Windows 0-days, SWIFT bank hacks among latest Shadow Brokers release | Hacker News Reader

Windows 0-days, SWIFT bank hacks among latest Shadow Brokers release

arstechnica.com

87 pointsbootload10 comments

Other discussions:

https://news.ycombinator.com/item?id=14114665

https://news.ycombinator.com/item?id=14119656

https://news.ycombinator.com/item?id=14116791

"It is very significant as it effectively puts cyber weapons in the hands of anyone who downloads it. A number of these attacks appear to be 0-day exploits which have no patch and work completely from a remote network perspective."

MS Windows on a network was never really secure. These hacked will makes old Windows based machines toxic. Pretty sure not all, if any of the historic releases will be patched. Read this post, "Microsoft: most ShadowBrokers exploits are already patched" ~ https://news.ycombinator.com/item?id=14119656

"Researchers from security firm Kaspersky Lab, meanwhile, have confirmed the leaked code they analysed bears unique signatures tied to Equation Group"

Here is a Kaspersky Q&A (pdf) on the Equation Group ~ https://securelist.com/files/2015/02/Equation_group_question...

From the article:

With the exception of Esteemaudit, the exploits should be blocked by most firewalls. And best practices call for remote desktop connections to require use of a virtual private network, a practice that should make the Estememaudit exploit ineffective

In other words, if you're behind a firewall/NAT with the relevant ports inaccessible from the Internet, you won't be affected even if you're not running a patched version of Windows.

From the exploit list provided and their description, it seems like using Win10 and Win Server 2016 is enough to protect yourself against these attacks.

...except that the telemetry and autoupdate capabilities of those OSs means the NSA doesn't even have to exploit anything; they can just ask MS to hand over the data. The saying about "known unknowns" and "unknown unknowns" comes to mind...

According to 8chan one smb2 exploit actually affects Win10, despite being tagged as intended for much older Windows.

8chan providing security expertise and 4chan electing presidents and directing bombardments in Syria. What a time to be alive.

The NSA can't just request information about Americans

So is that a new change since the massive data collection about Americans that Snowden initially revealed? I don't recall any reforms being all that significant.

You might have that mixed up, as most of those leaks pertained to foreign intelligence gathering. The aspect involving Americans was the telephone metadata program, and a bill did indeed get passed as a result to fix that.

"Most" is correct, but some of the other reported programs sweep up large numbers of Americans. Examples:

"The National Security Agency is harvesting hundreds of millions of contact lists from personal e-mail and instant messaging accounts around the world, many of them belonging to Americans"

https://www.washingtonpost.com/world/national-security/nsa-c...

"NSA was using its metadata troves to build profiles of US citizens' social connections, associations and in some cases location"

https://www.theguardian.com/world/2013/sep/30/nsa-americans-...

"The N.S.A. is not just intercepting the communications of Americans who are in direct contact with foreigners targeted overseas, a practice that government officials have openly acknowledged. It is also casting a far wider net for people who cite information linked to those foreigners"

http://www.nytimes.com/2013/08/08/us/broader-sifting-of-data...

The firewall will protect you if it isn't compromised. From the article: "Some of the previous weapons-grade leaks, for instance, exploited unpatched vulnerabilities in Cisco Systems firewalls."

Reply on news.ycombinator.com