Slashdot Mirror
WannaCry Exploit Could Infect Windows 10 (threatpost.com)
msm1267 writes: EternalBlue, the NSA-developed attack used by criminals to spread WannaCry ransomware last month, has been ported to Windows 10 by security researchers. The publicly available version of EternalBlue leaked by the ShadowBrokers targets only Windows XP and Windows 7 machines. Researchers at RiskSense who created the Windows 10 version of the attack were able to bypass mitigations introduced by Microsoft that thwart memory-based code-execution attacks. These mitigations were introduced prior to a March security update from Microsoft, MS17-010, and any computer running Windows that has yet to install the patch is vulnerable. You can read the researchers' report here (PDF), which explains what was necessary to bring the NSA exploit to Windows 10.
Butt, butt, that won't happen to ME.
But Microsoft said that Windows 10 was "the safest Windows ever", EVER!
Just cruising through this digital world at 33 1/3 rpm...
What does this mean for Windows versions other than XP, 7 or 10?
Bullshitware like UAC (which stops zero malware in just about every security study I've read), or secure boot, or any other number of "security" theater that M$ comes up with, they all end up failing horribly.
There's no substitute for designing things securely.
Lawyers, MBA's, RIAA? A jedi fears not these things!
3.0!
I thought what these "researchers" did was illegal? Now they are even advertising it.
the OP said that "were able to bypass mitigations introduced by Microsoft that thwart memory-based code-execution attacks"
but then goes on to say that if patched it is safe?
Does the vulnerability affect both patched and unpatched installs?
Film at 11.
Look, if you bent over backwards (because you have to bend over backwards, to prevent W10 from updating itself without so much as asking) to disable updates, and then didn't bother to check and manage updates yourself... then what did you frickin' expect to happen?
This was KNOWN when the first attacks were being reported. Where the FUCK have you been?
UAC is a failed attempt at replicating sudo* as it's missing fine grained control. UAC is also integrated into the Windows APIs in a way that causes a lot of problems for older software*.
Secure Boot is malware, not a security system. If the person who bought the damn thing is told "I have another master" or "You're not my master"*, it's not a security system.
The TPM crap that they heavily backed is also another "You're not my master" malware package.
Their automatic updates crap as of late, causes more problems than it helps. (Use computer, go to bed, wake up, annnnnddd.... it's gone!) Nevermind undermining it for spying purposes.
They are designing it to be insecure, intentionally. They never had any intention of it being secure for you, just themselves. Of course it's failing horribly for you. It's supposed to.
*sudo is meant to allow administrators to assume the user ID of the super user (uid 0) for a task (and anything it spawns). UAC doesn't actually perform this task. (See also the Windows "runas" command.)
*sudo just changes the effective uid for a process, and therefore can be implemented without even recompiling anything. UAC however, changes the APIs, and anything that doesn't conform to it's changes, or isn't expecting them, may not run at all or just outright crash. (It's heavily integrated into the File and Folder Redirection component.) UAC also tries to "detect" when a program tries to perform a privleged task, (sudo simply doesn't run when the program does, and therefore the program's behavior is not altered.) and displays an authorization prompt on the secure desktop. This prompt doesn't work in a lot of cases though, (anything run from the CLI unless it performs elevation itself, and any non-user initiated task. (User SID is not used by the program.)) and the results are typically not pretty.
*Secure Boot Note: Yes, most secure boot implementations allow the end user to change the key or disable it, but I've only seen one implementation where changing the key didn't involve disabling it, then boot to a command prompt to install the new key. (Some ASUS laptops have an option in their firmware to load a new PK.) Of course another issue is the "One Key to rule them all" design failure, which MS disregarded as an issue. Probably (as predicted long ago...) for when MS decides to throw the switch and make the MS Store the only valid software source for Windows. (Which is a real possibility now, all it would take is one firmware update (remove the disable secure boot / change key options) and one update to Windows sent out by the Windows Update Service.)
> secure boot
When Secure Boot is enabled, and supported by the underlying OS, it defeats Evil Maid. It also defeats surreptitious replacement of one's bootloader and OS kernel. Something that defeats whole classes of attacks isn't bullshitware.
> UAC
UAC is no less effective than sudo. Because of Windows' Window Stations UAC is -in fact- superior to every X11-based GUI for sudo. (On X11 systems, anyone running as the same user running the sudo elevation GUI can sniff the keystrokes entered in that GUI. On Windows, UAC happens in an isolated session. You'd have to have installed a root-level keylogger to sniff those keystrokes... and if you've got root you can do _far_ more interesting things than sniffing someone's password.)
Of course, the big caveat for _every_ security measure is that if a First World Nation-state is after _you_, specifically, there's very little you can do to stop them forever. They have effectively infinite money and people at their disposal.
I'm surprised that someone with such a low UID would be so confused about fundamental computer security issues!
Please explain what needs to be done to "design things securely." Explain what specific sort of technical controls should be put in place in a kernel to prevent attacks. Make sure you aren't listing ones that they have already implemented, such as NX memory regions (which is what DEP is) and also make sure you aren't listing things you like in other OSes that are done in Windows under a different name like separate user/superuser privilege (which is what UAC is for). Let's hear these these brilliant, 100% effective solutions you have. I mean you clearly must know how, since you are so sure Microsoft doesn't do it, right?
Or if not, kindly stuff it and quit blathering on about shit you don't know anything about. Maybe go take a SANS course and get a handle on how there is NO perfect security, anywhere, period, and ti is all incremental, all about making things harder for adversaries.
For that matter you could even start at reading the linked article which says "Performing a similar heap spray on Linux is difficult, but easier than this. A lot of work went into this."
One of the biggest problems with Windows 7 is that the Windows Update system can break, and the automatic repair tools don't have the ability to fix the problem in a number of cases. If you intentionally turn off Windows Updates for whatever reason, and then do not go through the patches each week and install the "good" ones, you are setting yourself up for trouble. The vulnerabilities in Windows for Wannacry had a patch for Vista and newer back in March, so only those not installing updates were really vulnerable by the time Wannacry hit the news.
So, like the changes to Windows or not, if you refuse the fixes that are made available, and THEN something happens, it is actually your fault at that point. It is like recall notices on cars, where if you get a recall notice saying your transmission might catch on fire in some situations without the recall, and you choose to ignore it or put it off, and then your transmission catches on fire, that is YOUR fault. A free fix was offered to prevent problems, and you ignored it.
Several of the Windows updates that patched the related security holes were both finalized and digitally signed several months prior. This indicates that a handful of people at Microsoft were aware of what was going on, and had been compelled by court order on how to proceed and to stay quiet.
Most likely, NSA/CIA used this to probe European, Russian, and Asian networks to discover what the effects of an attack like this would be, and how much damage could be caused to public offices and facilities, with little regard to civilians.
Why does the world tolerate this? It was literally an act of war.
and yet another attempt at getting 15 minutes of fame.. Using a security hole that has been fixed almost 3 months ago, with an OS that updates itself about every week, so unless you really have updates turned off and never manually loaded updates it's mute.. Why do these guys even get attention?
Security Researcher: We ported WannaCry to Windows 10.
Hacker: Thanks for doing our work for us !
(which stops zero malware in just about every security study I've read)
Observer bias. It stops 100% of malware that it was designed to stop by prompting the user to specifically run said malware. Your observation fails to note the following: .exe file.
1. Malware got more sophisticated than getting a user to double click an
2. You don't hear or read about failed malware that ended up having no impact.
Security is not an end, it's a process. It's a cat and mouse game. With each vector closed new attack vectors are explored. Modern malware looks absolutely nothing like it did in the pre-Vista days. Modern attack vectors look nothing like it either.
UAC is not a sudo replicant, it is a tool for easily escalating to a privileged user. It is akin to what you see in many modern Linux GUIs when you try to run something, it asks for escalation and then runs as root, often for a period of time thereafter. Also your understanding of how UAC works is incorrect, you can have it change user contexts if you wish to set it up that way. You can tell UAC how to operate. Normally what it does is present even administrators with a restricted security token until they escalate.
Fine grained sudo control is more akin to Just Enough Administration (https://msdn.microsoft.com/en-us/library/dn896648.aspx) though that is even finer grained sudo.
Much like the original poster, please don't spout off if you don't know what you are talking about. There's a lot of documentation on the Windows security model out there, if you want to look in to it. However trying to criticize it when you don't understand its functionality is silly.
They never had any intention of it being secure for you, just themselves.
... and the three-letter agencies when they come a-knockin'.
'He who has to break a thing to find out what it is, has left the path of wisdom.' -- Gandalf to Saruman