Slashdot Mirror
Chinese State Media Says US Should Take Some Blame For Cyberattack (cnbc.com)
An anonymous reader shares a CNBC report: Chinese state media on Wednesday criticized the United States for hindering efforts to stop global cyber threats in the wake of the WannaCry ransomware attack that has infected more than 300,000 computers worldwide in recent days. The U.S. National Security Agency (NSA) should shoulder some blame for the attack, which targets vulnerabilities in Microsoft systems and has infected some 30,000 Chinese organisations as of Saturday, the China Daily said. "Concerted efforts to tackle cyber crimes have been hindered by the actions of the United States," it said, adding that Washington had "no credible evidence" to support bans on Chinese tech firms in the United States following the attack. The malware attack, which began on Friday and has been linked by some researchers to previous hits by a North Korean-run hacking operation, leveraged a tool built by the NSA that leaked online in April, Microsoft says.
Blame Microsoft.
Well, that kind of "blame" is a step up from the traditional Chinese statements about the US:
(Wait, were those quotes from Chairman Mao or from Elizabeth Warren and Bernie Sanders?)
coming from *china*. are they just getting more jealous every time putin and trump drop trou?
"no fair! we have to spy and hack and steal our way to obtain your secrets, but you just fucking GIVE THEM AWAY to the russians!"
If only the NSA reported the vulnerabilities to Microsoft first.
It's not just the Chinese saying "blame the NSA".
https://www.washingtonpost.com...
http://www.zerohedge.com/news/2017-05-14/microsoft-slams-nsa-letting-its-hacking-tools-cause-global-malware-epidemic
But.. but.. what about american exceptionalism?! Cultural imperialism? Manifest Destiny? New Amerikan Century? Good Guys versus Bad Guys? NSA created those exploits to make the world more peaceful and a safer place, Citizen!
If the National Security agency had actually given a shit about security, it would help companies fix these problems before they are exploited in the wild, rather than hoard and weaponize them. They made a conscious decision to attack security rather than enhance it. As a result, critical infrastructure such as hospitals have suffered, and we haven't seen the end of it yet.
It is a rogue agency, and needs to be brought to heel. When parts of the government start treating its own people as enemies, it's time for a clean slate. You need intelligence agencies. They provide an important service to the nation. You do not need intelligence agencies that violate the Constitution and cause cyber-security issues all around the world. It has gone beyond anything acceptable, and must be dismantled and a new one created under the careful oversight of civilians who have an allegiance to civil rights.
According to Engaget and other sources. So yea, the US is to blame for all the pirated un-patched installs of XP in China. Russia has purportedly Russia 64 percent. Isn't it strange that the NSA would code such and exploit. Live by the sword, die by the sword.
With a SINGLE 'standalone' non-networked PC (no home network/LAN) just turn off Server & Workstation services. It shuts off any "handles" (port 445) this thing propogates thru + turn off NetBIOS over TCP/IP in your internet connection & uncheck/disable Client for Microsoft Networks + File and Print Sharing. Port 139 & 445 always pop up issues over time.
I covered all this 11++ yrs. ago in a security guide I wrote for users with a single system & apparently, its advice STILL STANDS THE "TEST OF TIME" ala https://www.google.com/#q=HOW+TO+SECURE+Windows+2000/XP/ vs. even today's threats like this one.
* This effectively makes this threat a non-issue + saves you CPU cycles/RAM & other I/O wasted on services you don't NEED as a single PC user only... & you don't. They're just wastes with a single PC really. Many services are (covered in guide above based on CIS Tool guidance (who took fixes to their ware from "yours truly" too, no less)).
APK
P.S.=> Of course, don't be STUPID & click on attachments in bogus malicious emails this thing propogates thru as well (Chrome/Opera/Webkit users - BEWARE of the ShellControlFile issue that just popped up (.scf file) noted here-> http://www.theregister.co.uk/2017/05/17/chrome_on_windows_has_credential_theft_bug/ )... apk
That's the same as blaming gun manufacturers for all the mass shootings.
While it might have been the NSA that created the basis of the ransomware, there's really larger problems. Any hacker could have discovered the vulnerability and launched the same attack.
The first problem is that the malware affected Russia and China in greater numbers for the simple reason that many Windows installations there are pirated so they are not likely to receive patches. MS for their part did patch the vulnerability in the March cumulative update if I remember correctly.
The second problem is that MS didn't patch unsupported, older versions of Windows until WannaCry became widespread (Windows XP, Vista, etc). So there are still many older versions of Windows out there being used. This second problem does affect companies and machines that have stayed on older Windows for a number of reasons (hospitals, factories, etc.)
The third problem is that trust in MS has slowly been eroded over the years with their behavior:
For many, they simply don't trust MS anymore. In years past, a bad patch every now and then could be forgiven. With no trust in MS, consumers are simply taking their chances.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Even if the NSA told Microsoft about this bug a year or more ago, it wouldn't have helped China at all. They're running tens of thousands of stolen copies of Windows and on old versions like XP so any patch Microsoft released would have never been installed anyway.
The blame here is on China and any other companies that kept using XP passed it's end of support date. They made that decision, they have to live with it. If they can't afford Windows, there are some perfectly usable Linux distributions out there.
... when the Chinese take a LOT of blame (all the blame?) for North Korea.
For over 50 YEARS, CHINA has been basically the SOLE supporter of a despotic regime that, in addition to crimes and atrocities only exceeded by the Holocaust, Stalin or "The Great Leap Foward", through forced labor, prison camps and also responsible for the DEATHS of MILLIONS of its citiizens (primarily through starvation), is now threatening the security of much of the world (even Putin made some nervous remarks). That the North Koreans don't give a flying F*** about convention or Geneva protocols or whatever is obvious from their past terrorist attacks (bombing of an airliner) to using the (most) deadly chemical weapon known to man (basically all other nations have destroyed their stocks) in a densely populated city in an uninvolved country just to kill one possible dissident (and they probably smuggled it in via diplomatic pouch, hence the police apprehending N. Korean embassy workers).
That the Chinese were willing to put an entire nation of people IN HELL for five decades just so that they could possibly keep the Americans from being on their doorstep shows how little regard they have for HUMAN RIGHTS or even LIFE. (They probably could've gotten the Americans to have agreed to leave S. Korea if N. Korea was unified. From what I can tell, they never tried). But even if you were ignorant of the North Korean situation, you could probably have guessed their (lack of) morals from the way they treated Tibet and their own ethnic minorities.
That is why I have so little regard for the Chinese (government) and long ago stopped making direct investments in China. As for their citizens, I'd like to believe that they are the classic example of why a people blindfolded by censorship can be lead to do the worst imaginable things. A person can easily be convinced to murder (and a country to genocide) if he is lied to.
There 'Murica, I fixed that for you. The "NIA" has turned bloated, slow, unaccountable, and has gone rogue. Only congress can reign them in but they have to expect very dirty fight-back from them, the CIA, and the Pentagon. Who's going to effectively take on the deep state?
Lot's of self-blaming to do ...
If, as usual, the first thing the "Windows crack" does was to disable updates then guess who should take the blame. How about blaming the big Firewall of China that doesn't let MS updates come through?
And then if the malware came from North Korea, to finance some "nukelar" bombs they need to develop, then who's number one ally in that enterprise?
See subject: I try aid others preventing them from being f'd over by this ransomware - have YOU done more/better? No. Nicest part of what my guide gives others is more speed/cpu/ram via what my last post says https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&btnG=Google+Search&gbv=1/ as well as more security.
APK
P.S.=> Go away psycho loon loser - quit stalking/harassing me you sick freak... apk
>...criticized the United States for hindering efforts to stop global cyber threats...
WHAT? So when this WannaCry began making its rounds, the US went out of its way to keep it going... and promote its horrible run? And denied others the ability to stop it? SAY WHAT?!?
It can be reasonably assumed (yes I know) that if the NSA knew about these vulnerabilities than at least one other state actor such as China or Russia knew about them too.
So this is simply a 'political game'.
Do you even know what intelligence and counter intelligences actually do? If the NSA open sources all their tools and methods do you expect the other foreign intelligence agencies to do the same thing? Because that is what the mindless proles are asking for.
As I understand it, what the "mindless proles" are asking for is for the NSA, when they discover that there is a vulnerability in the software that allows it to be attached, to tell the companies that make the software about it to allow it to be patched instead of hiding the information.
By the way-- "mindless proles"?? What's with the neo-Marxist-jargon? I don't think I've heard anybody use the word "proletariat" seriously in fifty years.
That is sort of like going to war and telling your target the time of the attack, the force size the target can expect to face, and then leaving all the ammunition locked up back home in the armory.
It's more like the NSA discovering that there's a grenade strapped to their body, and deciding to disarm it instead of leaving it there and saying "well, probably nobody will notice it."
The NSA is not responsible for securing anyone's software.
Apparently not. Instead they were responsible for developing a vulnerability and then releasing it to the world.
They are a covert intelligence agency empowered to provide security to the US. They can do anything they want to any country on the planet and the only rule is don't get caught.
This is the way criminals reason: "I can do anything I want as long as I don't get caught."
I'd prefer to that lawful organizations are actually obeying the law. "We're powerful so we're above the law" is for tyrants, not free people.
Hey China, your truck was stolen and then driven into a crowd. You should share some of the terrorists blame. It might have been OK as they tried the vehicle gates and they were blocked, so they rammed a pedestrian gate. Where you, China, provided a target rich environment.
- Tjp
I am in wallow with my inner money grubbing capitalistic pig. ... Oink!
I like eggrolls. I blame China.
As I understand it, what the "mindless proles" are asking for is for the NSA, when they discover that there is a vulnerability in the software that allows it to be attached, to tell the companies that make the software about it to allow it to be patched instead of hiding the information.
It is not the NSA's responsibility to make sure software is secure. Their job is to find vulnerabilities that can be exploited to meet their ends. To suggest that they immediately throw away each new capability they develop by alerting the software makers is just stupid. If they were looking for vulnerabilities just so they could be patched, it would go against the entire purpose of their looking for those vulnerabilities - Why would they bother searching if not to find something to exploit?
He's getting rather old, but he's a good mouse.
It is not the NSA's responsibility to make sure software is secure. Their job is ...
As an agency of the U.S. government, their job is to uphold the constitution, and specifically their job is to provide for the common defence (you know, that constitution stuff?).
They decided that "making us safer" meant "don't report vulnerabilities that might make us unsafe." That was their decision. "Let's leave the U.S. vulnerable" was what they chose.
They believed that not patching vulnerabilities makes us safer. Worse, not only did they not warn us, and thus allow us to defend against the vulnerability, they actually worked to use that vulnerability to make a tool to break in... and then left that tool lying around for bad guys to pick up and use, because, hey, they thought that they were the big bad wolf and they were immune to the bad guys breaking in.
We're lucky that the bad guys only decided to use it to get a bit of money.
This time.
As an agency of the U.S. government, their job is to uphold the constitution, and specifically their job is to provide for the common defence (you know, that constitution stuff?).
And by maintaining their ability to break into adversaries' computers, they concluded that's what they were doing.
"Let's leave the U.S. vulnerable" was what they chose.
No. They decided, "let's leave the world vulnerable." That unfortunately includes their own country.
They believed that not patching vulnerabilities makes us safer.
That part you got right.
He's getting rather old, but he's a good mouse.
Because after you steal and use someone else's software it is the people who had their property stolen who should be required to make sure your system is safe. I think they should consider themselves lucky the pirated software doesn't steal all of their trade and military secrets by default.
It is not the NSA's responsibility to make sure software is secure.
Sorry, but you're wrong. The National Security Agency has multiple tasks. Among them and besides the signals-intelligence role, they are also tasked with securing the US' data networks as part of essential infrastructure vital to national security.
They sacrificed national security for signals-intelligence capability, mostly motivated by domestic politics and the desire to use the NSA domestically to suppress dissent and political opposition. I blame this change in the NSA to the political appointees that have been replacing the 'old guard' within the agency over the last few past administrations both (R) and (D). Patriotism and idealism among the leadership has been mostly supplanted by cynicism,fanaticism, political ambition, and a nearly sociopathic attitude towards society and the people, almost a God-complex in some cases.
It would not surprise me that the shadow brokers are talented geeks that were approached by the NSA but refused to go to work for them, and/or ones who quit the agency in disgust and despair.
Who the SB are and what they want is really not important here, however. It is the fact that a US Agency that is, at the very least, obligated to take steps to alert the necessary parties when they discover a major vulnerability in vital national infrastructure did in fact do the opposite in hopes of using it as a weapon at some point while vital national infrastructure, including financial and healthcare networks were at risk, is massively irresponsible, self-centered, stupid, criminal, and itself a threat to national security.
Heck, I'd expect the Dept. of Interior to report vulnerabilities they discover in vital national infrastructure, never mind the National Security Agency, FFS! What are we paying these power-tripping fools for, anyway? This fiasco sure ain't in their charter!
The NSA needs to be gutted, audited, and totally re-invented with sufficient limits on its powers and authorities and enough oversight and enforcement in place to make certain laws and rules are followed and Constitutional protections respected. Same with much of the US Government's litany of agencies and departments.
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
If we were all using the gnu hurd we wouldn't be in this mess..
This is China we are talking about, right? They should save the sanctimony, China has hacking tools wreaking havoc. They should back to the damage done in years past and take responsibility.
Perhaps is microsoft's fault for upgrading pirated Windows XP and then not supporting it for free.
When China starts giving a dick about anything besides it own selfish interests let us know.
It seems to me that Microsoft has been negligent with security. They don't support any sort of granular permissions, nor any modes for running applications that would limit the damage they can do. (Why can DailyJoke.exe read/write all files except system files, read the screen buffer, and listen for keypresses?) If granular permissions are too hard, why has sandboxing not been implemented? Why is every installer a black box which must be run as admin?
However, since we haven't legislated that they aren't allowed to be negligent, this is legal. I can be negligent when building a table. You can be negligent when you reheat your leftovers. This is not illegal. But given that Microsoft has a type of monopoly and their security negligence is costing time, money, and even some lives, would it be appropriate to mandate any sort of stronger security model?
A cat can't teach a dog to bark.
To enable or disable SMBv1 on the SMB server, configure the following registry key:
Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Registry entry: SMB1
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled
To enable or disable SMBv2 on the SMB server, configure the following registry key:
Registry subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Registry entry: SMB2
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled
---
To disable SMBv1 on the SMB client, run the following commands:
sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled
To enable SMBv2 and SMBv3 on the SMB client, run the following commands:
sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
sc.exe config mrxsmb20 start= auto
* Per https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012/
APK
P.S.=> Between the above (& patches exist also) OR doing what I do for standalone SINGLE systems w/ no home network-lan https://news.slashdot.org/comments.pl?sid=10624577&cid=54434563/ you'll be OK ... apk
Blame BOTH: NSA & Microsoft. MS "gave" NSA access to their source code to snuff the world.
eh? what are those dark clouds in the horizon?... why they make sounds like helicopters?
This is solved with proper firewalling. I would assume the people who put up the firewalls do not consider this exploit to be the end of the world. So when deciding on whether to use or close the exploit, it's pretty fucking clear.