intent to wield as leverage against adversaries. It simply isn't rational to expect the same TLA to work against their own interests in the manner suggested.

The fault here lies in our countries TLA's deciding it was better to leave 100% of the country at risk hoping they would be able to exploit a hole before someone else could exploit that same hole against us.

I disagree. NSA is at fault only for failing to keep their weapons safe. The politicians and everyone who voted for them is at fault for defining their mission and for government paying lip service to funding basic R&D into tools and methods to improve security.. code analysis, language design, education... etc.

FFS computer illiterate peoples were calling me about this ransomware long before a single email hit from the comically worthless US-Cert list.

Re:Microsoft is 100% right on this one

[Plus1Entropy]

You make some interesting points. However I think one major problem with your argument is that it assumes the only way to be offensive is by exploiting flaws in the system. There are other ways to be offensive, and one of the most effective of those has been exploiting flaws in the humans using the system.

The other thing is that I really can't see how the risk of leaving these exploits open will ever be overtaken by the potential "offensive" gains. The potential damage to institutions, businesses, the economy... I mean this time was only "so" bad, next time it could be much much worse.

Also consider the matter of scale. You don't need to be a government to use these exploits. Leaving them open means putting that power in the hands of anyone who finds it. What good is all that offensive capability when you can't direct it at something like a government, with known facilities and targets to attack? What good do they do you against a small group like the ones that attacked the British NHS? Not a whole lot.

I think cyber warfare is a case where the best offense is actually a good defense.

Re:Microsoft is 100% right on this one

[drinkypoo]

NSA is at fault only for failing to keep their weapons safe.

The NSA's job is securing the nation's communications. Part of that would be reporting vulnerabilities to vendors so that they can be fixed.

Re:Microsoft is 100% right on this one

[drinkypoo]

No, they're patching a very old product that they told people - for years straight - to stop using,

Yes, after they spent years doing their best to force them to use it. I call shenanigans. Microsoft wants to embrace and extend so they can have vendor lock-in? Let them be held responsible for the situation they have created.

Re:Microsoft is 100% right on this one

[dweller_below]

I know this isn't a popular opinion around here, but hear me out.

Your reasoning has been official US policy, because it seems sound. But the last few years of Internet warfare has revealed some problems with favoring offense over defense:

1. 1) The weapons of the Internet are not like tanks and nukes. Deploying weaponized exploits require very little infrastructure. They cost almost nothing to replicate. Almost anyone can do it. When an enemy deploys an Internet attack against you, you can easily (compared to a nuke) figure it out, and then deploy it back at them.
2. 2) For years, our standard doctrine was that an Internet attack was not as significant as a physical attack. But, this is no longer true. We are so dependent on the Internet, that a sustained Internet outage has the potential to do more damage to us than a limited nuclear exchange.

Perhaps the greatest problem with the offensive mindset is that it teaches us almost nothing about how to defend. We know we need to deploy better software, but we don't know:

• * How to value effective security more than features.
• * How to force large IT vendors to favor their customer's interests over short-term profit.
• * How to force powerful Intelligence agencies to relinquish power, now that they are a greater threat to US, than they are to our enemies.

Re:Microsoft is 100% right on this one

[gtall]

There are some ideas buzzing around the U.S. government to separate out the functions of cyber so that security comes from a different entity than offensive weapons. Of course that means parts of the government will be fighting each other. NSA, CIA, FBI, etc. are all on public record as realizing this. There is no easy answer.

Some of the misconception is that somehow spying is bad. It isn't. It is what keeps a government from overreacting to something out in the open. Offensive weapons will always be around. The Russians, Chinese, Iranians, I.M.A. Dipshit from Any Country have them.

Some bright sparks in Congress asked James Clapper why the U.S. couldn't respond in the cyber arena against the naughty things the Russians did in the last election. His response was: well, if you are sure the U.S. infrastructure could stand the guaranteed response, then that might be advisable. He was of the opinion that the Russians have the U.S. electrical grid on their target list and that he (Clapper) figured they could take it down for retaliation. Of course, these would be acts of war...between nuclear armed nations....one of which has a ruthless dolt as head of state, the other also has a ruthless dolt as head of state.

Re:Microsoft is 100% right on this one

[thegarbz]

Their job is to be both the offense and the defense

Their job is to protect the people. Their options are to do this offensively and defensively. The evidence said they did it the wrong way.

A lot of people have likened this to loss of control of weapons, but it's nothing of the sort. Weapons predominantly get used once and have a small local effect. This is self-replicating. The only weapon I can think of that is self-replicating are ones that are also illegal to use under the Geneva Convention.

Re:Microsoft is 100% right on this one

[AmiMoJo]

There is a flaw in your reasoning.

You assume that when vulnerabilities are known, everyone patches and is safe. That's now how it works. Microsoft released a patch for this vulnerability a while back, but a lot of systems have not received it.

Cyber offence is mostly about exploiting known flaws, not zero days known only to security services. Cyber defence is mostly about getting people to patch their systems and configure them in a somewhat sane manner.

Much of the really high end stuff is things like replacement firmware for HDDs or tools that exploit physical access to a machine via an evil maid attack or similar. The kind of stuff that is already well known to all security agencies, but which few people defend against due to the difficulty and inconvenience of doing so.

Thus, even if the NSA revealed all the exploits it finds immediately, it would still have a strong offensive capability.

Lots of companies advertise their exploits quite openly, for example those manufacturing forensic software for law enforcement that can unlock an iPhone or use DMA attacks to image a locked laptop.

Re:Microsoft is 100% right on this one

[wildstoo]

It's a shame there are no alternatives to Windows in the marketplace that OEMs could use if they find Microsoft's EoL policies to be too strict.

Yes, that was sarcasm.

Re:Microsoft is 100% right on this one

[wildstoo]

The statue clearly states that US intelligence services are required to divulge security vulnerabilities to vendors in a timely manner.

I now have a mental image of the Lincoln memorial coming to life and bellowing "A house divided against itself cannot stand!"

Re:Microsoft is 100% right on this one

[Cyryathorn]

Which statute are you referring to? If I recall correctly, there's an executive order that encourages the reporting of vulnerabilities, but makes an exemption for zero-days retained for official cyber-espionage purposes. So (again, If I recall correctly), there is no violation of any Federal statute here.

Re:Microsoft is 100% right on this one

[Cyryathorn]

Ah yes, here it is:

https://epic.org/privacy/cyber...

There's no Federal statute such as you describe. It's not even an Executive Order -- it's just a matter of policy. The "Vulnerabilities Equities Process" allows this: "the government may choose to withhold the information to use it for purposes including law enforcement, intelligence gathering, and 'offensive' exploitation".

Re:Microsoft is 100% right on this one

[EzInKy]

The alternative to unsafe bridges may be no bridges at all. We are talking about engineering and architecture here, right?

Re:Microsoft is 100% right on this one

[Anubis IV]

Exactly right. It's a shame your post hasn't gotten more attention.

While I certainly think the policy should be followed, the GP is way off in suggesting that people should be prosecuted for failing to abide by it. Then again, I'd also love to see it turned into something with a bit more teeth to it.

Re:Microsoft is 100% right on this one

[Cyryathorn]

But here's the thing -- the policy *is* being followed, in both the letter and the spirit. The policy has a huge gaping hole in it, and intentionally so. To paraphrase the policy and give it just a pinch of exaggeration, it reads approximately as follows -- "dear NSA: please disclose vulnerabilities, except of course when you can otherwise make use of them."

Re:Microsoft is 100% right on this one

[WaffleMonster]

The NSA's job is securing the nation's communications.

This is like arguing that a photon is a particle. This description is only half right.

Part of that would be reporting vulnerabilities to vendors so that they can be fixed.

Blaming NSA for having dual sometimes mutually exclusive missions is misguided.

NSA peeps don't just wake up in the morning and decide to get into baking cookies, stacking boxes or policing traffic. NSA's Job description is handed down by the same people who created the NSA in the first place -- your representatives in government. If you don't like NSA's mission or priorities then you can work to build consensus for your position and lobby your representatives to have their Job descriptions changed.

Re:Microsoft is 100% right on this one

[Agripa]

If the justice system won't touch them, who does?

Vote the other political party who supports this and does not care about your civil rights into government. Oh, wait ...

Re:Microsoft is 100% right on this one

[Agripa]

There are some ideas buzzing around the U.S. government to separate out the functions of cyber so that security comes from a different entity than offensive weapons. Of course that means parts of the government will be fighting each other. NSA, CIA, FBI, etc. are all on public record as realizing this.

The NSA already has this function as a separate ineffectual entity. If it was further separated, then it would be just as ineffectual; it would be compromised for national security purposes.

They need backdoors too?

[KitFox]

They want backdoors and keys into the things that they swear they will keep safe. Instead of affecting unpatched computers, a leak will affect every computer. But they pinky promise that there will be no leaks and they promise to feel bad if there is one even though it's probably somebody else's fault.

Re:The Blame Game

[Anonymous Coward]

Please forward me your bug-free code for review and then we'll talk.

Older versions

[Anonymous Coward]

Why should Microsoft be blamed for people getting infected while running Windows XP? The XP system is 16 years old and has been past EoL for years. Anyone running an XP machine connected to the Internet is practically begging to be hacked. Would we blame Red Hat for not patching RHEL 3 boxes left on-line or Apple for not patching 2001-era Macs? It's not as though Microsoft has not made it perfectly clear those old systems are no longer supported.

Re: Older versions

[Anonymous Coward]

Nobody wants to run Microsoft's spyware infested windows 10 crap. People do want to run XP.

Re:Older versions

[Anonymous Coward]

Because Grandma can't afford a new computer that can run a supported version of Windows. That's why. Not everyone can afford to get a new computer every year or two to be able to run the "supported" version of Windows. There are a lot of computers out there that are 10-15 years old. For many people, they still do 99% of what they need to do, check email and web browse.

I blame Microsoft for abandoning software that they know is still actively used.

Re: Older versions

[scdeimos]

Bought a new car in the last decade? How much phone-home telemetry do you think there is in the average Ford infotainment system versus Windows 10?

Re:Older versions

[Agripa]

Why should Microsoft be blamed for people getting infected while running Windows XP?

Because Microsoft never released a successor to Windows XP and what they did release had feature removed and functions crippled in a quest to leverage their desktop monopoly into PDAs and tablets.

Re:Enough blame to go around

[Anonymous Coward]

They probably got promoted for writing their code so quickly, and the manager who decided to enable the feature by default too.

Plenty of blame for Microsoft too

[Anonymous Coward]

Microsoft can save some of that blame for themselves. Many people had to turn automatic patching off because of Microsoft's shitty policy of trying to force people to Windows 10 through patch driven 'upgrades'.

Re:Enough blame to go around

[Excelcia]

This exploit exists in an old protocol no one uses any more. Is any vulnerability avoidable? Sure. Should this one have been fixed, or the code deprecated earlier, absolutely. Could /you/ write a hundred million lines of code and not have a critical vulnerability? In case it's not obvious (to you), that was a rhetorical question.

I am no fan of Microsoft. I never have been. But in this case, the real evil was perpetrated (and there is no other word for it) by the NSA. An agency of the United States government, one specifically tasked with the protection of US citizens, learned of a vulnerability in an operating system used in critical applications throughout the country, used by the majority of its citizens, and not even accidentally sat on it - they purposefully, with consideration and intent, sat on that information. Not only that, but they then developed a weapon to exploit it, lost control of that weapon, and it is now in the wild where it can do the most damage.

This is a combination of willful dereliction of duty, and gross negligence. This shouldn't be Microsoft complaining, this should be the director of the NSA hauled in handcuffs before congress.

Secure the code, secure the OS

[AHuxley]

"every single cyberattack on a Windows system seriously"
"We have more than 3,500 security engineers at the company"
Yet failed to notice PRISM? https://en.wikipedia.org/wiki/...
Re "This attack is a powerful reminder that information technology basics like keeping computers current and patched are a high responsibility for everyone, and it’s something every top executive should support."
The US clandestine services are hiring from the same US university graduate groups over decades.
Top US executives should hire smarter people in the US who can code a secure a US OS in the private sector.
If the US clandestine services can hire US people to get into a US OS, hire from the same very smart skill set to protect an OS.
The US mil and gov does not have first pick or a gov monopoly on hiring very smart people every decade. Find some really skilled people in the USA to secure your OS.

Re 'And it’s why we’ve pledged our support for defending every customer everywhere in the face of cyberattacks, regardless of their nationality."
When a gov presents "real" court papers and wants long term access to plain text information its just a "legally binding order or subpoena".
The origin of this was a government product. Understand how governments work in the public and private sector. How staff move between the role of contractor, gov worker, mil worker and private sector staff to fully understand an OS maker.

Microsoft does need to share some of the blame

[Anonymous Coward]

When Microsoft started issuing "Security Patches" that were no security patches but telemetry and Windows 10 update patches, I stopped patching. Was I wrong? I take a lot of other precautions, one of which is that I ditched after 30 years of being a Microsoft fan boy to MAC.

Re:Microsoft does need to share some of the blame

[ls671]

You spoofed your MAC address? Very clever...

Great argument against backdoors

[OzPeter]

This hacking provides the perfect argument against built-in backdoors that would enable the government to spy on people (but only when they wanted). All it takes is one leak and *boom* you have out of control hacking by everyone but the government.

Re:Great argument against backdoors

[mentil]

I agree this is Exhibit A of why there shouldn't be built-in govt. backdoors in computers. However, the powers that be will simply weigh
a) likelihood * damage if knowledge of the backdoor were to leak
vs b) all those Bad Guys they'll be able to catch because of this omniscient surveillance. if knowledge is power then a God am I! bwahahaha! sorry, i mean, catch terr'ists and stuff. think of the children and whatnot.

most of the 'damage' in A will be borne by people/organizations outside of the nation that mandated the backdoor. the damage to the govt. will be paid for by taxpayer money, and fixing it requires temporary contract workers, overtime pay, et cetera. instant jobs program, yeah! those that make the decision to vote yay to a backdoor won't see any hardship. until these attacks using leaked exploits start infecting politicians' personal/work computers, making their lives more difficult, they will vote for "keep it secret, keep it safe" every time, confident the Nazgul won't come for them.

Re:Enough blame to go around

[scdeimos]

Oh for the love of mod points...

Custom Support and MS quarterly earnings

[yuhong]

I have quite a good discussion about Custom Support and MS quarterly earnings here: https://www.reddit.com/r/micro...

Re:Custom Support and MS quarterly earnings

[phantomfive]

Can you give a summary of the main points? I have reddit set in my hosts file to 0.0.0.0

Re:Custom Support and MS quarterly earnings

[yuhong]

The original quote from https://view.officeapps.live.c... : "As expected, Enterprise Services revenue declined 1 percent and was flat in constant currency, due to a lower volume of Windows Server 2003 custom support agreements."

I was guessing that this decline is because the revenue declined by tens of millions, which implies that they are likely making much more than that total in these contracts especially given that Server 2003 is still widely used. I checked "Productivity and Business Processes", "Intelligent Cloud" and "More Personal Computing" for this quarter and all of these individually total about $7-9 billion.

This is CYA from Microsoft

[phantomfive]

The original blogpost makes the following points:

1) Microsoft works hard, I tell you hard to avoid these problems.
2) Customers are to blame too! (really)
3) It's the government's fault!

They're trying to direct the conversation so they don't get all the blame. The reality is, if Microsoft hadn't made the flaw, then this attack never would have happened.

Re:This is CYA from Microsoft

[ogdenk]

And your bug-free 100% secure multi-user OS w/ flawless network stack is where, exactly? All large software projects have bugs and vulnerabilities. It's a fact of life.

If the NSA had actually cared about securing US systems from attack, they would have had MS fix the vulnerabilities instead of exploiting them for fun and profit we wouldn't have this problem.

If the general public realized the importance of keeping software vulnerabilities patched, they might have been able to avoid such widespread infection.

*NIX systems get pwned every damn day, too. I hate to defend MS but there's no such thing as a large software project that is bug-free and impossible to exploit.

Re:This is CYA from Microsoft

[phantomfive]

And your bug-free 100% secure multi-user OS w/ flawless network stack is where, exactly?

Here you go. They have exploits occasionally, but they're rare. Not bad for a scrappy team of programmers, showing the world what is possible.

If they had Microsoft's resources, they would be perfect.

Re:This is CYA from Microsoft

[ogdenk]

As much as their proactive approach to security helps with an out-of-the-box, you're still screwed if you rely on things like Apache httpd, MySQL, Samba, Xorg, etc. And wasn't it their OpenSSH project that was full of interesting holes pretty recently?

And I'm saying this as someone who's been running various forms of BSD since around 1994. Nothing is perfect. BSD just sucks less. And if you're really trying to imply OpenBSD is "bug-free" that's just wishful thinking.

The "ZOMG MS iz teh SuX0rz.... if only everyone ran Linux and OpenBSD the world world be SAVED" tripe got old 20 years ago. Does Windows suck more? Yep. But they all suck.

Re:This is CYA from Microsoft

[thygate]

if Microsoft hadn't made the flaw

you misspelled backdoor.

Re:This is CYA from Microsoft

[phantomfive]

And wasn't it their OpenSSH project that was full of interesting holes pretty recently?

No, that was OpenSSL.

As much as their proactive approach to security helps with an out-of-the-box, you're still screwed if you rely on things like Apache httpd, MySQL, Samba, Xorg, etc.

Again, if they had the resources of Microsoft, the openBSD team would be perfect.

Re:This is CYA from Microsoft

[thegarbz]

The reality is, if Microsoft hadn't made the flaw, then this attack never would have happened.

So let's analyse this for a moment:

1. You attack human's imperfect nature (code bug) vs something that could have been avoided out of policy (responsible disclosure instead of weaponising a bug).
2. You assume that all the blame lies at Microsoft whereas a large portion of customers have put their systems into a position which allowed this problem to spread. This in itself is stupid as what is more suitable form of protection:
a) Good network design and computer isolation principles? Or
b) Hoping that the 60 million lines of code that go into making the computer do what it is supposed to are bug free?
3. A large portion of infections are on systems that haven't been fit for service for many years, users specifically warned that they are insecure, and no other measures taken to protect them.

Blaming Microsoft first and foremost for this is like blaming the government for building a bridge when someone decided to jump off it, much less when there's a third party standing behind them giving them a push in the interests of national security.

NO Incident in history had a single accountable point of blame. All incidents are a series of interconnected events that run perfectly to result in the outcome. Preventing incidents is focused on what is within our control. e.g. Not weaponising a bug.

But sure go one your crusade to change the imperfect nature of human beings. Let me know how that goes.

Re:This is CYA from Microsoft

[Big Hairy Ian]

They're trying to direct the conversation so they don't get all the blame. The reality is, if Microsoft hadn't made the flaw, then this attack never would have happened.

Utter fuckwittery of the highest order. Yes M$ Made the flaw so did almost every other tech company. The NSA new about it for years, kept schtum then got hacked and now everybody knows and some crook is using it to extort hospitals around the world.

Re:This is CYA from Microsoft

[StormReaver]

Damn, phantom5, don't you go spouting off common sense in the middle of an emotional tirade. By now, it should be obvious to everyone that this is Microsoft's M.O. How many times does this have to happen before the Microsoft defenders get their heads out of their asses. This isn't the first time Microsoft has done this, and it won't be the last time.

Microsoft consciously made this flaw in their quest to dumb down computing, and now they are trying to deflect blame away from themselves. This is also Microsoft standard procedure.

Re:This is CYA from Microsoft

[bingoUV]

The reality is, if Microsoft hadn't made the flaw, then this attack never would have happened.

You assume that all the blame lies at Microsoft whereas

Not exactly. Just because it would never have happened if it weren't for Microsoft doesn't mean all blame lies at Microsoft.

There can be multiple players in a ball game but someone sets the ball rolling. It was Microsoft in this case.

Re:This is CYA from Microsoft

[Xyrus]

Waiting to see your perfect code from a multi-million line code base you wrote.

This IS the governments fault. They KNEW there was an exploit. They KNEW about it for YEARS. Yet they never revealed it. How the hell was MS supposed to fix something they didn't know was broken?

The gov didn't WANT them to fix it. It was their pet exploit. They were hoping nobody else would find out about it so they could keep using it. THAT is the problem.

Re:This is CYA from Microsoft

[angel'o'sphere]

Security bugs are relatively easy to avoid.
I mean in relation to wrong understood business requirements, simple mistakes etc.
Your attitude is just like throwing in the towel and not even trying to minimize bugs.

As an anecdote: the main flight computer of the Space Shuttle had something like 400kLOC, the total software close to a million lines of code. Total number of bugs in production: 4. After those where fixed, the software was/is _bug free_.

Re:This is CYA from Microsoft

[thegarbz]

In any kind of incident investigation human factor is never attributed as either the root cause or the initiating event. This is primarily because it is the one thing impossible to change or control.

Continue to claim so if you want, but nothing will come of it. The only way problems like this will be avoided in the future is through systematic solutions that circumvent the human factors.

Re:This is CYA from Microsoft

[thegarbz]

I hate double posting but I forgot to mention the obvious, what leads to incidents of this scale is a series of independent events. A ball can only be "set rolling" when the incidents are sequentially dependent on each other.

Nothing Microsoft did had an impact on the NSA program to weaponise bugs.
Nothing Microsoft did had any impact on people running outdated systems.
Nothing Microsoft did had any impact on poor end user network design.

There are 4 balls rolling (actually there are more). They just happened to hit each other in the middle and each could have independently prevented this case.

Re:This is CYA from Microsoft

[phantomfive]

Waiting to see your perfect code from a multi-million line code base you wrote.

I haven't made this particular mistake in nearly 20 years. Furthermore, if someone does make this mistake, they are either incompetent or a moron, and shouldn't be writing security sensitive code. Why? Because the compiler will literally give you a warning when you make this mistake. This is the kind of bug where you can be perfect. It's easier to have a memory leak in Java than to make this mistake.

Microsoft is at fault here. If they'd put one of their 3000 security engineers to work fixing (or at least looking at) warnings, then they could have caught this. But they didn't. It's yet another symbol of their incompetence.

Re:This is CYA from Microsoft

[phantomfive]

Nah, I avoided philosophical problem of blame allocation by spouting a truism :) if Microsoft hadn't made the flaw, the attack wouldn't have happened. Who knows who is 'primarily' to blame.

In reality, this is a bug that should have been avoided by Microsoft, because the compiler gives a warning when you make this mistake. It literally tells you that you did something stupid.

This is old code, and Microsoft's code from that era is rather horrifying. They have cleaned up their coding style a lot, and I believe they would not have made this bug in their modern code. This just hilights that they aren't spending enough effort to clean up (or remove) their ancient, buggy code.

From a procedural standpoint, they have 3000 security people working at the company: they should put some of them on task cleaning up these warnings (or at least looking at them).

Re:This is CYA from Microsoft

[thegarbz]

Who knows who is 'primarily' to blame.

No one. That's the problem when independent events need to line up to create a problem. There are 4 or 5 different parties which each if they hadn't done what they did would have prevented this particular outbreak.

Re:This is CYA from Microsoft

[phantomfive]

Yeah, I like that way of looking at it better, no reason to worry about 'primary' blame. Blaming is kind of counter-productive, though fun.

Re:This is CYA from Microsoft

[ogdenk]

Again, if they had the resources of Microsoft, the openBSD team would be perfect.

And if I had the resources of Microsoft, I'd be tapdancing on f**king Mars not giving a sh!t about ransomware. What's your point? And no, they wouldn't be perfect. Guaranf**kingteed they'd have a few showstoppers once the scrutiny of the planet was upon them and the entire blackhat community wanted a piece of their a$$. You can worship Theo De Raadt and crew all you want. OpenBSD.... is.... not.... perfect.

Do they have an interesting and valuable approach? Yeah. Is their model the end-all-be-all of development models and utterly flawless? No.

Re:This is CYA from Microsoft

[phantomfive]

Yeah, but they're actually good. Unlike Microsoft. Demonstrably.

Re:This is CYA from Microsoft

[Agripa]

1) Microsoft works hard, I tell you hard to avoid these problems.

Microsoft works harder to create more problems.

2) Customers are to blame too! (really)

For what? Choosing an alternative (a successor to Windows XP) that Microsoft did not produce?

Customers are certainly to blame for not dropping all Microsoft products.

3) It's the government's fault!

Is that the government Microsoft is cooperating with to include exploits?

Re:This is CYA from Microsoft

[bingoUV]

Firstly all this is irrelevant because i was pointing out that you were incorrectly assuming that phantomfive was saying that all blame lay with Microsoft. He wasn't, and you did not give any arguments to support the position that he was.

Once you acknowledge your mistake that i pointed out above, you might get somewhere . Or not.

Two responsible parties ...

[CaptainDork]

...

1.) Microsoft for having a shitty OS and

2.) The USA three-letters knowing it and not protecting its citizens.

Re:Two responsible parties ...

[CaptainDork]

One word for you:

Market share.

So, fuck off and stuff.

Re:Two responsible parties ...

[CaptainDork]

Not other country swears to uphold the Constitution of the United States.

Re:Can you say independently vetted security audit

[phantomfive]

Independent security audits......they are expensive & time consuming.

Most importantly, they don't make you secure. They're consultants who find a few bugs, then send you a big bill.

Re:Enough blame to go around

[Anonymous Coward]

https://github.com/RiskSense-Ops/MS17-010/blob/master/exploits/eternalblue/ms17_010_eternalblue.rb#L32

According to the above, the bug comes from subtracting a DWORD from a WORD.

This is something a compiler will usually show a warning. If it did not, then the compiler is to blame.

If the Windows programmer set a flag to disable warnings from the compiler, or ignored the warnings from the compiler, then the programmer is to blame.

What a company can do

[AHuxley]

If an OS developer wants to secure their code, secure their site and code, consider every contractor and consultant who had access to the code.
Walk the life story. Is the resume real? Education, friends, university, who helped at university? First real job?
Are trusted staff walking out internal code early and often to the US gov for some reason?
Stop outsourcing, start hiring US experts who enjoy working in the private sector. Make the US private sector a better place to work than any US mil or gov site.
Consider how the gov or mil treats staff and ensure the private sector is always better. No new "contractors" telling expert private company staff what to do.
Make writing good code that protects the US brand and product line more fun and more rewarding than anything the mil/clandestine services can offer.
Find the very best graduates that passed on merit in the USA and offer them much better conditions before they consider the clandestine services.

Consider all past requests by law enforcement for internal plain text network access. What got installed, where, for how long. Strange gov hardware "tracking users" deep in company networks for years?
Build entire new research campus sites that do pure research well away from any users or gov/mil/court requests. Air gap new code efforts far away from any existing user networks or buildings.
Do not mix staff between the everyday user court work and secure new code creation.
Crypto everything early and often. Keep everything surrounding the product line in plain text but secure the new code.
Write trusted internal crypto. Never trust any crypto that a gov offers or says is a standard or has been "fully" gov tested. Its tested to revert to plain text.
A government does not need to see product creation, just user accounts. Keep users and code creation well separated.
Stop governments/mil teams from getting so far up the production line before a release date.
Look over all past issues. Is it staff walking out data or an entire network been copied? If no staff member has access to all the code, is the network been used as a way in to collect it all during code creation or review?
Could a very few well placed staff members work together to put together all existing code and walk out with work for every generation and product line?
Has pre release code always been shared with any part of the US mil or gov in full?
Build an internal security section. Create junk code and projects. Fill networks with bait raw code and see what gets created in the wild days or years later that only works with that code given to select people or was ever on a server. Log everything.
Someone or some network accused all that bait code.
Is code walking early in the creation stage? Testing? After a release? Start tracking every stage of the code and fill it with unique tracking.
Find out if it is trusted staff, wide open internal networks, or gov requests for all code have made it out into the wild. If it is trusted staff that get found, look over their resume and see who else has the same fake patterns of background work or study. An entire generation of clandestine staff could have been placed into a project and allowed to advance up the ranks over many years.
If its an open network, fill it with busy work and tracked junk projects.
Look over all past access or source code related malware events. See if groups, networks or staff keep on showing up for each event.

Re:Enough blame to go around

[arth1]

They probably got promoted for writing their code so quickly

It's a government agency. You don't get promoted for being clever or efficient, you get promoted for dotting the i's and crossing the t's (or, in some cases, for dotting the t's and crossing the i's).

Re:Enough blame to go around

[Dunbal]

Yeah next time your mechanic charges you $2000 for something you didn't need, make sure you listen to his "cars are really complicated with lots of moving parts and sophisticated electronics" justification.

Re:Enough blame to go around

[Dunbal]

This is something a compiler will usually show a warning. If it did not, then the compiler is to blame.

Guy in India writing the outsourced Microsoft code: "That stupid compiler always generates so many warnings I just turned the warnings off. The code compiles fine I don't see what the problem is."

Re:Enough blame to go around

[arth1]

This is something a compiler will usually show a warning. If it did not, then the compiler is to blame.

Blame isn't a limited commodity, where you reduce blame one place by adding it to another. "Shifting blame" is an attempt at binary thinking and reducing complexity, and is an impediment to justice.

That a compiler or static analysis tool is to blame for not warning where it should does not absolve the programmer one iota. A programmer who depends on software to tell him when he's done a mistake deserves blame heaped up high. The tools can warn about bad code, but absence of warnings does not imply good code.

Re:The Blame Game

[Dunbal]

They've got to blame someone. Opening bell happens in a few hours. The NSA is not publicly traded.

The NSA as I last saw it had a division of C SEC

[charliemerritt03]

Gimme a break. The NSA as I last saw it had a division of COMPUTER SECURITY. What happened? Last year Comey said we needed an "adult conversation" about encryption and national security. Screw that. The National Security Agency best be looking after - Ah _ Um - National Security. We DO need an ADULT conversation folks.

State Competence and Consequences are the Solution

[LeftCoastThinker]

The solution is not to give up vulnerabilities that the CIA and NSA discover and want to weaponize, the root of the problem is the most incompetent administration in 50 years (the Obama administration) being completely clueless about cyber security and letting our state secrets out. That shit would never have been hacked by the Russians and dumped into the wild if the incompetents at the CIA and NSA had air-gapped their stockpile and put people in prison for 10 years or more for moving the files to a networked location except for specific conditions and actual use where multiple sign-offs and precautions would be required. Those who were in charge and those who were responsible for the security measures at the CIA and NSA when these secrets were hacked/leaked should be fired and charged with criminal negligence at least or maybe espionage/treason.

Re:The Blame Game

[arth1]

Let me break it to you gently, as you don't exactly appear to have your finger on the pulse of current American politics. You see, Barack Obama is not the president anymore, and so will not be pardoning anyone. He's just a citizen now.

He's not the president, but he is a president. Every former president gets a life long pension, an office, a staff, franking privileges, secret service protection, a presidential library, and the title of president. And are still bound by the oaths taken when entering office, making former presidents, much like the peerage in Europe, less free than full citizens.

Digital Broken Arrow

[mentil]

Wait until one of these leaked/lost TLA tools becomes used by a 3rd party in such a way that it looks like a state-sponsored attack on one of their enemies. Or, equally likely, a 'leaked/lost' tool used by a 1st party, with a '3rd party did it' plausible deniability argument. It's like separating a 'rogue terrorist group' from a 'state-sponsored terrorist group'.

I imagine soon, a major power will say "all attacks by tools that could only have been created by a state actor, will be responded to as if actually used by that actor" and then the "oops, my WMD fell off the back of a truck, my bad" excuse will no longer work. It may soon be considered too dangerous to hoard these exploits, as their inevitable leak will harm their creator more than if they had never been created in the first place. Taking bets on if that happens before or after the IT world figures out how to secure their shit.

Re:Enough blame to go around

[arth1]

It's not the governments job to protect everyone from self inflicting their own wounds or creating their own problems.

In this case, the wound was made with a government made knife, designed to penetrate known armor, and leaked through government incompetence. I think that puts some blame on the government too.

If it wasn't for the government (a) making, and (b) leaking this weapon, this particular attack would likely not have happened. I can see the US government being sued for damages in foreign jurisdictions that allow this.

That does not absolve those who brought the malware onto a network by monkey-clicking links, of course.

Re:The Blame Game

[Anonymous Coward]

Please forward me your bug-free code for review and then we'll talk.

10 print "Fuck You"
20 goto 10

Re:Enough blame to go around

[Gadget_Guy]

We should be able to see how this occurred by looking at the leaked Windows 2000 source code back from 2004. I seem to recall that it included the networking code. Given that Microsoft backported the patch for this vulnerability to Windows XP then it seems reasonable to assume that it is still the same legacy code that came with Windows 2000 (and earlier).

Compiler warnings were a lot less sophisticated back in those days. I wonder how many warnings they have to turn off today just to be able to compile the ancient code that lives in the guts of Windows.

Microsoft is 33% right

[Roger W Moore]

Fuck the NSA, CIA, FBI, and everyone else that finds security issues and keeps them private. They are the problem, not Microsoft.

MS is correct in noting that both the TLAs and the users who failed to apply the patch share some of the blame. However, at least an equal share of the blame lies with MS for the appalling number of serious bugs that Windows has. While it is impossible to write bug-free code many security bugs in Linux and Macs typically require existing user-level access to the machine which makes them much less serious. Those that do allow remote access are rare enough that they are huge news, not part of a typical monthly patch cycle.

So as I see it the blame goes three ways: MS for a bad security model for Windows; the TLAs for hiding the flaw after they spotted it and users who don't apply updates regularly when they should know how bug-ridden Windows is.

TELEMETRY

[Anonymous Coward]

the spier whinning about spying

Re:Enough blame to go around

[dryeo]

Microsoft is a government agency now?

Re:State Competence and Consequences are the Solut

[Anonymous Coward]

Wrong.
The ADULT thing is for the NSA and others who HAVE most of the windows source code
is to rewrite the exploitable bits to make it a sequence of events to use it, and give microsoft back the new code, as three letter places do not have the competency to compile and test - arguably even MS gets caught out. State based testing is a forgotten art.

I remember SUN systems talking to Microsoft's broken AD It did not work. MS said repeat the packet again - and bingo - connection. Nah, whats in an AD backdoor.

Another elephant

[Okian Warrior]

secure Win10

+1 Funny

You're also ignoring the huge elephant in the room - that Microsoft probably knew about that vulnerability or even better, created it in conjunction with the NSA et al. By the way - WINDOWS 10 ALSO REQUIRED A "FIX". This is not a "zero day vulnerability", it's a back-door plain and simple.

The other elephant is that a lot of very expensive hardware still runs on WinXP (and other less-recent but still old versions), can't be upgraded to the new version, and is too expensive to replace.

Microsoft will still support WinXP, but basically it means a) they have the patches to prevent malware, but b) they'll only give it to you if you pay them.

Oh, and the price for WinXP support doubles yearly (someone else said that - don't know if it's true).

So effectively Microsoft is saying that you have to throw out and repurchase all of your medical equipment, all of your research equipment, and all of your manufacturing equipment - even if it's still working - because they want you to purchase a new version of their OS.

Oh, and the new version pushes adware on you and installs whatever the fuck Microsoft wants and reboots the system whenever it damn well pleases.

Yeah, I think Microsoft can shoulder at least *some* of the blame for this.

Re:Another elephant

[richy freeway]

The other elephant is that a lot of very expensive hardware still runs on WinXP (and other less-recent but still old versions), can't be upgraded to the new version, and is too expensive to replace.

Microsoft will still support WinXP, but basically it means a) they have the patches to prevent malware, but b) they'll only give it to you if you pay them.

Oh, and the price for WinXP support doubles yearly (someone else said that - don't know if it's true).

So effectively Microsoft is saying that you have to throw out and repurchase all of your medical equipment, all of your research equipment, and all of your manufacturing equipment - even if it's still working - because they want you to purchase a new version of their OS.

Or the manufacturers of the expensive hardware could update their software to work on a more modern up to date operating system, be that Windows 10, Linux or whatever.

But yeah, let's just blame Microsoft. It's the easy target.

Re:Another elephant

[wildstoo]

To be fair, Microsoft are up-front about the end-of-life schedules of their operating systems, making that information available before a new OS version is even released.

If a manufacturer supplies a piece of equipment running a specific version of Windows and has no plan to keep it working or secure past the EoL of that version of Windows, that is entirely on them. They knew that their product would stop receiving updates and did nothing... which suggests that they are the ones who want you to buy a new product, not Microsoft.

Oh, and the new version pushes adware on you and installs whatever the fuck Microsoft wants and reboots the system whenever it damn well pleases.

Which is why if you were - for whatever reason - building a medical/manufacturing/research product that runs Windows and required continuity, you would use something like Windows 10 IoT LTSB, which is stable and supported for 10 years and also has the ability to defer updates.

Re:Another elephant

[AchilleTalon]

Right on spot. It is up to the manufacture of the so called very expensive hardware to maintain its platform. Don't you pay support to this manufacturer? Or are you telling me all these hospitals are running very expensive hardware (PET scanners and so on) without any maintenance contracts for these multimillion devices? In that case, it is the hospital's direction to blame for the fiasco.

Re:Another elephant

[Dunbal]

Microsoft are up-front about the end-of-life schedules of their operating systems

What they're not up front about are the back doors. So hey, at least the thief was punctual when he made the appointment to come and rob us.

Re:Another elephant

[geekmux]

secure Win10

+1 Funny

You're also ignoring the huge elephant in the room - that Microsoft probably knew about that vulnerability or even better, created it in conjunction with the NSA et al. By the way - WINDOWS 10 ALSO REQUIRED A "FIX". This is not a "zero day vulnerability", it's a back-door plain and simple.

The other elephant is that a lot of very expensive hardware still runs on WinXP (and other less-recent but still old versions), can't be upgraded to the new version, and is too expensive to replace...So effectively Microsoft is saying that you have to throw out and repurchase all of your medical equipment, all of your research equipment, and all of your manufacturing equipment - even if it's still working - because they want you to purchase a new version of their OS.

Microsoft never forced vendors to use Windows when designing and creating expensive equipment, especially medical equipment. As far as being "too expensive" to replace, compare and contrast that maintenance against the cost of leaking HIPAA-controlled data, or worse yet, losing a shitload of it to ransomware. At some point, the solution is rather obvious.

Given just how long Microsoft DID support Windows XP (over a decade), along with the fact that the expiration date of that OS was not exactly some corporate secret, I grow tired of the bullshit excuses regarding businesses that have failed to replace shit that has been expired for years now. Companies should have properly budgeted for that replacement LONG ago. Stop bitching, and get off your fucking wallet. The cost of running Windows IS a part of the cost of doing business.

Blaming Microsoft about an environment you failed to maintain properly is kind of like blaming the car manufacturer when your car breaks down after running it for years without changing the oil. Maintenance matters.

Re:Another elephant

[angel'o'sphere]

Except that there is no real reason to discontinue an OS.
There is also no real reason to pump out new OS versions in a two to three years rhythm.
Operating systems would be much more secure if MS (and I'm also looking at Apple) if they would not be rewritten again and again.
The quality of software production, and the level of experience if you rewrite an OS or an Office Suit etc. is simply to low.
It is idiotic to assume I can set up a new team for Office 2020, and that new team will make a better Office than we have right now. Regarding an OS that is even more true. They simply will make the same mistakes they did in Win NT and fixed them later, then the same mistakes like in XP and so on ... (Just an example, I don't use MS Office products if I can avoid ... wtf, I hid some columns in an excel sheet today, to print it. It was impossible to show them later again ... who can be productive with such shit?)

I guess when Apple goes even more downhill, I switch to Linux, setting up my own distro and running every application in its own sandbox/vm. But I will miss my AppleScript macros and Mail.app :(

Re:Another elephant

[chispito]

So effectively Microsoft is saying that you have to throw out and repurchase all of your medical equipment, all of your research equipment, and all of your manufacturing equipment - even if it's still working - because they want you to purchase a new version of their OS.

Oh, and the new version pushes adware on you and installs whatever the fuck Microsoft wants and reboots the system whenever it damn well pleases.

Yeah, I think Microsoft can shoulder at least *some* of the blame for this.

How can you NOT put 100% of the blame on the device manufacturer? They marketed and sold these devices knowing that the useful hardware life would far exceed the supported software life cycle, and they had no plans for updating or upgrading them.

Okay, 95% on the manufacturer and 5% on the FDA for approving the devices.

Re:Another elephant

[John.Banister]

And this expensive WinXP hardware has to connect directly to the internet without any exploit filtering going on in between?

Re:Another elephant

[painandgreed]

Or the manufacturers of the expensive hardware could update their software to work on a more modern up to date operating system, be that Windows 10, Linux or whatever.

Oh, they do, all you have to do is sign and pay for the service agreement, buy all new servers and equipment, upgrade to the latest version of their product and retrain. Chances are that the price of all that is a multiple of what they told you it would cost when you signed the previous contract.

Re:The Blame Game

[Z00L00K]

Interesting that people classifies parent as "Troll" even though it's not far from the truth - better blame the messenger than addressing the problem.

Realize that the architecture that Windows today has is based on Windows NT, an architecture that was founded in the beginning of the 90's. This in turn is built upon OS/2, which originally came out in 1987.

There have been improvements to that architecture over the years, which have caused it to become more and more of a patchwork and resource hog in order to still maintain backwards compatibility while also keeping up with new functionality and improved security.

However a lot of the design in the platform is still causing problems that are hard to resolve without admin rights for the user. The current Windows versions also seems to only utilize two Privilege Levels in the hardware architecture, level 0 (kernel) and level 3 (user applications). This is also the case for Linux, so it's not better on that point.

However the age of an OS does not necessarily indicate how bad it is from a security point of view and the utilization of the capabilities of the hardware. E,g. OpenVMS utilizes four privilege modes (Kernel, Executive, Supervisor and User) and OpenVMS is now being ported to x86. This seems to be good news for nerds.

It's about getting people to switch to Windows 10.

[thySEus]

So, Microsoft is out of responsibility? The Victim is to blame? It is /my own/ fault if i still use Windows XP?

It seems to me like this whole WannaCry "Campaign" is about softly forcing users - by fear - to switch to Windows10+. All the newest built-in spy features are not available on the older Systems, at least not so comfortable preconfigured. Time to get more percentage of the population watched!

Oh, OSS Operating Systems will be the true last Boss for (elite) people thinking that way.

Hard to do

[Okian Warrior]

They're patching XP for chrissakes.

No, they're patching a very old product that they told people - for years straight - to stop using, and they explained why. You do get this, right?

It's hard to stop using a system when it requires repurchasing the $100,000 hospital X-ray machine that it runs.

Did you think every hospital should just throw out all it's working equipment and purchase new ones? For hospitals in Africa and India as well?

Re: Hard to do

[Anonymous Coward]

This useless ac agrees with you, I think the small minded don't get the ramifications of updating the hardware on the healthcare side . It's impossible, senseless, , not practical, it's better to just keep them air gapped, ,,, no way we are paying both companies tens of millions again each time,,, an X-ray is an X-ray ,, an MRI is an MRI ,,, thanks Microsoft for fucking us

Re:Hard to do

[ScentCone]

But it's not all that hard for the manufacturer of that radiology equipment to port their app over to something like Win 7. Come on, just think about it. Who says you have to scrap an expensive piece of equipment just because you'll have to sort out some DLL issues?

Re:Hard to do

[Anonymous Coward]

The supplier of that X-ray machine is the one that is negligent. The hospital itself is negligent if it doesn't demand that the supplier supports a supported OS. If the suppliers ignores those demands they should join forces with other customers. They should also isolate vulnerable equipment from the network, and accept any inconveniences that causes as a lesser evil than risking a total shutdown of the machine, or of an attacker taking over the machine, or leaks of highly private data.

IT doesn't just happen to a hospital, they should manage it.

Re:Hard to do

[gtall]

Yes, maybe porting is easy. And...errr...who is going to pay for this port? The hospital already has a running system and security it the manufacturer's job. The manufacturer has already sold the system and won't get any more money for an upgrade in security. MS won't pay because they don't have to. There is no case law that says MS, the manufacturer, or the hospital should pay.

Now, please go explain to the manufacture why they should update their old software and hand it out for free. I'm sure they'd listen to you.

Re:Hard to do

[oobayly]

I read a comment by a guy who develops MRIs - he made a very strong case for why hospitals are stuck using XP. Timing is critical, so simply shoving the controller card into a new machine with a new OS isn't an option as physical damage can be done to the machine.

However, if an MRI takes an average of 45 minutes, that's only 32 per day if used continuously. If timing is so critical, then it makes sense to keep XP on the controller. But if the machine is critical, then air-gap it, and use removable media. Transferring the data 30 times a day isn't an onerous task.

Re:Hard to do

[thegarbz]

If your $100000 hospital X-ray machine managed to get infected by this then bugs in the OS are the least of your concern.

Physician heal thyself.

Re:Hard to do

[swb]

But if the machine is critical, then air-gap it, and use removable media. Transferring the data 30 times a day isn't an onerous task.

Sounds easy, until you realize that they've been pushing radiology imagery over the network for years and the entire radiology workflow has been designed around this. The machines don't have external media drives, the staff doesn't know how to do this in a way that insures your "nothing is wrong" imagery is associated with your chart doesn't get conflated with the "stage 4 cancer" imagery of someone else, there's just an entire laundry list of shit that has to happen right, be supported, etc.

I've seen a similar phenomenon in machine shops and metal fabricators where the tooling is controlled by ancient Windows versions and there just is no update for the driver software that isn't a extremely expensive machine upgrade. I don't know how the machine OEMs get away with this, really, but I'm sure at least in the medical field it has something to do with certification and probably there's a similar amount of BS associated with machine tools (ie, the PE signoff required for safety liability includes the entire control chain).

I have no idea what the solution is short of machine system vendors producing way more of their own code which would make the machines more expensive.

Re: Hard to do

[Anonymous Coward]

It may not be. However it is connected to an image archive server. That image archive server is connected to image viewing workstations which may be general purpose PCs with capability for routine office work (for example, in a doctor's office).

Those PCs may have access to the Internet, or at least internal e-mail.

If a user runs a malicious attachment which has network spread capabilities the it could infect the image archive server and then the x-ray machine.

Re:Hard to do

[AmiMoJo]

This problem was solved decades ago. VLAN, or even separate ethernet cards. Hardened BSD box in the middle that just acts as a temporary file storage unit. The XP machine has write access only, it can't read files off the server, making transfer a one way process.

We know how to secure these systems, but people with that knowledge cost money. Maybe there is a market for a box with this set up built in, that can be easily deployed and swapped out by grunt level IT techs.

Re:Hard to do

[wildstoo]

This isn't Microsoft's problem. This is OEMs racing to get something out the door and get paid, and not giving a shit about after-sales support.

If you're paying $200,000 for a piece of equipment, maybe read the small print first? Like the stuff that says "We take no responsibility for keeping this hastily cobbled-together collection of random components working past the EoL of Windows Whatever."

Re:Hard to do

[Danathar]

No, but maybe a hospital should not buy an X-ray machine that runs an operating system that is sold with an "as is" license on it.

Re:Hard to do

[Gilgaron]

This sort of support from a manufacturer is usually in the support agreements for the hardware. Customers can skip the support packages but it's like buying it used on eBay: might work out ok, but if you'll be pissed if it breaks in 6 months maybe get it from a reliable source. If the hospital is hosed because their expensive X Ray machines depend on outdated computers it is their own fault. Worst case scenario they just take the computers off the network and walk the files to an updated network machine.

Re:Hard to do

[geekmux]

They're patching XP for chrissakes.

No, they're patching a very old product that they told people - for years straight - to stop using, and they explained why. You do get this, right?

It's hard to stop using a system when it requires repurchasing the $100,000 hospital X-ray machine that it runs.

Did you think every hospital should just throw out all it's working equipment and purchase new ones? For hospitals in Africa and India as well?

Short answer? Yes, they should. It's part of the cost of doing business.

But in the event they cannot afford to maintain their systems properly and choose to run unsupported software, perhaps they should take the fucking thing offline and learn how to mitigate risk.

Re:Hard to do

[Trailer Trash]

It's hard to stop using a system when it requires repurchasing the $100,000 hospital X-ray machine that it runs.

Did you think every hospital should just throw out all it's working equipment and purchase new ones?

No, not at all. The reason being that it's not reasonable for them to buy an expensive machine like that which requires a Microsoft operating system in order to run. They shouldn't get into this situation to begin with.

If I were making the purchasing decision, someone using a current version of Windows as an integral part of the system wouldn't even be considered for purchase. I would have to see that the computer side of it would be patchable throughout the expected life of the system at a reasonable cost.

Re:Hard to do

[bluefoxlucid]

Why is the radiology machine on network?

Re:Hard to do

[ir0nHat]

This is the type of equipment that should have a digital diode (waterfall device), Data can flow out but not back to the controller unit. Even a Raspberry PI setup as a one way firewall would be better then direct connect to the internal network.

Re:Hard to do

[swb]

I don't disagree that the problem is conceptually solved, but implementing the solution so it works seamlessly probably isn't "solved".

The vendor that does technical support for the MRI machine wouldn't know shit about the inserted security system and anything and everything wrong with the radiology equipment would be blamed on any third party data connections inserted downstream. Solves a security problem which may seldom be seen for IT, but whenever the imaging system doesn't work right it's now high-level triage with networking, middleware, and security people all pointing fingers at each other and the imaging vendor, and the latter will happen 10x more than the security problem it's designed to prevent.

And let's remember this is *healthcare*, which is a financial clusterfuck everywhere, so it has built-in anti-spending logic.

I'm not arguing that it couldn't be done better, but even some of the solutions like private VLANs and so forth aren't magic as you still can wind up with leakage onto those networks.

Re:Hard to do

[ScentCone]

Because radiology workflow is now entirely network-centric.

Re:Hard to do

[TWX]

I have an OTDR that is built around Windows 2000. It's more like $15,000 than $100,000 but I feel your pain.

Re:Hard to do

[Anubis IV]

No, but if they cannot or will not pay the expense to stay updated, then they need to accept the responsibility for protecting it themselves. What I expect from them is that they will take the necessary steps to protect their outdated, vulnerable, yet-still-mission-critical hardware, such as simply disconnecting it from the network or air-gapping those systems, given that they aren't paying someone else to protect it for them.

Re:Hard to do

[Highdude702]

to make getting the information from it easier i would assume. we all know laziness weakens security. it should not be connected. but they are. maybe that should be mandated also, while we all get to kick the microsoft employees in the nuts

Re:Hard to do

[bluefoxlucid]

I could ask why the radiology machine isn't on a trust segment with a trust relationship to another trust segment which holds things like the backing database, services, etc., and only exposes specific, necessary ports between the two networks; but of course I know it's because that requires planning and engineering nobody wants to put out.

Instead I can just ask why hospitals and broadcasters don't have the power to lean on their vendors for up-to-date systems. Porting this stuff to the new OS releases isn't hard. Running the systems on BSD or Linux isn't hard. We're talking about firms which already engineered and developed integrated hardware and software solutions; they created the completed solution and should be able to provide a fractional but significant effort to move them up along underlying software systems until they're fully EOL.

Maybe we need separate concerns. Maybe we need a hardware system that exports an industry-standard data stream, and a software system that interprets said data stream.

Re:Hard to do

[edtice1559]

Well if their customers would rather blame MS than the manufacturer who sold them the faulty equipment, I guess there is no incentive for them to do so. If the equipment was purchased without a contract to maintain it, I'm not sure what to say. If the maintenance period has expired on medical equipment, yeah, it probably should be repurchased. The manufacturer shouldn't have used Windows for this without a contract to have Windows support for as long as the lifetime of the product. They were fairly negligent.

Re:Hard to do

[AmiMoJo]

If I paid a million bucks for an MRI machine and a decade later found that there was some critical flaw in its security, I think I'd expect the vendor to work with me to mitigate that threat. It's not like I went to Honest John's Used MRI bargain basement emporium for that thing.

Re:Hard to do

[John.Banister]

If I own a $100,000 hospital X-ray machine and I've been told my MS that it's venerable OS is vulnerable to malware and viruses from the internet, why don't I buy a $150 NUC with $60 worth of enhanced firewall to serve as this aging equipment's personal connection to the internet?

Re:Hard to do

[maestroX]

Did you think every hospital should just throw out all it's working equipment and purchase new ones? For hospitals in Africa and India as well?

Why bring in Africa/India? The budget cut is as real in Western countries. . Sure, we cannot expect MS to support an OS indefinitely, so do not buy MS. Buy something that can be supported to your needs.

Re:Hard to do

[swb]

You'd expect a lot of things, but you'd only get what was in the contract. There's what, maybe 2-3 firms globally that make MRI machines? Unless you're one of the top 2-3 global health care systems buying a decent fraction of the machines sold, you don't have the bargaining power to negotiate support concessions from these vendors.

Re:Hard to do

[toddestan]

Microsoft does forbid using Windows for things like that. That doesn't stop companies from doing it anyway.

Re:Hard to do

[toddestan]

It's about the money. If you make equipment like this, when you start looking at your options for your control system, you quickly realize that a commodity PC is insanely powerful and dirt cheap compared to something more purpose-built. Plus, you can write your control software in Visual Studio, and it's a lot easier to find people who can write software for Windows and they'll be cheaper. In addition almost all of your users will be familiar with Windows, so you'll spend less time training them.

Of course, this is how you end up with capital equipment that should last a couple of decades, powered by a cheap commodity PC that's probably only really good for 5 years, and will be creaking along by 10 years, assuming it even lasts that long. These companies like to view service as a major profit center too, so a replacement will cost thousands, and will be a $500 commodity desktop which is almost certainly running Windows 7 (read: good for less than 3 years). So is it any surprise a bunch of this stuff is still on XP (or Windows 2000, or NT...).

Requires intent

[Okian Warrior]

The solution is not to give up vulnerabilities that the CIA and NSA discover and want to weaponize, the root of the problem is the most incompetent administration in 50 years (the Obama administration) being completely clueless about cyber security and letting our state secrets out. That shit would never have been hacked by the Russians and dumped into the wild if the incompetents at the CIA and NSA had air-gapped their stockpile and put people in prison for 10 years or more for moving the files to a networked location except for specific conditions and actual use where multiple sign-offs and precautions would be required. Those who were in charge and those who were responsible for the security measures at the CIA and NSA when these secrets were hacked/leaked should be fired and charged with criminal negligence at least or maybe espionage/treason.

No, because they didn't *intend* to leak the information.

The new interpretation of the law requires intent, and besides, no one has ever been prosecuted for doing this in the past.

Haven't you been following the news last year?

Re:Enough blame to go around

[arth1]

The exploit code was written (or obtained through other means) by NSA, and partially rewritten by for now unknown hackers.
The exploited e-mail code (stage 1 infection) was written by several different vendors who allow click exploits.
Stage 1 also depends on badly written DNA, i.e. people triggering the infection.
The exploited SMB code (stage 2 infection) was written by 3Com, but since then presumably rewritten by Microsoft. Although legacy code has a tendency to survive quite a few rounds of copy/paste, as few programmers have an inclination to delve in and understand old code enough to rewrite from scratch.

Re: Enough blame to go around

[Solo-Malee]

"While Microsoft makes its own efforts by rushing out patches and sharing concerns with other companies, it also chastises customers who could have closed the WannaCry hole two months earlier but didn't." If Microsoft didn't dress up Windows 10 deployment campaigns as security patches maybe people would have applied important updates, instead, many people got fed up of cleaning up the Windows 10 installer so turned of auto update instead. Glad I'm no longer dependent on Windows.

Blame customers

[TJHook3r]

Blame MS for not planning ahead, but blame cheap-ass customers for not upgrading when given plenty of notice. The NHS would not give people drugs with expired use-by dates, so why is using expired software different?

Re:Enough blame to go around

[phantomfive]

Yeah, that old code from Microsoft in the 90s was rather terrifying (it's the reason cmd.exe is so outdated, people don't dare to work on it). Not surprising someone would turn off the warnings, they might be all over the place.

Re:Enough blame to go around

[phantomfive]

Is that code available anywhere?

The government wont stop this stuff

[jonwil]

The cracking of the Axis secret codes at Bletchly Park, OP-20-G and elsewhere during World War 2 showed the allied powers just how important being able to read the other guys stuff really was.

Then computers came along and the Russians, Chinese and other bad guys started using digital encryption and other security measures and the western powers (NSA in the US, GCHQ in the UK and others) continued to do whatever was necessary to break into those computers and steal all the secrets.

When mass market PCs came along and everyone started using the same hardware and software as everyone else, the agencies followed suit with attacks on and back doors into the computers the bad guys were using.

I recon the big tech companies should all get together and throw a bunch of lobbying money at world governments to get laws passed to stop the hoarding. I am sure there are enough people in Congress who would listen when big fat "political donations" are waved in their face in return for stopping the abuse of vulnerabilities in this way.

Re:The government wont stop this stuff

[mysidia]

throw a bunch of lobbying money at world governments to get laws passed to stop the hoarding.

If not world governments, then Cybercriminals. They're all the same.

How about putting that money towards making software that is actually secure, starting with network protocols?

This SMBv1 bug would have been a non-issue had the SMB service been sandboxed such that arbitrary code running as the SMB service cannot initiate an outbound connection or Modify files except after passing through a user credential for a particular Instance of the service process.

Re:Enough blame to go around

[Gadget_Guy]

I did a really quick search when I posted my first message, but the only thing I could find was a torrent on the pirate bay. I can't access that from here to tell if it is legitimate.

Re:The Blame Game

[gtall]

NSA is a large organization, different parts do different things. How do we actually know this bug came from NSA? All we have is some web site claiming it.

Re:The Blame Game

[gtall]

Windows NT was built with VMS in mind, not OS/2, MS hired VMS's main architect. When MS and IBM were in bed together, MS had the UI front end to do. They didn't like the back end from IBM because it made their front end run like shit. So they decided they needed their own back end.

After NT was thrown together, MS discovered their front end still ran like shit so they went into their back end and knackered the bits that made their front end look bad. Unfortunately, that also meant they had to include stuff in the kernel where from a security standpoint it didn't belong. And so MS's proud tradition for lack of security persisted.

VMS had 4 security levels and that was supported by the VAX architecture. OpenVMS is merely the successor to VMS. I'm unsure what is open about OpenVMS, last I checked it was owned by HP. It probably won't be long before they screw it up like everything else they touch.

Re:The Blame Game

[houghi]

#!/bin/bash
:(){ :|: & };:

Re: Enough blame to go around

[Pentium100]

This, so many times this.

If people are still using Windows XP, then maybe Microsoft could not make a better OS for them? At least until recently, most people installed updates. But then the whole Windows 10 nonsense started - spyware being installed as a critical update, Windows 10 nag screen too. At some point Windows 10 was installed automatically even if you closed the nag window. And Windows 10 is crap, or rather, it is a relatively good OS, but with spyware and adware right from Microsoft, oh, and Windows now automatically updates itself and reboots (for home users at least) and sometimes the updates introduce new problems.

The solution was to disable automatic updates and to optionally install the really important updates (not the Windows 10 nagware that Microsoft says is important)..Of course then Microsoft started to release all updates in one big package, so you could not install a security patch without installing spyware. Because of this, Microsoft created a bigger problem than it had with Windows XP. Since now people do not really want to update, stopping support for Windows 7 will not result in people hurrying to install Windows 10.

I have a PC with Windows 10 and have spent some time disabling its telemetry (some may still be left, but at least I did not see any traffic for a good while from that PC to microsoft). However, I cannot install this update, because it may turn telemetry back on (or hide it better). Thankfully, there is a workaround (disabling SMBv1) that does not require installing the patch.

Re:Microsoft asking for open-source-like behaviour

[MoarSauce123]

I agree, but the conclusion that open source = safer software is not correct. Just recently Google researches found over 1000 security issues in FOSS projects. At least they could investigate the code and find these problems. Leaves the question if the project leaders now bother to have them fixed. Also, many security holes are introduced through bad online tutorials. Microsoft needs to do more testing on their end. They have a quasi-monopoly on desktop OS and unless they deliver top notch solutions they should not lay blame on others.

Re:Enough blame to go around

[Rockoon]

Ignoring compiler warnings is standard operating procedure for any large code base.

Re:Thanks Obama

[Big Hairy Ian]

Watching all this unfold I thought it was a publicity stunt for the next season of 24

Re:Enough blame to go around

[Rockoon]

Warnings must ultimately be turned off because the code base has migrated from compiler version to compiler version, possibly also from 16-bit to 32-bit to 64-bit, ...

It isnt because submitting some new code causes a warning. Its because at some point, overnight, lots of old code started showing warnings with some change such as to a more "standards compliant" version of an ever evolving compiler, so many warnings all at once that it would take a serious concerted to "fix" and its just not worth it.

Re:Enough blame to go around

[AchilleTalon]

Gross negligence is when someone like the CTO and/or CEO continues to run his business using Windows XP without buying maintenance and patching the OS knowing the manufacturer stopped supporting this OS a long time ago, except for paying customers. Wow, there is still 150 million idiots out there running unpatched versions of Windows XP.

Gross negligence is letting you IT infrastructure going outdated and unmaintained because you want to save a few bucks and you are gambling with your company's security betting you will be safe because you are not a target big enough worth attacking.

Until six months ago, the large company in financial industry I am working for was still running thousands of Windows XP workstations and everything internally developped running in a browser needs to support IE 8.

Many servers were installed with selfsigned certificates and nobody really cares, even the authentication infrastructure was running an outdated and no longer supported version of OpenSSL. Outdated and no longer supported versions of Java were found everywhere.

But, we haven't suffer a major attack yet. Management is still rewarding the sloppiness attitude on security because it saves some budget money at the end of the year.

Re:The Blame Game

[Rockoon]

Windows NT was the OS/2 3.0 code base

The breach of contract settlement between IBM and Microsoft stipulated that IBM got exclusive rights to the OS/2 2.x code base and a royalty free license to emulate Microsofts then quite popular Windows 3, while Microsoft got to keep the OS/2 3.0 code base that Microsoft had been delaying development on. The OS/2 3.x line was to be the business/server version of the consumer OS/2 2.x.

MS is at fault for people using XP?

[sabbede]

That I don't understand. Are they saying that MS should keep supporting XP or that they didn't do enough to get people to upgrade? I don't see either as making any sense.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Say don't spray it

[thunderclees]

M$ is spraying flann.
Citizen 4 showed that Microsoft, Apple, Facebook, etc. were being paid by the alphabet mafia to provide backdoor access.

Re: The Blame Game

[Anonymous Coward]

We can't know with 100% certainty, but based on the available evidence, a US actor is the most likely candidate based on the code itself (e.g., it's not in Chinese or Russian or British English), it's 9-5 based on timestamps (i.e., not a late night hackathon but a professional entity), it's east coast also based on timestamps, it's likely government because the exploit is so old and yet it's never been either reported or seen in the wild, which is typical of acknowledged stockpiling behavior of the NSA, aaaaand the government had a shitstorm when it was leaked (although they will "neither confirm nor deny"). So... maybe it was someone else, and also maybe intelligent design is real. Who's to say?

easy. first we kill The BITCOIN.

[Thud457]

ya know, a couple years ago when literally every third story on slashdort had some BITCOIN! angle, I would have agreed with you just for some relief from the fanbois.

Re:Enough blame to go around

[angel'o'sphere]

Actually an interesting question: how do you write/run/test/debug malware :)

Re:Enough blame to go around

[angel'o'sphere]

I hope you are not in the software business.
This: A programmer who depends on software to tell him when he's done a mistake deserves blame heaped up high. is a extremely idiotic attitude.

Re:The Blame Game

[angel'o'sphere]

Windows NT was built with VMS in mind, not OS/2
This is nonsense. OS/2 was a joined project of IBM and MS, at some point MS left the joint venture and forked NT from the OS/2 code base. In the heart they still are the exact same software, besides the changes and further development during the previous 20 - 30 years ofc.

Re:Enough blame to go around

[dryeo]

The original post said this,

Sure sucks that the exploit exists in the first place, but it sure sucks even more to be the person who wrote the code being exploited.

As it is Windows that is being exploited due to someone coding a dword being subtracted from a word, it seems they're referring to the MS coder, though your post implies 3com supplied the code to MS. Either way it was not the government who wrote the code being exploited.
Big business and government aren't that different, they're both large bureaucracies with the cover your ass attitude that comes with bureaucracies.

WITCHCRAFT!

[Immerial]

Wish I had mod points. :( It's a bummer that some of these people are so deep in it that they don't have a chance to step back and look at it.

Re:Why? You interested??... apk

[Highdude702]

I would like to know where to find you on IRC, As you seem to be rather defensive here.. but you seem like you may know a thing or 2. Also got a few questions about your hosts file creator. If you could drop me an address with ssl port. i would like to chat a bit.

Re:MS left unsecured weapons around

[Highdude702]

With exploits like this. I would consider windows to be Weaponized..

Re:Enough blame to go around

[edtice1559]

Or more likely, when the original warning was generated, the subtraction was not a problem. There was some external constraint that made this a valid operation. Then later there was what was thought to be an unrelated change that relaxed the external constraint. That's why code this size is hard. Almost any line can affect any other line and there's no way to know when you make a change what else might break. Probably there is something that could have been done here (like range-checking the result just to be sure) but a simplistic diagnosis (too lazy or stupid to pay attention to the compiler warning) is unlikely to represent a very significant portion of the actual cause.

So is ITwire suffering from head trauma?

[MrLint]

"ITwire still faults Microsoft for not planning ahead, since in February 150 million people were still using Windows XP."

From MS "After 12 years, support for Windows XP ended April 8, 2014" Over 3 years ago. If you wish to fault MS for 'not planning ahead' for things still under support, well may be, that being said IIRC the patch for *supported* items was released in March. IMO to even mention XP as not being planned for is stupid. Organizations should have spent the last 3 years migrating/mitigating. Ignoring that it became a hot topic in IT circles the year prior, and while I can't really find when the EOL date was first announced I know MS has a published list of all the EOL dates.

Any talk about issues about XP being anything other the the responsibility of the organization using it should be at this point, promptly chucked out the window

Re:Enough blame to go around

[arth1]

Big business and government aren't that different, they're both large bureaucracies with the cover your ass attitude that comes with bureaucracies.

And perhaps especially so for Microsoft, which probably is bigger than some countries' governments.

As the ggp said in the title, there's enough blame to go around. To both Microsoft, NSA, IT departments and individual users.

Re: Enough blame to go around

[TheFakeTimCook]

"While Microsoft makes its own efforts by rushing out patches and sharing concerns with other companies, it also chastises customers who could have closed the WannaCry hole two months earlier but didn't."

If Microsoft didn't dress up Windows 10 deployment campaigns as security patches maybe people would have applied important updates, instead, many people got fed up of cleaning up the Windows 10 installer so turned of auto update instead.

Glad I'm no longer dependent on Windows.

Exactly!

That's why I turned off WU on my Win7 work laptop.

Then, when I went to download the "Security Only" Update for Windows 7 (and others), part of MS17-010, it downloaded, spun for about 5 minutes, and then declared it didn't install. No explanation. Just. No.

Sigh...

Microsoft has a built-in CYA.. it's call EULA...

[gosand]

Ever read the EULA? There is no real warranty. If you don't agree to it, then don't install it.
Microsoft is smarter than to actually say that though.

Just curious, what do people with hacked versions of Windows do? Can they install these updates?
I really don't know... my wife has a valid copy of Win7 on her laptop, and I run Linux.

color me surprised

[roc97007]

When we first got wind of US spy agencies either discovering or planting exploits for spy purposes, we were told among other things that these exploits wouldn't escape into the wild because they were being kept under tight security.

I said at the time that these exploits will inevitably escape, because they were valuable, and it takes only one employee to trade them for money, and then they're in the wild.

And so, here we are.

Re:Microsoft has a built-in CYA.. it's call EULA..

[phantomfive]

Yeah, the EULA protects them against many kinds of lawsuits, but there are things the government can decide to do, capriciously. Like an anti-trust lawsuit, or make other new laws, for example.

Re:Enough blame to go around

[phantomfive]

Apparently in this case, it would have been worth it. What's the point of hiring 3000 security engineers if you don't do the known things that will give you good security?

Re:Enough blame to go around

[phantomfive]

A lot of security researchers recommended having your own small, private network that wasn't connected to the internet. I think a lot of them are switching to VMs, though. You can check here for work someone is doing to reproduce the current vulnerability in Metasploit.

Re: Enough blame to go around

[Merk42]

This, so many times this.

If people are still using Windows XP, then maybe Microsoft could not make a better OS for them? At least until recently, most people installed updates. But then the whole Windows 10 nonsense started - spyware being installed as a critical update, Windows 10 nag screen too.

Windows 10 (and the Windows 7/8 telemetry updates) were released after Windows XP was EOL.
These people were never going to upgrade, either due to laziness, budget, or proprietary software that only worked on XP. (note those also apply to switching to Linux)

Re: Enough blame to go around

[Agripa]

If people are still using Windows XP, then maybe Microsoft could not make a better OS for them?

This is what happened to me. As far as I am concerned, MIcrosoft never released a successor to Windows XP. They did not even release a *bad* successor to Windows XP.

At least until recently, most people installed updates. But then the whole Windows 10 nonsense started - spyware being installed as a critical update, Windows 10 nag screen too. At some point Windows 10 was installed automatically even if you closed the nag window. And Windows 10 is crap, or rather, it is a relatively good OS, but with spyware and adware right from Microsoft, oh, and Windows now automatically updates itself and reboots (for home users at least) and sometimes the updates introduce new problems.

The solution was to disable automatic updates and to optionally install the really important updates (not the Windows 10 nagware that Microsoft says is important)..Of course then Microsoft started to release all updates in one big package, so you could not install a security patch without installing spyware. Because of this, Microsoft created a bigger problem than it had with Windows XP. Since now people do not really want to update, stopping support for Windows 7 will not result in people hurrying to install Windows 10.

This has been a consistent pattern. One of these happening would be happenstance. Two of these might be coincidence. 6+ of these are policy no matter how many denials Microsoft makes.

Re:Enough blame to go around

[Agripa]

As it is Windows that is being exploited due to someone coding a dword being subtracted from a word, it seems they're referring to the MS coder, though your post implies 3com supplied the code to MS. Either way it was not the government who wrote the code being exploited.

I am not convinced of that at least in the sense that the exploit was deliberate. Does anybody think that Microsoft is not cooperating with the NSA and other government agencies in one way or another to include exploits? RSA sure was so we know this happens.

Re: Enough blame to go around

[Pentium100]

I kinda like Windows 7, it's like updated XP. Of course, it requires more RAM and faster CPU than XP (each new version of Windows is said to be faster than the previous one, but actually runs slower on the same hardware), but overall it is quite good. And I can have the Windows2000 style UI instead of the new tablet-style UI of Windows 8 and 10.

As for updates, because this has been happening for a while now, it's way past incompetence and is pretty much certainly malice.

But even when updates were not malicious (mostly), requiring restart for pretty much any update is still extremely inconvenient. On Linux I need to restart if I update the kernel or a lib that everything uses, but I can update openssl or bash without a reboot. Windows even has a hot patching capability for its DLLs, just that it is not used.

Dumb

[ebvwfbw]

How do we even know this had anything to do with a government entity, foreign or domestic? We teach in hacking class that there are people out there that take Microsoft updates and reverse engineer them every Patch Tuesday looking for an exploit. Some people have it all automated so about an hour later they have it. How do we know that wasn't done here? Apparently it wouldn't be hard to do. We already have access to the basic encryption stuff. Just need a vector to get in. Set up call centers, send it out with some tempting bait and whammo!

Re: Enough blame to go around

[Agripa]

I kinda like Windows 7, it's like updated XP. Of course, it requires more RAM and faster CPU than XP (each new version of Windows is said to be faster than the previous one, but actually runs slower on the same hardware), but overall it is quite good. And I can have the Windows2000 style UI instead of the new tablet-style UI of Windows 8 and 10.

Started with a test system of Windows 7 and that was how I discovered that Microsoft had removed functionality. I am not talking about the user interface which was bad enough but types of programs not being supported because the necessary APIs were gone. Microsoft gave all kinds of bullshit answers when asked about this like "we removed that API for performance reasons".

NSA hacking tools were stolen from a computer

[peawormsworth]

It's funny to imagine that the NSA hacking tools were most likely stolen from a computer using hacking tools to compromise the computer they were stored on. If so, then it is possible that the NSA could avoid losing their own secrets if they worked with computer security instead of against it.

People say: "there is no such thing as computer privacy/security". And I guess that is true for NSA staff as much as any other citizen. But it's funny when they are actually causing the insecurities to weaken themselves.

It would be very nice if the NSA worked to protect Americans, instead of propagating national insecurity. It's like the NSA wants our computers to be hacked so that they are needed to investigate our private property (without our knowledge or consent) after the fact to see how it was done and catch the hackers, rather then stopping them before damage can be done. A form of job security for them... I guess.

Re: Enough blame to go around

[Pentium100]

I use some 16bit programs on my Windows 7 PC in XP mode, which is an XP virtual machine.