• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

Cyberattacks using leaked NSA hacking tool reported in 12 countries

This runs counter to what what's already known about the SMBv1 vulnerability covered in MS17 010. Ransomware can be spread by phishing, as always, but this seems to be particularly virulent because it spread via a known exploit. Everything I've read suggests that a vulnerable (unpatched or unpatchable) workstation with SMBv1/CIFS File Sharing support enabled could become infected without the user doing anything.

I worked at a company that got hit with this rasomeware, and it was infected from downloading a file from a phishing scam via email. We were able to act fast enough so it didn't jump onto the network, but it looked exactly the same as this. The thing I'm not understanding is if they are getting infected the same way. I looked at what you posted, but it didn't make a lot of sense to me. WannaCry is looking for the existing backdoor exploits, but how does WannaCry get on system to begin with. I'm assuming the the same way my company got it but this is so widespred I can't believe so many people fell for this scam.

Same way neogaf ads some times open google play store on mobile.
Always is some shitty loophole.

Yeh, i mean this makes sense to me that an theres are things that run thru ads that get onto people system. But in this case, that's not how WannaCry is getting on systems. What I want to know is how WannaCry getting on the system to begin with is what i'm wondering.
 

Dopus

Banned
Wikileaks being agents of Russia is not hyperbole. They are trash.

I assumed that they were involved given the multiple posts posting about it since I couldn't recall the details of it. If they're not, sure, ok. Doesn't make them not terrible.

It's nothing but hyperbole based on what we know right now.
 

Arttemis

Member
It's nothing but hyperbole based on what we know right now.

It can be called conjecture, sure. That said, there's nothing hyperbolic about accusing an organization that releases mass amounts of volatile data, sometimes targeted against leftist politicians, as being a pro-Russian organization. That's literally Russia's playbook.
 

Liseda

Member
People blaming WikiLeaks for NSA-exploits being leaked? are you serious?

Looks like standard targeted cybercrime anyway, update your computers people o/
 

ameratsu

Member
I worked at a company that got hit with this rasomeware, and it was infected from downloading a file from a phishing scam via email. We were able to act fast enough so it didn't jump onto the network, but it looked exactly the same as this. The thing I'm not understanding is if they are getting infected the same way. I looked at what you posted, but it didn't make a lot of sense to me. WannaCry is looking for the existing backdoor exploits, but how does WannaCry get on system to begin with. I'm assuming the the same way my company got it but this is so widespred I can't believe so many people fell for this scam.

Read this post https://www.reddit.com/r/worldnews/comments/6arkxt/comment/dhh6c4w

If you are still lost, read up on what computer worms are and how they spread
 

Dopus

Banned
It can be called conjecture, sure. That said, there's nothing hyperbolic about accusing an organization that releases mass amounts of volatile data, sometimes targeted against leftist politicians, as being a pro-Russian organization. That's literally Russia's playbook.

It's an exaggerated statement presented as fact. It holds no weight to it, so it irks me when I see it. It's conspiratorial nonsense as far as I am concerned, and unless there is actual evidence presented to us then I'm not going to take it seriously.

It's okay to criticise them, and I'm certainly not a fan of the timings of certain releases. But to make a claim that they're Russian shills is going beyond what we actually know. Moreover, you have to discount completely what the organisation themselves have said in addition to taking everything the state has said as a matter of fact. This is problematic in and of itself.

And we're not even touching what the official line is regarding them and how making such a statement is going far beyond it. At best, there is a suggestion that Russia used Wikileaks. Clapper even stated that if this was the case and that they don't know whether Wikileaks knew about the particular source being state-sponsored. Wikileaks, of course, categorically denied any state-sponsored actors being involved.

If you've already decided that they're Russian agents then that is a pointless question to ask in the first place. But I've yet to see a good reason to put full trust in intelligence agencies that have consistently misled the public. And I've yet to see good evidence to suggest that they are compromised by Russian intelligence or are indeed one and the same.
 

Paganmoon

Member
so of course they are lining up their dominos so they can flick the first one, start pushing software then go home for the weekend..

That's bound to work out well :)

Man what a week for cybersecurity. The Microsoft Endpoint protection vulnerability early in the week, and I thought the HP/Conexant keylogger would be the big news item of the day yesterday morning.

I should look to changing careers.
 

Tworak

Member
having a grace period for a few months on security updates in wsus to "check if they are stable" is a great idea
 
What does this have to do with WikiLeaks? Looking at the articles I've seen it was a group named Shadow Brokers that released the tools independantly.

Right. I was wondering what exactly Wikileaks had to do with it since I don't recall hearing anything about them releasing actual NSA tools and such. I know they did report that the NSA had lost control over it's "arsenal" however, but that was about it.
 

kirblar

Member
It's an exaggerated statement presented as fact. It holds no weight to it, so it irks me when I see it. It's conspiratorial nonsense as far as I am concerned, and unless there is actual evidence presented to us then I'm not going to take it seriously.

It's okay to criticise them, and I'm certainly not a fan of the timings of certain releases. But to make a claim that they're Russian shills is going beyond what we actually know. Moreover, you have to discount completely what the organisation themselves have said in addition to taking everything the state has said as a matter of fact. This is problematic in and of itself.

And we're not even touching what the official line is regarding them and how making such a statement is going far beyond it. At best, there is a suggestion that Russia used Wikileaks. Clapper even stated that if this was the case and that they don't know whether Wikileaks knew about the particular source being state-sponsored. Wikileaks, of course, categorically denied any state-sponsored actors being involved.

If you've already decided that they're Russian agents then that is a pointless question to ask in the first place. But I've yet to see a good reason to put full trust in intelligence agencies that have consistently misled the public. And I've yet to see good evidence to suggest that they are compromised by Russian intelligence or are indeed one and the same.
They are Russian shills. It is known. Assange had a goddamn show on Russias propaganda network! Your post is complete and total whataboutism that tries to say that "we can't trust western intelligence agencies" to undermine them when it's blatantly obvious to anyone with a functioning brain what's going on. No one should need the CIA to tell them what they can figure out on their own.
 

NeOak

Member
FYI: the NSA had reported the vulnerabilities to Microsoft, who issued patches well before the Shadow Brokers leaked said vulnerabilities.

The problem: people not applying the patches. It's always not applying the damn patches. Always apply the patches, fools!
This is why W10 has mandatory updates.
 

Coreda

Member
They are Russian shills. It is known. Assange had a goddamn show on Russias propaganda network!

Looking at it the series had initial broadcast exclusivity for RT due to other networks declining to host it, despite not being produced or made by them, yet is being cited as evidence of WikiLeaks being an arm of the Russian government. Good enough I suppose. Half a dozen posters here were convinced it was WikiLeaks releasing this data to begin with despite none of the articles stating this, though I've listened to television hosts (and even media releases) in the past make the same connection for unrelated leaks without any correction from colleagues so I guess it's not that surprising.
 

Dopus

Banned
They are Russian shills. It is known. Assange had a goddamn show on Russias propaganda network! Your post is complete and total whataboutism that tries to say that "we can't trust western intelligence agencies" to undermine them when it's blatantly obvious to anyone with a functioning brain what's going on. No one should need the CIA to tell them what they can figure out on their own.

"Whataboutism". It seems like this is the go-to retort for many around here when they don't actually wish to engage with the argument.

You're deluded. I'm sorry. You've given nothing and actually said nothing but an accusation that has been presented as fact. Call it speculation. Call it conjecture. Call it whatever you want. It's most certainly not a fact.

If "it is known" then could you explain the state's position? If "it is known" could you provide us all the evidence for your outrageous assesment? You won't, because you can't. It is not reasonable.

Assange had a show that RT bought the rights to. RT didn't make it or produce it. Dartmouth films made it and they're based in London. They're also the ones who made and produced The World Today with Tariq Ali, just so you know. RT had the highest bid. This is known. It's also known that Assange has expressed his dismay that RT bought the rights. So please stop with this conspiratorial nonsense.
 

lazygecko

Member
This has made me really paranoid. The entire process of checking whether your Win10 version is protected or not is way too convoluted for me to make any sense of, what with all the different KB IDs and how they overlap/override eachother. I've gotten automatic updates throughout May, but none of the KB numbers attached to them seem to match up with the ones listed here. I tried getting the latest KB4019472 patch through Windows Update, but as usual that thing is being a piece of shit and has the download stuck at 0%. I've also tried downloading manual .msu installers through the Microsoft Update Catalog but they simply fail to install and will not specify why.
 

D4Danger

Unconfirmed Member
This has made me really paranoid. The entire process of checking whether your Win10 version is protected or not is way too convoluted for me to make any sense of, what with all the different KB IDs and how they overlap/override eachother. I've gotten automatic updates throughout May, but none of the KB numbers attached to them seem to match up with the ones listed here. I tried getting the latest KB4019472 patch through Windows Update, but as usual that thing is being a piece of shit and has the download stuck at 0%. I've also tried downloading manual .msu installers through the Microsoft Update Catalog but they simply fail to install and will not specify why.

KB4019472 is a patch for Windows 10 v1607

if you're running Windows 10 v1703 (you should be if you're up to date) you're fine? I think that's right anyway. feel free to correct me if I'm wrong.
 

lazygecko

Member
KB4019472 is a patch for Windows 10 v1607

if you're running Windows 10 v1703 (you should be if you're up to date) you're fine? I think that's right anyway. feel free to correct me if I'm wrong.

Going to System > Help > About says I'm on v1607 (14393.1066)

Why it's refusing to apply the patch is completely beyond me, or if 1607 is even enough to be protected. The lack of information is so frustrating.
 

D4Danger

Unconfirmed Member
Going to System > Help > About says I'm on v1607 (14393.1066)

Why it's refusing to apply the patch is completely beyond me, or if 1607 is even enough to be protected. The lack of information is so frustrating.

yeah I don't know enough about this to help sorry but I saw people saying if you were using 1703 (the Creators Update released last month) you're okay. Maybe just install that? they'll make you do it eventually anyway.
 

brian577

Banned
Then why report on it at all?

Because it's there job to report the news and the hacks are one of the biggest stories of the week?

The group in your post stole and published the hacking tools online. Any organized group could of used them.
 
Top Bottom