Slashdot Mirror
New SMB Worm Uses Seven NSA Hacking Tools. WannaCry Used Just Two (bleepingcomputer.com)
An anonymous reader writes: Researchers have detected a new worm that is spreading via SMB, but unlike the worm component of the WannaCry ransomware, this one is using seven NSA tools instead of two. Named EternalRocks, the worm seems to be in a phase where it is infecting victims and building its botnet, but not delivering any malware payload.
EternalRocks is far more complex than WannaCry's SMB worm. For starters, it uses a delayed installation process that waits 24 hours before completing the install, as a way to evade sandbox environments. Further, the worm also uses the exact same filenames as WannaCry in an attempt to fool researchers of its true origin, a reason why the worm has evaded researchers almost all week, despite the attention WannaCry payloads have received.
Last but not least, the worm does not have a killswitch domain, which means the worm can't be stopped unless its author desires so. Because of the way it was designed, it is trivial for the worm's owner to deliver any type of malware to any of the infected computers. Unfortunately, because of the way he used the DOUBLEPULSAR implant, one of the seven NSA hacking tools, other attackers can hijack its botnet and deliver their own malware as well. IOCs are available in a GitHub repo.
Ars Technica quotes security researchers who say "there are at least three different groups that have been leveraging the NSA exploit to infect enterprise networks since late April... These attacks demonstrate that many endpoints may still be compromised despite having installed the latest security patch."
EternalRocks is far more complex than WannaCry's SMB worm. For starters, it uses a delayed installation process that waits 24 hours before completing the install, as a way to evade sandbox environments. Further, the worm also uses the exact same filenames as WannaCry in an attempt to fool researchers of its true origin, a reason why the worm has evaded researchers almost all week, despite the attention WannaCry payloads have received.
Last but not least, the worm does not have a killswitch domain, which means the worm can't be stopped unless its author desires so. Because of the way it was designed, it is trivial for the worm's owner to deliver any type of malware to any of the infected computers. Unfortunately, because of the way he used the DOUBLEPULSAR implant, one of the seven NSA hacking tools, other attackers can hijack its botnet and deliver their own malware as well. IOCs are available in a GitHub repo.
Ars Technica quotes security researchers who say "there are at least three different groups that have been leveraging the NSA exploit to infect enterprise networks since late April... These attacks demonstrate that many endpoints may still be compromised despite having installed the latest security patch."
Your computer have virus.
... Crafting even nastier ones as we speak.
Maybe if we *did* something about their datacenters and the people working in them, maybe we'd have a chance before they combine this crap with IoT and finally get the dystopian kill-through-net future they've been sexually pleasuring themselves to the fantasy of for decades now.
Preferably while all the old nukes are still running of 7 1/2 floppies and protected from these monsters setting off false flags.
Just look at Google. Terrifying, just terrifying.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Be sure to spin rhetoric about "NSA" and "CIA" freakouts harder than the actual technical details, as usual!
Why? Is there not enough information to fill the 24 hour news cycle with Trump in the US, Erdogan in Turkey, the Brexit in Europe, ad infinitum...
Or, and I don't have the tinfoil hat on but it's out of the drawer, will these be used to somehow shunt internet freedoms as the powers that be protect us from another Boogeyman.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
oh yeah, i'm sure that's why it was launched
The current focus is on WIndows vulnerabilities, but I wonder if there are Linux/*BSD/MacOS vulnerabilities of similar significance that have not made it into general consciousness. It strikes me that the NSA may have had exploits of similar effectiveness for these systems that haven't been released by Shadow Brokers or others (perhaps because they get a bigger bang by revealing Windows-based exploits).
Why has the NSA, who know exactly what weaponized exploits were broadcast to the world. . . Why has the NSA not offered-up any antidotes to their now-public weaponization of a bunch of sploits?
They could swoop in and try to look like the hero here, but there's been no sign of that. Not a peep from the NSA.
Are they just making popcorn and watching the fallout because they think they are computer GODS, enjoying watching the plebes fight all of these forthcoming worms and trojans just to get themselves off before going back to work reducing the security of the USA by continuing to develop more of the same?
If you want to be safe, shutdown your PCs today for unexpected tomorrow or week.
Why?
Because Windows is still vulnerable coming the e-terror to you.
Make commercial software companies legally liable.
If you haven't looked into it yet and you're running Windows 7 and above, disable SMB v.1 on Windows as server or client. There's not much reason to maintain it unless you have older hardware/software that relies on it (XP, Windows Server 2003). v.1 is slower and completely replaced by SMB v.2 and v.3.
Wakey wakey sleepyhead....
When the NSA realized that the code had been stolen & likely to be released, they communicated the SMB bug to Microsoft who then released patches for their "maintained" OS's two months ago. It is because of this that they were able to release patches for their out of maintenance OSes as soon as Wannacry started spreading.
Did you just imply that if the NSA said "here's a patch, please apply it globally" that you would apply it blindly?!? I'm not one of the people calling for the NSA to be the world's beta testing organization by buying up all the bugs on the internet & then handing them off to makers so that they patch their code, but even I wouldn't apply a NSA patch blindly like that.
The NSA is not Trump with hourly Twitter updates direct from them to the world. They'll always communicate through proxies.
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
Or everybody could just quit panicking and patch their systems.
Every time another "ogodtheskyisfalling" article comes out covering a new/improved malware based on the leaked NSA toolbox I'm looking for a quick summary early in the article that says "this beastie will be a problem for Windows, probably Win7 and earlier; will not be a problem for Linux; probably won't be a problem for OS X." Or even a simple 0-10 ranking of "no problemo" to "burn your computer NOW!" for each of the three major platforms placed somewhere prominent in the article would be nice. For my less-techie friends/relatives who get all hyped up with every new WormKillerTorpedoBot_Comrade exploit, it could give them an idea if they should be worried and figure out what to do, or not. For me, I can avoid reading pages and pages of turgid tech-prose about something that, not running anything on Windows, I don't need to care about. So how about it Tech Pundits of America, how about a little help here?
Fuck these guys.
for the system to be infected then take them over from the virus writers discretely
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
MS should just force the upgrade of all computers to Windows 10.
What goes around is apparently coming around - thanks a lot for that.
Seems that whole "(our) security through (your) obscurity" thing has a few wrinkles in it.
Sincerely,
The people you're supposed to be protecting.
It must have been something you assimilated. . . .
TCP port 137, 139, and 445 are blocked, UDP ports 137 and 138 are blocked. So am I safe?
I've got a printer and NAS on my network, I know the printer uses SMB but not sure of the NAS.
Or everybody could just quit panicking and patch their systems.
I tried.
I downloaded MS17-010 for 64 bit Win 7 (which I run in my work laptop), and after churning for a few mins, it said that the Update Wasn't Installed.
So I simply disabled SMB1 and am hoping for the best.
If anyone has any ideas, I'd love to hear them!
It says something that I was almost as scared of manually downloading and installing a critical security patch from Microsoft than I was of the original virus.
Turning wuauserv on for the first time in over a year felt like I'd turned off my ad and script blockers and downloaded all the russian porn and pirated software I could find.
The bugs involved were leaked to the Russians by The Donald.
Ned Pyle and others have eloquently described why everyone should drop SMB1 support, yet NAS suppliers and Sonos continue to ship products that use SMB1.
Despite being deprecated by MSFT for years, SMB1 is alive and well with Sonos. There is no SMB2+ support, there is no timeline nor any commitment to add SMB2+ support. Please note: this issue only affects those that use Sonos with a local file server such as a NAS, your PC, etc. to store the music library and then make it accessible via the LAN.
I don't understand how a company that prides itself on making premium audio products doesn't put security ahead of other software development priorities. One juicy scandal can cause way more damage than the modest cost of implementing readily-available SMB2-3.11 server/client software packages.
SMB1 support on the Sonos, if allowed at all, should be on a opt-in basis, with adequate warnings to consumers re: potential pitfalls. Modern incarnations of SMB servers have NTLM v1 and SMB1 support turned off by default for a reason.
NSA...Making America Secure again! Bigly!
With a friend like the NSA, who needs enemies!
some talented hacker will turn their attention to wiping out all records of student loans and consumer debt. Heck, maybe even mortgages.
We can only hope...
I have seen so many Linux hardening scripts, written in bash. But similar hardening scripts are very rare in the Windows platform. It would be nice if some scripts are released to the public on how to harden standalone machines and also scripts for hardening Enterprise versions of Windows which are connected to both LAN and WAN. If a new exploit is found, then a single line update on hardening script would do to mitigate the new threats.
I have built my own script for Windows (disabling services and removing stuff I don't need), but my script is not as powerful as those scripts I have seen for Linux.
No such thing as a "secure" os, some are less secure than others.
Anything that has a connection to anything else is less secure,anything connected to an internal network is even less secure,anything with a connection to the internet in any shape or form is realy insecure..
ANYONE that thinks they admin/own/use a "secure" system is deluded/deluding other users..
Linux/OS etc etc all have holes/backdoors,EVERYTHING does,anything that one man/group can create can be subverted by one man/groups..
You will never know how many holes your particular favourite os has until it's too late..
If you want/need real security,don't use ANYTHING electronic, use an abacus and pen and paper..
Modern electronics "may" have bought the world many so called advantages,but the world got along for thousands of years without them and will do so again in the future..
Posted by a happy/safe dull luddite..
Using a dull android device that never has anything vital/important on/through it,that resets itself at random(thanks HTC) but does what I need/want it to do.
Anyone want to hack me,be my guest,I have nothing that you can steal,blackmail me with,so I don't care if anybody does hack it.bank accounts what are they ? got none,embarrassing crap,got none,vital data,got none..
Try more life,less things and stuff.
P.s,yes I do live in the "real" world,and unfortuanetly have to rely on all the crap electronic stuff everyone else insists on useing..
Are these posters active in the workforce? Every relevant office in the world uses windows.
{...} But out here in the functional world, windows is everywhere.
Depends of the field you work.
Academic research ?
Specially in fields like computational biology ?
It's going to be exclusively UNIX.
With Mac OS X being a bit more popular on the laptops and workstations of the researchers,
and Linux having monopoly on the servers and compute nodes.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
They are an enemy of the United States. Arrest them and take their computers.
Corporatism != Free Market
The article image makes it look like Microsoft WROTE it.
After all, it says the product is copyrighted by Microsoft.
That's great advice but see my note below, if you want to run a Sonos from a file server as intended, you have to have SMB1 (NT1) enabled on that file server, which means also enabling NTLM v1 authentication.
Yes, there is a complicated workaround by using Plex or subsonic as a means of feeding the Sonos data without the need for SMB1 insecurity, but implementing this system is not the faint of heart. Plus, with every new service enabled on the server, you add more potential exploits.
All I want is to be able to enable SMB 3+ on my home file server or shut it off altogether. Presently, the best solution may be to use a burner file server just for the Sonos with one-way updates. Nuts!
You should look at an alternative for Sonos then.
Why does Microsoft produce such fucking terrible software? Do what Apple had the balls to do a decade ago and drop all native backward compatibility with old apps. All old apps should run in a VM or in a sandboxed environment.
WannaCry is a disgrace and again proves Microsoft blows.
I'm not familiar with this product or Sonos but this sounds proprietary.
Not reimplementing any part of the product is more profitable and most computer users are non-technical so they don't understand what SMB is let alone which revision is known to be insecure. Users should be advised to liberate themselves from Sonos' control over the user's computers; seek other ways to play the audio, ways that respect a user's freedom to run, modify, and share (including commercially). Perhaps reconsider Sonos if they distribute products that respect a user's software freedom. After all, if the security issues you describe are important enough that should be sufficient justification to seek the freedoms you deserve with or without Sonos' help.
Digital Citizen
This is all because of crap the NSA did while Obama was in office.
so,
the TLDR is
You are a fucking idiot?
Disabling SMB1 is not enough to stop the EternalRocks worm, which includes the EternalChampion (SMB2) and EternalSynergy (SMB3) exploits.
Disabling SMB1 is not enough to stop the EternalRocks worm, which includes the EternalChampion (SMB2) and EternalSynergy (SMB3) exploits.
Have I mentioned that I hate Windows?
I'd love to see it get through my firewalls, past my AV, overcome my system permissions and magically affect my backups, lol.
These exploits are script-kiddie level. I don't need to patch anything because my shit is secured.