Slashdot Mirror
Group Linked To NSA Spy Leaks Threatens Sale of New Tech Secrets (reuters.com)
Hacker group Shadow Brokers, which has taken credit for leaking NSA cyber spying tools -- including ones used in the WannaCry global ransomware attack -- has said it plans to sell code that can be used to hack into the world's most used computers, software and phones. From a report on Reuters: Using trademark garbled English, the Shadow Brokers group said in an online statement that, from June, it will begin releasing software to anyone willing to pay for access to some of the tech world's biggest commercial secrets. In the blog post, the group said it was setting up a "monthly data dump" and that it could offer tools to break into web browsers, network routers, phone handsets, plus newer exploits for Windows 10 and data stolen from central banks. It said it was set to sell access to previously undisclosed vulnerabilities, known as zero-days, that could be used to attack Microsoft's latest software system, Windows 10. The post did not identify other products by name. It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs, without providing further details.
It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs, without providing further details.
Are they attempting to ensure that there's no safe harbor for them anywhere in the whole world? Seems like if one pisses off the USA, Russia, and China, that there's no country in the entire world that wouldn't give up these people to someone if their identities are uncovered.
This makes me wonder about the legitimacy of the claims, and if they're really from a group with this kind of power or if they're just someone trolling for teh lulz.
Do not look into laser with remaining eye.
It's only a matter of time before some hair brained bureaucrat suggests blocking bitcoin transactions as a means to prevent criminals from funding themselves.
Considering their last attempt to sell such data was somewhat lacking in buyers, I'm curious why they don't just ring up WikiLeaks, get a semi-decent payday and be done with it.
Unless, of course, it's the intel agencies themselves playing the part of TSB seeing who they can reel in on their fishing expedition.
Erh... no. Allow me to shed some light onto this.
I've been in IT security for about 10 years now. For most of this time, security was but an afterthought. Security is the equivalent of insurance or military: Expensive and utterly useless unless you really, really need it. Be honest, do you need fire insurance? As long as it doesn't burn anywhere, it's just a waste of money. And for the longest time, there was no fire anywhere in IT. Yes, from time to time there was a bit of a problem. A worm that dug into millions of computers. Or some big company was hit by a hack that did minimal damage.
The problem here is that the damage was simply not high enough to warrant employing people who cost 6 figures a year and can't even guarantee you to be protected against anything that may come your way. Take this highly simplified risk calculation: If your potential damage in case the risk manifests isn't higher than the chance of it manifesting times the cost to mitigate it, it is more sensible to just carry the risk.
And for the longest time, this was the case. Imagine a potential damage of a million bucks per incident. If that happens once every ten years in your company, your annual cost to mitigate must not be higher than 100k. And 100k isn't really much money in ITsec.
If it costs more, you're better off just taking the hit once a decade.
For the longest time this was actually a sensible way to operate. Financially sensible. We've been warning about something like this for years. It was pointless, because the risk never manifested as incidents.
Now the incidents happen.
And now it is too late. We're in too deep to recover. Most of the software and hardware we use cannot be sensibly secured, because, as noted before, security is an afterthought and was not part of the fundamental design. Take HTTPS of all the things. What is it, essentially, but a thin security fig leaf on top of http? And we're still dealing with crucial infrastructure like DNS and DHCP that are by no means secure (not only because they still use a protocol where you can't even sensibly find out who the hell sent the packet in the first place), and while secure replacements exist, their implementation cost too much. Not only because we'd need new hardware.
More importantly, we'd need better trained administrators. Wait, more precisely: We'd need administrators that get at least basic security training. When you see people shrug at you when you tell them that using self signed certs is not ok and you get back a "what's your problem, it IS encrypted, what else do you want?", you know that the person does not even understand what he is doing here. We are critically underprepared for what's coming our way, what we see here is the tip of the spear that's going to hit us right into the chest.
And we will not have the time left to don armor.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
> Using trademark garbled English,
I wonder if they translate and reverse their releases to help defeat style-analysis on what they write.
Your hair look like poop, Bob! - Wanker.
I was just watching Pearl Harbor - not a great film, but it brought back to me that the greatest threat to these people is the sheer force of American willpower. The Japanese military machine tugged at the tail of a sleeping tiger, and they lived to regret it.
I doubt American willpower was a serious contender considering the other side had people litter lay training to be suicide bombers. Americans troops typically were the first to break and run away. We had some advantages in that Americans were also the first to rally and run back into battle with more resolve, and with a different plan to make sure the last mistake didn't happen. The first mistake the Japanese did was mistakenly think that bombing people would make them want to give up. If anything, actively bombing a population has the opposite effect. Second, the sleeping tiger that the Japanese actually awoke was American industrial might. The Japanese could not replace sunken ships, downed airplanes, or dead pilots and soldiers. They US was pumping out enough for two fronts to double every year or two (not to mention while also supplying the Brits and Russians with considerable war material at the same time). Part of that was bad Japanese military tactics that aided in their downfall just like Sparta, while the US will try a different tactic till they find one that works, but mostly, it was just American has the industry, economy, and population to win a war through attrition.