Group Linked To NSA Spy Leaks Threatens Sale of New Tech Secrets (reuters.com) 105
Hacker group Shadow Brokers, which has taken credit for leaking NSA cyber spying tools -- including ones used in the WannaCry global ransomware attack -- has said it plans to sell code that can be used to hack into the world's most used computers, software and phones. From a report on Reuters: Using trademark garbled English, the Shadow Brokers group said in an online statement that, from June, it will begin releasing software to anyone willing to pay for access to some of the tech world's biggest commercial secrets. In the blog post, the group said it was setting up a "monthly data dump" and that it could offer tools to break into web browsers, network routers, phone handsets, plus newer exploits for Windows 10 and data stolen from central banks. It said it was set to sell access to previously undisclosed vulnerabilities, known as zero-days, that could be used to attack Microsoft's latest software system, Windows 10. The post did not identify other products by name. It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs, without providing further details.
Trolling or stupid? (Score:5, Interesting)
It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs, without providing further details.
Are they attempting to ensure that there's no safe harbor for them anywhere in the whole world? Seems like if one pisses off the USA, Russia, and China, that there's no country in the entire world that wouldn't give up these people to someone if their identities are uncovered.
This makes me wonder about the legitimacy of the claims, and if they're really from a group with this kind of power or if they're just someone trolling for teh lulz.
Re: (Score:3)
This makes me wonder about the legitimacy of the claims, and if they're really from a group with this kind of power or if they're just someone trolling for teh lulz.
I think this last week has proven that, yes, they do have access to these tools.
Re:Trolling or stupid? (Score:4, Insightful)
Either they aren't thinking this through or they are shills for some government to give them an excuse for another scorched earth policy.
Computers can be made secure most of the time with a little anti-stupidity. Firefox/netflix stops 99.999% of malware unless you whitelist some EvilWebsite. Don't open forwarded emails from your computer-challenged friends & family members.
Sure there are some nasty exploits on almost every platform but most of them require a javascript call to execute or some poor sap to open an attachment and run it.
Re: (Score:1)
Either they aren't thinking this through or they are shills for some government to give them an excuse for another scorched earth policy.
Computers can be made secure most of the time with a little anti-stupidity. Firefox/netflix stops 99.999% of malware unless you whitelist some EvilWebsite. Don't open forwarded emails from your computer-challenged friends & family members.
The problem with this mentality is most of the world is comprised of very stupid and ignorant computer users, which is kind of the main reason ransomware has turned into a very successful business model over the last 12 - 24 months.
Sure there are some nasty exploits on almost every platform but most of them require a javascript call to execute or some poor sap to open an attachment and run it.
The number of poor saps in the world is equal to the number of devices running Java/Javascript, proving both can be rather hard to manage.
Re:Trolling or stupid? (Score:4, Insightful)
One of the things that has bothered me about computing developments over the last 20 or so years is that the push for easier and easier UI should have ended about fifteen years ago, and when the realization that an ever-increasingly-connected Internet was to be the future, the focus should have shifted away from UI and to backend security and testing of software products and protocols. Unfortunately that stuff isn't visual, so it's hard to sell a user on a new version of Windows without changing the look.
In my opinion GUI development peaked sometime around 1996 or 1997. Windows 95 OSR2 with IE4 debuted and integrated the web browser into the filesystem shell in a way that's basically the same as it is today, and most of the elements in Windows that we're used to were implemented. In XWindows the most important elements of each major windowmanager project had been created. Only lagging was Apple, OSX wouldn't debut for another four or five years, but again, there were UI elements similar to Microsoft's or to Common Desktop Environment (CDE) or to KDE, so there wasn't a whole lot that was truly new, and a lot of the OS was borrowed from its predecessor NeXT anyway.
Sure they've changed the colors, they've shifted back and forth between 3D-looking window frames and icons and 2D-looking window frames and icons, and they rearrange the look of the dialogue boxes or replace the Start Menu with a new menu, but the just seem to be reinventing the wheel, not actually creating anything new. But they aren't focusing on security like they should be either, even though with the UI nailed-down they really should be.
Re: (Score:2)
/facepalm
Thanks, Autocorrect!
Re:Trolling or stupid? (Score:5, Insightful)
The NSA knows what the Shadow Brokers have (basically, everything the NSA has). The NSA knows how much damage they can do. Further, the NSA, and ONLY the NSA, are in a position to disclose the remaining weaponized vulnerabilities to Microsoft, to get them fixed, and protect the rest of us from harm.
It's beautiful, you see. The NSA MUST voluntarily surrender the weapons that they have been sitting on, or they will be directly responsible for the use of those weapons against us. And this time, there is no head start...if the NSA doesn't disclose them, Microsoft can't fix them, and the ensuing hacks will make WannaCry look like a preshock.
Re: (Score:3)
Agreed. NSA bears a huge responsibility for any bad things that happen.
NSA not only kept zero-days exploits secret, but they weaponized them. And, apparently, even wrote manuals for these weapons. Then they failed to keep these weapons secure –– now they are out there.
Every day that NSA lets this stuff just sit out there, without doing anything to mitigate potential damage from their weapons, puts more and more responsibility on their shoulders.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
This makes me wonder about the legitimacy of the claims, and if they're really from a group with this kind of power or if they're just someone trolling for teh lulz.
RULE #1: Don't hold the whole world for ransom –– where would you go once they paid-up?
Re: (Score:3)
Maybe its to force the US government into revealing all their exploits so they can be patched.
The alternate is that US allies will feel betrayed, that loss of trust will get reflected in attitudes to the USA, make it a tipping point where US citizens get scrutinised more heavily at international boarders, need Visas for entry, trade goods will need closer (and more expensive) inspection, US owned transport given lower priority at ports and airports, red
Re: (Score:2)
Who said financial reward was their ultimate goal ?
. . .
One way or another, this is a huge setback for the USA. And if that's the goal, the money is a smoke screen.
Hmmn. $300 does seem kind of low for a ransom, doesn't it?
Re: (Score:2)
But the hit that spy/law enforcement agencies and the US is going to take to their reputation is probably priceless.
And as they dribble out more exploits, this is going to be the gift that keeps on giving and its going to take YEARS to recover, if they ever do.
It may even be that if this is state sponsored, they have made themselves much safer while leaving everyone else open to the exploits they
send in some elite govt killers (Score:1)
Re: (Score:2)
Re: (Score:2)
Can I assume that you also believe any foreign government has a right to retaliate ?
No matter what you have been told, American lives are not automatically worth more than anyone elses.
End of Bitcoin (Score:3)
Re: (Score:1)
Re: (Score:2, Informative)
Actually, I wonder if Bitcoin will prove their undoing.
Contrary to popular belief, Bitcoin is not anonymous. It's pseudonymous. Every single bitcoin transaction is recorded in the shared ledger of which account it went from, and which account it went to - it's HEAVILY tied to an identity. The thing is anyone can set up a bitcoin wallet with an encryption key, so we don't know which real person each wallet is associated with.
Why is this relevant? Because AT SOME POINT, the criminals need to get their mon
Re: (Score:2)
Re: (Score:2)
Same way that they do it now with bank phising: Hire some bum off the street to go into the Western Union to cash in the money from the transaction slip you give him. He gets to keep a few pennies and hands you the rest of the dough.
Re: (Score:3)
> . And at that point, they need to sell bitcoins out of some wallet, and exchange them for cash
Yea, but like any burgeoning semicriminal area, there's a reasonable amount of mitigations for this risk.
The simplest one is overt laundering. You put some amount of your illegally gained money into a pool that is trusted to spit out some fraction of that at a later time, to an entirely different account. Because the pool is constantly spewing bitcoin at arbitrary accounts, it is not always obvious which goe
Re: (Score:2)
Or who drives their own car to do the cash exchange and gets caught in a nation thats keeps car park CCTV for 12 months and can find that date and time weeks or months later.
Odd Behavior (Score:4, Interesting)
Considering their last attempt to sell such data was somewhat lacking in buyers, I'm curious why they don't just ring up WikiLeaks, get a semi-decent payday and be done with it.
Unless, of course, it's the intel agencies themselves playing the part of TSB seeing who they can reel in on their fishing expedition.
Re: (Score:2)
Re: (Score:1)
They better act quickly, before Donald gives it away for free.
Re: (Score:2)
An alternate approach that may make more money, and would definitely be both more legit and less likely to piss everyone off, would be to use the exploits to get payouts from each company's bug bounty program. Unless the NSA went ahead and preempted this approach by releasing all of their zero-day exploits to the vendors (seems unlikely), they could do this for years, maybe at 10-50k a pop depending on how bad they are.
Re:How bad is this, really? (Score:4, Informative)
Erh... no. Allow me to shed some light onto this.
I've been in IT security for about 10 years now. For most of this time, security was but an afterthought. Security is the equivalent of insurance or military: Expensive and utterly useless unless you really, really need it. Be honest, do you need fire insurance? As long as it doesn't burn anywhere, it's just a waste of money. And for the longest time, there was no fire anywhere in IT. Yes, from time to time there was a bit of a problem. A worm that dug into millions of computers. Or some big company was hit by a hack that did minimal damage.
The problem here is that the damage was simply not high enough to warrant employing people who cost 6 figures a year and can't even guarantee you to be protected against anything that may come your way. Take this highly simplified risk calculation: If your potential damage in case the risk manifests isn't higher than the chance of it manifesting times the cost to mitigate it, it is more sensible to just carry the risk.
And for the longest time, this was the case. Imagine a potential damage of a million bucks per incident. If that happens once every ten years in your company, your annual cost to mitigate must not be higher than 100k. And 100k isn't really much money in ITsec.
If it costs more, you're better off just taking the hit once a decade.
For the longest time this was actually a sensible way to operate. Financially sensible. We've been warning about something like this for years. It was pointless, because the risk never manifested as incidents.
Now the incidents happen.
And now it is too late. We're in too deep to recover. Most of the software and hardware we use cannot be sensibly secured, because, as noted before, security is an afterthought and was not part of the fundamental design. Take HTTPS of all the things. What is it, essentially, but a thin security fig leaf on top of http? And we're still dealing with crucial infrastructure like DNS and DHCP that are by no means secure (not only because they still use a protocol where you can't even sensibly find out who the hell sent the packet in the first place), and while secure replacements exist, their implementation cost too much. Not only because we'd need new hardware.
More importantly, we'd need better trained administrators. Wait, more precisely: We'd need administrators that get at least basic security training. When you see people shrug at you when you tell them that using self signed certs is not ok and you get back a "what's your problem, it IS encrypted, what else do you want?", you know that the person does not even understand what he is doing here. We are critically underprepared for what's coming our way, what we see here is the tip of the spear that's going to hit us right into the chest.
And we will not have the time left to don armor.
Re: (Score:2)
Don't worry. Quite a few companies will be in the near future...
Re: (Score:2)
Wait, more precisely: We'd need administrators that get at least basic security training. When you see people shrug at you when you tell them that using self signed certs is not ok and you get back a "what's your problem, it IS encrypted, what else do you want?", you know that the person does not even understand what he is doing here.
Yes, because we *ALL* know how trustworthy the CA's are. With a self-signed cert, you have direct and immediate control over it. Going through a CA, you're trusting (there's that concept again) that they know what they're doing, that they're not issuing... alternative... certs that you didn't authorize, and that should your cert be compromised, they'll inform you in a timely (if at all) manner.
Re: (Score:2)
Why should I trust your cert? More importantly, why should I believe that the cert your server presents to me is your cert? How do I know it is your server presenting the cert and not some man in the middle? I cannot verify a self signed certificate. I have no way to determine whether the certificate you present to me is genuine.
Re: (Score:2)
By trusting a signed cert I basically trust that signing company (certificate authority), and this doesn't always work out. Stolen certs were used to spread virus/malware infections, and political activists in Iran were spied on by their gov't because some CA's root certificate was hacked.
Certs signed by registered CAs may offer a tad more protection against MITM attacks than self signed ones, but they are definitely no silver bullets.
Re: (Score:2)
There is no silver bullet. And people understanding certificates wrongly is only the tip of the ice berg. Even if they do start to get the idea, it isn't a given that they actually understand the implications. Just because the certificate is CA signed doesn't mean that your data is protected. At least if you click a link that connects you to Bank0fAmerica.com. Yes, the connection is encrypted and the certificate is really for the server Bank0fAmerica.com. But I somehow doubt that this is where you want to s
Re: (Score:2)
CA signed certificates protect you only in those cases where you don't need protection anyway, and as soon as you really need this protection against MITM, they are the first to fall while instilling a wrong sense of security. As long as there is no truly dependable CA out there, one might as well put the same amount of trust in self signed certificates.
US/UK based companies have shown on multiple occasions, that they are ready to bend over for authorities as fast as they could, just remember the shameful b
Re: (Score:2)
CAs protect against rogue actors. Normal criminals. Protection against criminal governments takes more effort.
Re: (Score:2)
I would assume that 99.99% of all MITM attacks were executed by, or per request from, a government, typically the one the client resides in. I just don't see my Telco or some upstream provider sniff on my banking or gmail traffic unless my government would specifically instruct them to do so. Once that is the case, no browser automated CA signature check can save you.
SSL/TLS are mechanisms to ensure, that traffic is encrypted such that only you and the actual endpoint of the connection can read its contents
Re: (Score:2)
Don't forget that the "man" in the MITM can as well be some kind of trojan sitting inside your computer, proxying the connection.
It boils down to the problem of determining whether the certificate presented to you is actually one issued by the server you are connecting to. This can of course also be solved with self-signed certificates. Actually, in all really important cases, I do solve it with self signed certificates, but it means that you somehow have to solve the problem of verifying authenticity. This
Re: (Score:2)
Don't forget that the "man" in the MITM can as well be some kind of trojan sitting inside your computer, proxying the connection.
Once you lost control over your computer, encryption won't be of much help - just think of keyloggers ...
It boils down to the problem of determining whether the certificate presented to you is actually one issued by the server you are connecting to. This can of course also be solved with self-signed certificates.
This is generally not practical, since it would require you to receive authentication through a distinct communication channel - not happening at least in WWW. Current situation goes like this: 1. you call phone number you found somewhere. 2. party claims to be someone. 3. party sends you SMS confirming that part is really who they claim they are 4. you send SMS to someone else, asking "is this really wh
Re: (Score:2)
In this case the certificate (along with pinning) does less for your security than for your ability to detect that the connection is compromised. That's the whole point behind CA-signed certificates. They don't encrypt any better than self signed, they only tell you that the encryption isn't between you and who you think you are connecting to.
And yes, verifying the authenticity of self-signed certificates isn't feasible in most circumstances, unless the required security warrants the disproportionally insan
HTTPS = pure bullshit (slowdown & breakable) (Score:1)
See subject: THIS is your proof as to exactly HOW & WHY https://theintercept.com/2017/05/11/nyu-accidentally-exposed-military-code-breaking-computer-project-to-entire-internet/ [theintercept.com] via "Windsor Green"... there's some SECURITY INFO for you.
* Plus, the stupid LIBS used for https? Always break backward compatibility EVERY SINGLE F'ING TIME so when old model's found to be breakable (ala TLS & SSL)? They don't keep the same return types (common way to bust API's by shithead rookies) so that legacy apps can't
Re: (Score:2)
So I read the document provided and I can spare the rest of the community the work: The (insert three letter agency of choice here) have a supercomputer in the making or already ready that's a few 100 times faster than anything they had before and that can easily break 1024bit key encryption.
So switch to 4096bit and SHA256.
That's basically the gist of the document and the solution to this the-sky-is-falling problem. They have not broken https, they just threw more computing power against it. Which is pretty
Re: (Score:2)
Thats the interesting part. The lists of the Anti Virus brands that don't have the skills to do behavioral analysis or watch over the OS for changes.
Some brands have the staff and skills to find and track gov funded malware long term.
With more smart people globally reading the gov files, more people might just avoid that low quality AV brands and buy quality AV that detected or was able to trac
Again? (Score:2)
Last time they pulled that stunt I think the bid went up to 3 or even 5 bitcoins.
Re: (Score:1)
Re: (Score:2)
Other nations got their networks totally penetrated by the NSA and GCHQ so they don't do anything interesting on the phone or internet anymore.
They learned from all their past network mistakes and have people thinking about better security.
They have a secure base, site, science city thats totally secure from the outside world. No tourists, no students on holiday, no illegal migrants, no foreigners wondering around, no embassy staff making friends. Less spies get near their sites o
Not a good move (Score:2)
Writing Style (Score:3)
> Using trademark garbled English,
I wonder if they translate and reverse their releases to help defeat style-analysis on what they write.
Re: (Score:2)
Trump is NOT really smart.
And of course such an action could put a target on the back of every american overseas
Brutality and killing has only ever resulted in MORE people being brutalised and killed, is never actually a solution.
Re: (Score:2)
"Brutality and killing has only ever resulted in MORE people being brutalized and killed, is never actually a solution."
Spoken like a true, brainwashed, ignorant liberal... Apparently you failed history class. Here are a few highlights of the exact opposite: WW2 ended "new Socialist" Hitler's bid for world domination and extermination of around 8 million people of "lesser races", Korea stopped the brutalization and murder of millions of south Koreans (see what happened when the US failed in Vietnam and th
Strike back (Score:2)
Well, America, it is time to hit back at those that seek to disrupt our way of life through these attacks. We are seeing just the beginning of this new warfare, but we need to hark back to the spirit that was awoken in us in 1941, and we need to hit
Re: (Score:2)
2. You do not automatically have the right to attack any country or their citizens
3. ALL you will do is create enemies and loose allies.
Re: (Score:1)
We have a difficult problem facing society, one that cannot be solved by the usual declaration of War on (ISSUE HERE). As we've seen before, the unintended consequences ended up being worse than the original problem.
Currently we still have something resembling an open internet. Those that fall sway to jingoistic buzzwords to justify knee-jerk overreactions is why we can't have nice things.
Re: (Score:3)
I was just watching Pearl Harbor - not a great film, but it brought back to me that the greatest threat to these people is the sheer force of American willpower. The Japanese military machine tugged at the tail of a sleeping tiger, and they lived to regret it.
I doubt American willpower was a serious contender considering the other side had people litter lay training to be suicide bombers. Americans troops typically were the first to break and run away. We had some advantages in that Americans were also the first to rally and run back into battle with more resolve, and with a different plan to make sure the last mistake didn't happen. The first mistake the Japanese did was mistakenly think that bombing people would make them want to give up. If anything, actively
Hay Dumb Ass Shadow Brokers ! (Score:2)
Sooner or later... (Score:1)
Yeah (Score:2)
Bank of America CEO on security budget (Score:2)
"The only place in the company that doesn't have a budget constraint is that area."
Re: (Score:1)
Re: (Score:2)