Slashdot Mirror
NSA Exploits Ported To Work on All Windows Versions Released Since Windows 2000 (bleepingcomputer.com)
Catalin Cimpanu, reporting for BleepingComputer: A security researcher has ported three leaked NSA exploits to work on all Windows versions released in the past 18 years, starting with Windows 2000. The three exploits are EternalChampion, EternalRomance, and EternalSynergy; all three leaked last April by a hacking group known as The Shadow Brokers who claimed to have stolen the code from the NSA. Several exploits and hacking tools were released in the April 2017 Shadow Brokers dump, the most famous being EternalBlue, the exploit used in the WannaCry, NotPetya, and Bad Rabbit ransomware outbreaks.
4.... "It's EDS 4."
That's called taking care of your installed base.
I guess Linus and his penguin flock will be having a field day.
Or must you visit a malicious web site, or firewalls be down, open shares and what not? I'm generally only worried about true remote exploits, the last I knew of for Windows was in 2001ish, "MS Blast".
Remember when we chalked the NSA up on our side? They might have been a secretive government agency, but no matter what they did they had our interests at heart. Those were the days, weren't they?
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
Yeah, but you get much better framerates in Win 10 thank to Direct X 12. Sadly they're a Windows Store exclusive.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
... I'm still running NT Workstation
This can be mitigated via echolonic irrigation. Pro Tip: take good care of your phat pipe.
At least the NSA won't be able to use those exploits anymore.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
This could turn into a big issue unless Microsoft releases a patch for all those older versions.
... you worked there. The chances of Mr A Random Hacker gaining access to their core systems are as close to zero as makes no difference. If original code is truly from the NSA then it was leaked by an employee.
Interesting that he went for a 2 year old version of Windows 10. Would have been much more interesting if he tested the latest patched versions of all OS's. If he did that for Windows 10, won't surprise me if he also used unpatched versions of Windows 8.1 and 7.
I made a fair amount of money on that game. Monopoly money, of course ...
Exchange it for BitCoins.
The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
If the NSA and other agencies worked on making US telecoms infrastructure and software more secure instead of ....
I must be missing something. Isn't it the purview of the US telecoms and other companies that are creating, deploying and selling the infrastructure and software to ensure that it's secure, reliable and cost-effective, not the US government? That is, if they want customers.
The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
It's not the fact that the NSA isn't allowed to hack. It's the fact that they discovered multiple critical vulnerabilities in an OS used by hundreds of millions of American citizens and other American agencies and governments, and instead of disclosing it responsibly so that Americans would be protected, they sat on that information. Worse, they weaponized it, then they let the weapon escape out into the wild. NSA exploits are responsible for more billions of dollars in ransomeware attacks than any single source.
The NSA failed to protect Americans, weaponized a weakness shared by virtually every citizen, and then failed to keep their weapons locked up. Imagine if the US Air Force lost a few nukes. The property damage by NSA leaks is about akin to dropping a nuke on medium sized city. The NSA leadership responsible for those decisions shouldn't just be fired, they should be hauled (in chains) before congress to answer publicly for those decisions. I cannot fathom why the American people aren't still howling for their arrest.
What does Windows ME have to do with anything? Even at the time everybody recognized it as a bad joke. The only people to use it were the suckers that bought a new computer without first making sure it was running 98 instead.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
The NSA's charter has two goals: improve the security of US stuff, and penetrate the security of non-US stuff. They've apparently decided that attack is more important than defense and it's biting them (and everyone else) in the butt.
Yeah, but you get much better framerates in Win 10
This experience isn't universal, in fact theres a thread on nvidia driver forums thousands of responses long complaining about massive performance issues in general on windows 10 but not a similar complaint mountain on windows 7(many people actually note that performance issues is not present on windows 7 on exactly same hardware setup) which was the most popular windows until literally a few days ago
Intel ME is just a mirage!
Rather than "spineless", I would say "complicit".
I think we've pushed this "anyone can grow up to be president" thing too far.
I think you can fairly blame every president since Eisenhower...and possibly him.
It's a systematic problem. When some gets into a position of power, they almost inevitably try to consolidate the power. If they weren't the kind of person who would do that, they wouldn't have schemed for the power in the first place. And the election system guarantees that only those nearly psychotically driven to gain power will be willing to put themselves through the process.
So I recommend selecting government officials by lottery with minimal qualifications. (At least 2/3 of the adults in the country should be in the lottery.) We could hardly do worse than the current selection, and it would prevent "politicians" being pre-bribed before they took office. And it would ensure that all minorities were fairly represented (on the average). Then there's the need to address regulatory capture, so office holders should be forbidden from any gainful employment after retiring ... which means they need a decent retirement package...say, twice the median income.
I think we've pushed this "anyone can grow up to be president" thing too far.
The NSA's charter has two goals: improve the security of US stuff, and penetrate the security of non-US stuff...
From what I can tell, their "improvement" is restricted to "national security information and systems". I didn't know that included Windows XP.
From NSA story:
NSA Mission
NSA's Mission is to help protect national security by providing policy makers and military commanders with the intelligence information they need to do their jobs. NSA's priorities are driven by externally developed and validated intelligence requirements, provided to NSA by the President, his national security team, and their staffs through the National Intelligence Priorities Framework.
From the NSA website:
Mission Statement
The National Security Agency/Central Security Service (NSA/CSS) leads the U.S. Government in cryptology that encompasses both Signals Intelligence (SIGINT) and Information Assurance (IA) products and services, and enables Computer Network Operations (CNO) in order to gain a decision advantage for the Nation and our allies under all circumstances.
More from the NSA website:
What is Information Assurance?
Information Assurance involves preventing unauthorized access to sensitive or classified national security information and systems. The purpose of the Information Assurance mission is to keep others from stealing or tampering with our national security systems and information. This work not only keeps our vital information out of unauthorized hands, but helps ensure that the information our decision makers need is available and reliable when they need it.
Under National Security Directive 42, the Director of NSA has responsibility for the security of national security information systems, covering the Department of Defense and other Federal departments and agencies. NSA/CSS also helps improve the security of critical operations and information by providing know-how and technology to suppliers and clients.
Who are NSA/CSS' Customers?
NSA/CSS provides intelligence products and services to the White House, executive agencies (such as CIA and the State Department), the Chairman and Joint Chiefs of Staff (JCS), military combatant commanders and component commands, military departments, multinational forces, and U.S. allies. In addition, we provide Information Assurance products and services to users of national security information systems and to government contractors, as required.
The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
Fair enough. You have a lot more detail there than wikipedia (their source is from 2014 anyway; it's been modified since then). Thanks for the references :)
Illustrating the perils of outsourcing your stuff to the private sector :]
There was a hybrid 98/me build you could make that added the few ME features and improvements and run on a 98 install. I think I cleared that shit from my local drives years ago and forget the name of that project.