Mediaboss Marketing

New York Times

Hackers Hit Dozens of Countries Exploiting Stolen NSA Tool New York Times The attacks on Friday appeared to be the first time a cyberweapon developed by the N.S.A., funded by American taxpayers and stolen by an adversary had been unleashed by cybercriminals against patients, hospitals, businesses, governments and ordinary ... NSA-created cyber tool spawns global attacksPolitico An NSA Cyber Weapon Might Be Behind A Massive Global Ransomware OutbreakForbes Ransomware Cyber Attack Using NSA Tools Hits Russian Government, Global Firms and HospitalsNewsweek TechCrunch -Sacramento Bee -The Providence Journal -NHS Digital all 1,870 news articles »

See the original post here:
Hackers Hit Dozens of Countries Exploiting Stolen NSA Tool - New York Times

In mid-April,an arsenal of powerful software tools apparently designed by the NSA to infect and control Windows computers was leaked by an entity known only as the Shadow Brokers. Not even a whole month later, the hypothetical threat that criminals would use the tools against the general public has become real, and tens of thousands of computers worldwide are now crippled by an unknown party demanding ransom.

An infected NHS computer in Britain

Gillian Hann

The malware worm taking over the computers goes by the names WannaCry orWanna Decryptor. It spreads from machine to machine silently and remains invisible to users until it unveils itself as so-called ransomware, telling users that all their files have been encrypted with a key known only to the attacker and that they will be locked out until they pay $300 to an anonymous party using the cryptocurrency Bitcoin. At this point, ones computer would be rendered useless for anything other than paying said ransom. The pricerises to $600 after a few days; after seven days, if no ransom is paid, the hacker (or hackers) willmake the data permanently inaccessible (WannaCry victims will have a handy countdown clocktosee exactly how much time they have left).

Ransomware is not new; for victims, such an attack is normally a colossal headache. But todays vicious outbreak has spread ransomware on a massive scale, hitting not just home computers but reportedly health care, communications infrastructure, logistics, and government entities.

Reuters saidthathospitals across England reported the cyberattack was causing huge problems to their services and the public in areas affected were being advised to only seek medical care for emergencies, and that the attack had affected X-ray imaging systems, pathology test results, phone systems and patient administration systems.

The worm has also reportedly reached universities, a major Spanish telecom, FedEx, and the Russian Interior Ministry. In total, researchers have detected WannaCry infections in over 57,000 computersacross over 70 countries(and counting these things move extremely quickly).

According to experts tracking and analyzing the worm and its spread, this could be one of the worst-ever recorded attacks of its kind. The security researcher who tweets and blogs asMalwareTech told The Intercept, Ive never seen anything like this with ransomware, and the last worm of this degree I can remember is Conficker. Conficker was a notorious Windows worm first spotted in 2008; it went on to infect over 9million computers in nearly 200 countries.

Most importantly, unlike previous massively replicating computer worms and ransomware infections, todays ongoing WannaCry attack appears to be based onan attack developed by the NSA, code-named ETERNALBLUE. The U.S. software weapon would have allowed the spy agencys hackers to break into potentially millions of Windows computers by exploiting a flaw in how certain versions of Windows implemented a network protocol commonly used to share files and to print. Even though Microsoft fixedthe ETERNALBLUE vulnerability in a March software update, the safety provided there relied on computer users keeping their systems current with the most recent updates. Clearly, as has always been the case, many people (including in government) are not installing updates. Before, there would have been some solace in knowing that only enemies of the NSA would have to fear having ETERNALBLUE used against them but from the moment the agency lost control of its own exploit last summer, theres been no such assurance. Today shows exactly whats at stake when government hackers cant keep their virtual weapons locked up. As security researcher Matthew Hickey, who tracked the leaked NSA tools last month, put it, I am actually surprised that a weaponized malware of this nature didnt spread sooner.

Screenshot of an infected computer via Avast.

The infection will surely reignite arguments over whats known as the Vulnerabilities Equity Process, the decision-making procedure used to decide whether the NSA should use a security weakness it discovers (or creates) for itself and keep it secret, or share it with the affected companies so that they can protect their customers. Christopher Parsons, a researcher at the University of Torontos Citizen Lab, told The Intercept plainly: Todays ransomware attack is being made possible because of past work undertaken by the NSA, and that ideally it would lead to more disclosures that would improve the security of devices globally.

But even if the NSA were more willing to divulge its exploits rather than hoarding them, wed still be facing the problem that too many people really dont seem to care about updating their software. Malicious actors exploit years old vulnerabilities on a routine basis when undertaking their operations, Parsons pointed out. Theres no reason that more aggressive disclose of vulnerabilities through the VEP would change such activities.

A Microsoft spokesperson provided the following comment:

Today our engineers added detection and protection against new malicious software known as Ransom:Win32.WannaCrypt. In March, we provided a security update which provides additional protections against this potential attack. Those who are running our free antivirus software and have Windows updates enabled, are protected. We are working with customers to provide additional assistance.

Update: May 12, 2017, 3:45 p.m. This post was updated with a comment from Microsoft.

Update: May 12, 2017, 4:10 p.m. This post was updated with a more current count of the number ofaffected countries.

Here is the original post:
Leaked NSA Malware Is Helping Hijack Computers Around the World - The Intercept

Foreign Policy (blog)

Report: NSA Analysts Frequently Broke Rules on Intelligence Collection Foreign Policy (blog) NSA analysts had a startling error rate of 85 percent on another, smaller part of the NSA's foreign intelligence programs, a statistic that raises questions about the propriety of current powers to search that data, the court wrote. That program ...

More:
Report: NSA Analysts Frequently Broke Rules on Intelligence Collection - Foreign Policy (blog)

Some media reports about the ransomware -- called WannaCry -- that rocked the UK health system, Spain's telecom industry, and other targets in Europe Friday say that hackers pulled it from a leaked NSA tool kit.

That's not really accurate.

Instead, computing experts say and a review of the computing code shows, the leaked NSA tool kit demonstrated to the hackers how they could attack these systems. The hackers didn't use NSA code, but they did copy something from the tool kit.

"WannaCry ransomware uses one of the exploitsreleased recently by Shadowbrokers in the leaked NSA tools archive," said Andrew Komarov, chief intelligence officer for the cybersecurity firm InfoArmor. "This is pretty normal practice, where cybercriminals are using the latest vulnerabilities in order to increase the efficiency of their malware."

The name of the NSA tool that the hackers drew on to develop the new ransomware is called "Eternalblue".

The software fix for the vulnerability that the ransomware exploits came out in March, before the Shadowbrokers leak, so experts say there was theoretically time to patch systems in advance of an attack.

Komarov said there was no indication that WannaCry or Friday's attack had anything to do with the NSA "or any other state-sponsored cyber offensive activities."

The FBI is warning that unknown hackers have launched cyberattack with 'destructive malware' in the U.S. Kacper Pempel

The Agency announced late Tuesday that it has established a "Korea Mission Center" to "harness the full resources, capabilities, and authorities of the Agency in addressing the nuclear and ballistic missile threat posed by North Korea." The CIA also announced that Director Mike Pompeo has named a "veteran intelligence officer" to run the center but declined to name the officer for security reasons.

Both publicly and privately, the agency has said North Korea has been one of, if not the most, difficult of intelligence targets.

"Creating the Korea Mission Center allows us to more purposefully integrate and direct CIA efforts against the serious threats to the United States and its allies emanating from North Korea," said Pompeo. "It also reflects the dynamism and agility that CIA brings to evolving national security challenges."

Oregon Democrat Ron Wyden says he will block the nomination of Donald Trumps pick to be the top Treasury intelligence official until Treasurys anti-money-laundering agency produces documents requested by the Senate Intelligence Committee related to Trump.

Sen. Wyden says he will maintain a hold on the nomination of Sigal Mandelker to be under secretary of the Treasury for terrorism and financial intelligence until the documents are produced.

This week, Intelligence Committee Ranking Member Sen. Mark Warner, D-Virginia, announced that the committee had asked the Treasury Departments Financial Crimes Enforcement Network (FinCEN) for records relating to President Trump and his associates.

"I have stated repeatedly that we have to follow the money if we are going to get to the bottom of how Russia has attacked our democracy," Wyden said. "That means thoroughly review any information that relates to financial connections between Russia and President Trump and his associates, whether direct or laundered through hidden or illicit transactions. The office which Ms. Mandelker has been nominated to head is responsible for much of this information."

Wyden-0702508-18401- 0010

Three senior defense officials report that Iran test-fired a high-speed torpedo near the Strait of Hormuz on Sunday.

The Hoot torpedo is still in the testing phase, the officials report, but once it is fully operational it should be able to travel about12,000 yards (approximately six nautical miles) at a speed of about 200 knots per hour (approximately 250 miles per hour). None of the officials couldsay whether the test was successful or not.

The USS George HW Bush strike group is in the Gulf right now but all three officials said the test did not pose a threat to U.S. shipsor assets in the region.

Two of the officials said that the Iranian military last tested this torpedo in February 2015.

The ACLU is suing four federal agencies for records related to the Jan. 29 raid in Yemen that killed a Navy SEAL and civilians, including children.

The civil liberties organization filed a freedom of information request for documents in March and then filed a lawsuit in Manhattan federal court on Monday to force the government to respond.

"After conducting an internal investigation, the government released little information about the circumstances surrounding the Raid, the legal or factual justifications for it, and its consequences," the suit said.

Among the information the ACLU wants is an accounting of the civilians killed in the raid, which erupted in a deadly firefight after, as one senior U.S. intelligence official told NBC News, "almost everything went wrong."

The head of U.S. Central Command told Congress between four and 12 civilians were killed, but Human Rights Watch and others have put the toll higher.

The Trump administration has characterized the raid as a huge success. However, NBC News has reported in March that none of the intelligence gleaned from the operation so far has proven actionable or vital.

A man stands on the rubble of a house destroyed by a Saudi-led airstrike in the outskirts of Sanaa, Yemen, Feb. 16, 2017. At least one Saudi-led airstrike near Yemen's rebel-held capital killed at least five people on Wednesday, the country's Houthi rebels and medical officials said. Hani Mohammed / AP

Gregory Lepsky appeared in a New Jersey federal courtroom Friday to face charges that he planned to detonate a pressure cooker bomb in New York City in the name of ISIS.

Seamus Hughes of George Washington's Program on Extremism pulled this inventory of the defendant's internet search history from the case file.

Eight men accused of plotting to attack the 2016 Olympic Games in Rio de Janeiro on behalf of ISIS were sentenced Thursday.

The men were found guilty in a Brazilian court of recruiting and promoting terrorism and face sentences that range from five to 15 years in prison. They were arrested in a series of raids in late July 2016, several weeks before the Games.

They had all pledged allegiance to an ISIS offshoot, authorities said, anddiscussed a plan to contaminate one of Rio de Janeiro's water reservoirs.

"All of the accused were dedicated to promoting the terrorist organization called the Islamic State through the social networks Facebook, Twitter and Instagram," said the judge in the case, Marcos Josegrei da Silva.

The suspects, all Brazilian citizens, discussed plans in email threads, and via messaging apps like Telegram and WhatsApp, according to court documents reviewed by NBC News.

Some celebrated other terrorist attacks, like the shooting at the Orlando nightclub.

It doesn't appear any of them knew each other aside from conversations online and messaging apps.

The convictions are the first under Brazil's new anti-terrorism law. Previously, terrorism was not clearly defined in Brazil and was treated like any other crime; now an individual can face up to 22 years in jail if found guilty of preparing terrorist acts.

One of the men sentenced under Brazil's new terrorism law for a plot against the 2016 Olympic Games in Rio. Court Documents

The newest issue of the ISIS magazine Rumiyah includes instructions for would-be terrorists about how to kill pedestrians with trucks. In infographic form, the instructions list the characteristics of the ideal vehicles ("slightly raised chassis and bumper"), where to buy, steal or rent the trucks, and the ideal targets.

The latest installment of the magazine's "Just Terror Tactics" feature comes as the U.S. Transportation Security Administration has just sent a warning about truck attacks to law enforcement agencies across the U.S.

Truck Attacks Poster Propaganda

We've got a bad feeling about this.

The Russian government jumped on the "May the 4th Be With You" bandwagon by tweeting the message "Come to our side" over a photo of a key Star Wars character.

Han Solo? Nope.

Luke Skywalker? Nah.

Yoda, you ask? Nyet.

The Russian Embassy in the U.K. chose a photo of Darth Vader, a villain bent on galactic domination, to personify itself on what's come to be known as Star Wars Day.

Hopefully it's just a snarky joke from a Twitter account known for trolling. Otherwise, someone tell the Pentagon to fire up the Millennium Falcon.

See more here:
Ransomware That Hit Europe's Computers Did Not Come From NSA Leak - NBCNews.com

A massive cyberattack hit tens of thousands of computers in dozens of nations. Reports of the attack first surfaced in Britain, where the National Health Service described serious problems. (Sarah Parnass/The Washington Post)

Computers around the world are suffering an attack from malicious software. The compromised computers have been hit by ransomware software that encrypts the computers hard drive so that all the information on it is unavailable, and refuses to release it until a ransom is paid in Bitcoin, an online currency that is difficult to trace. Among the victims are FedEx, Britains National Health Service and computers belonging to Russias Ministry for the Interior.

Ransomware attacks have happened before. What is unusual is how quickly this attack is compromising large numbers of critical computers. It has been so successful because it has made use of a so-called zero-day exploit a previously unknown flaw in Windows software that makes it easy to take control of vulnerable systems. This zero day exploit became publicly known last month, when it was released as part of a treasure trove of NSA data by the Shadow Brokers, a shadowy group of hackers who many believe are associated with Russian intelligence. Criminal hackers appear to have combined this exploit with ransomware tools to mount a worldwide campaign. Heres what you need to know to understand what happened.

The NSA collects zero day exploits

One of the NSAs key functions is to spy on intelligence targets in other countries. This, very often, involves compromising their computer systems. Hence, zero-day exploits for commonly used software, such as Windows, are potentially very valuable to the NSA and to its rival intelligence agencies. Big complex pieces of software like operating systems have a myriad of bugs, some of which can allow hostile outsiders to take control of computers running the software. Such exploits can be used to gain surreptitious control of computers or other devices running software, scoop up information, or even turn computers or phones into silent spying devices by, for example, taking control of their cameras and microphones. There are even clandestine markets where zero day exploits are bought and sold.

But the NSA has a dual role

The complicating factor for the NSA is that it is not only supposed to hack into the computers of interesting foreigners it is supposed to protect the computers of U.S. citizens and firms from outside attacks. This poses problems, because foreigners and U.S. citizens tend to use the same kinds of software, and be subject to the same kind of attack. Every time the NSA discovers a new vulnerability, it is supposed to go through an equities process, in which it determines whether it is better to disclose the vulnerability to software companies (so that U.S. citizens, firms and the government can be protected) or keep it for its own use (so that it can compromise foreign systems).

When the NSA discloses the vulnerability, the creators of the software can modify the software through a patch, which can then be downloaded by users to close the vulnerability. When the NSA doesnt disclose it, nothing gets done unless someone independently discovers the problem (or the hole gets closed inadvertently thanks to other changes). When Microsoft, Apple or Google make you update your computer or phone operating system (or else suffer a series of annoying reminders), they are sometimes patching real vulnerabilities.

This zero-day exploit was kept by the NSA

The Shadow Brokers leak revealed a number of NSA documents, including zero-day exploits that were previously unknown to the general public. Importantly, the Shadow Brokers leaked the files they had compromised in multiple stages, saving the zero-day exploits for a later release, which happened a couple of months later. Although no one is saying so in public, it appears likely that the NSA contacted Microsoft as soon as they realized that the zero-day exploits had been compromised by hostile actors. Certainly contrary to initial reports Microsoft patched its software soon after the initial Shadow Brokers release in ways that suggested the company had become aware of the vulnerabilities. This meant that when the zero-day exploits were released last month, people with up-to-date installations of the relevant version of Windows were already protected against these particular zero day attacks.

Patching is not always enough

The problem is that many users take time to patch their systems. Sometimes this is because of laziness, ignorance or lack of resources. Sometimes, it is because organizations have to run a variety of complex software packages and may worry that if they change one software component (especially a crucial platform or operating system) the other software will stop working. Thus, big organizations often want to take time to test newly patched software before they start running it.

For whatever reason, a variety of organizations appear not to have downloaded and implemented the patches. This meant that their systems had a gaping vulnerability, which the ransomware has now taken advantage of, compromising systems in hospitals, businesses and government ministries.

There are no easy solutions

There are many causes for the current impasse. If the NSA had weighed the vulnerabilities differently, and quietly informed Microsoft years ago, the problem would never have happened at a wider scale, because Microsoft would have issued the patch long before criminals could take advantage. Obviously, if the Shadow Brokers had kept quiet, criminals would not have been able to take advantage (although the Shadow Brokers themselves could have used the exploits against U.S. and other targets with nearly complete impunity).

The bigger problem is that no one is in charge. Responsible software producers will issue patches to protect against vulnerabilities (although they may not be obliged to under the law), but there is no way to ensure that everyone implements them. Unfortunately, the problem is getting worse rather than better over time. As Bruce Schneier points out, many of the devices on the Internet these days are not computers or phones. They are DVD players, TVs, webcams and, maybe soon, even salt shakers. The companies building such devices are not always careful about looking for, or keeping track of vulnerabilities, so that hackers can target huge numbers of poorly secured devices (and use these devices to attack other Internet users). While experts have identified the importance of the problem, it isnt clear that there is any plausible solution without radical changes to the ways we build technologies, and shape incentives for businesses and users to keep these technologies secure.

Continued here:
Cybercriminals have just mounted a massive worldwide attack. Here's how NSA secrets helped them - Washington Post