SoylentNews is people
SoylentNews
Researchers have detected a new worm that is spreading via SMB, but unlike the worm component of the WannaCry ransomware, this one is using seven NSA tools instead of two.
The worm's existence first came to light on Wednesday, after it infected the SMB honeypot of Miroslav Stampar, member of the Croatian Government CERT, and creator of the sqlmap tool used for detecting and exploiting SQL injection flaws.
The worm, which Stampar named EternalRocks based on worm executable properties found in one sample, works by using six SMB-centric NSA tools to infect a computer with SMB ports exposed online. These are ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY, which are SMB exploits used to compromise vulnerable computers, while SMBTOUCH and ARCHITOUCH are two NSA tools used for SMB reconnaissance operations.
Once the worm has obtained this initial foothold, it then uses another NSA tool, DOUBLEPULSAR, to propagate to new vulnerable machines.
Source: BleepingComputer
(Score: 1, Insightful) by Anonymous Coward on Sunday May 21 2017, @02:34PM (11 children)
... as long as individual consumers have little control over what their devices can do.
Sure, transistor-to-app FOSS will produce insecure systems, but at least I would be able to take care of myself if I so chose; relying on central planners (e.g., Apple, Samsung, government, etc.) to define your world will only ever end in the tears of impotent rage.
(Score: 1, Insightful) by Anonymous Coward on Sunday May 21 2017, @03:30PM (6 children)
This is true. It also includes open source.
My TV has tons of opensource junk in it. Busybox distro. It will never see another up date from LG. They moved on years ago to newer shiny toys.
It is like the vulin Intel just had with their stuff. Unless all of the OEMs go back and reissue. Well though.
Fixes are usually easy with a good test case (open or closed). Patching is the hard bit. Closed source is not really that closed. I have seen dudes reverse engineer pretty much every electronic device out there. It is just a mater of time and usually a copy of IDA Pro. It is just obfuscated. I have seen dudes pick out the bits off a piece of silicon to find the internal program just so they can reverse engineer it and then find exploits.
It is *all* open. All of it. It is worse than you think or dream.
(Score: 2) by SomeGuy on Sunday May 21 2017, @05:24PM
I have recently been trying to explain to some people how products with such embedded "fancy" extra software or internet features can actually become a very bad thing.
Anything internet related is almost guaranteed to stop working after a couple of years. Protocols change, servers move, "cloud" services disappear, companies go out of business. And even while such a product is fully supported it can be vulnerable to to attack.
I shit you not, in the not too distant future, all these wifi/cloud connected "smart" thermostats that AC installers are forcing on people these days will wind up with some kind of ransomware that will freeze or fry people until they pay up. They could also be used to spy on people or display advertising.
But all the retarded consumeroids out there don't understand or care and are perfectly happy to buy a new product in two years when the old one stops working right. Of course, the manufacturers love that too.
(Score: 0) by Anonymous Coward on Sunday May 21 2017, @06:03PM (4 children)
It may all be "open" but it certainly isn't free, try distributing it and you will find out, likely painfully. And things like the DMCA say you can't even poke at devices you've bought...
There is plenty of open source junk. But not nearly as much a proprietary junk. And you won't be betting on a pig in a poke either.
Nihilism is a great way of life but don't expect it to lead you anywhere.
(Score: 0) by Anonymous Coward on Sunday May 21 2017, @08:26PM (3 children)
http://opensource.lge.com/index [lge.com]
I do not need to distrubute any of it to create a worm now do I? I am already being a dick. Do you think some copyright law is going to stop me?
Its all crap. All of it. The only thing open source gives me is the ability to to look at the code in a human readable format. It does not give me the exact toolchain to fix anything. It would take me months of my time to 'fix' my TV. I yanked the plug. My thermostat is a simple digital control or analog mercury switch. To keep the company who decides it needs to talk to a server just so I can change the temp of my house from turning me off when they go under.
Nihilism is a great way of life but don't expect it to lead you anywhere.
Hardly. It is fucked up. I keep hearing how open source is going to 'save the world'. But what do I see? More closed source junk with a thin veneer of open source. Which only reduces their cost and sticks me with code that is 10+ years old shipped with known vulins and known passwords. You think the current IoT storms that are brewing were written on closed source? They sit upon the backs of open source. We sit back and say it is easy to fix. Yes all bugs are easy once an example is found that is the foundation of software engineering and QA. But the patching bit is the bitchy part which no one wants to talk about and then get personal when someone points it out. Open and closed source have the exact same issues here. Open source will not magically fix this monumental growing problem of old hardware or old software no one wants to look at anymore because its not cool anymore. I am not being nihilist. I am being practical. We are being sold a bill of goods and 'open source' is the kool aid.
Some of the largest bot nets out there right now, today, are open source routers and IoT devices. Good luck getting the company that cranked out 200k of some insecure camera that went under 3 years ago to give you firmware to update and then get 200k+ customers to patch them.
(Score: 0) by Anonymous Coward on Sunday May 21 2017, @09:51PM
FOSS. Look it up.
You're fighting a straw man.
(Score: 2) by DECbot on Monday May 22 2017, @03:36PM
You're making a damn good argument to go back to analog and discrete digital components and forgo the reliance of software defined devices. Perhaps the current software everywhere model would make sense if all the devices required support contracts to keep them up to date. Consumers won't bite on that though. They will tend to go for the shiniest bobble for the price, support be damned. So perhaps low end and consumer models should stay analog while those willing to pay for the support contract can have the luxury of a software defined device. Realistically, that won't happen as the software genie is out of the bottle. The only why to bring security back to consumer devices is to require to hold the manufactures liable for defects and vulnerabilities. That will encourage manufactures to replace the cheap software defined devices back to analog/discrete components or expensive software defined devices that require support contracts after a initial "warranty" period. Having to write a monthly check to your thermostat is sure to ensure that it will keep working and also keep the company behind it from going out of business. I'll probably go back to the mercury switch--or write my own arduino sketch and keep the damn thing off
my lawnthe internet.cats~$ sudo chown -R us /home/base
(Score: 0) by Anonymous Coward on Monday May 22 2017, @04:55PM
why do you keep blaming F/OSS for your inability to buy from a responsible company or not to buy at all? You knew the situation before you bought, but you're a fucking sell out, so you bought anyways. now you're whining about it? you funded it, bitch! demand that companies foster dev+user community and make flashing their devices easy, etc. People always blame the people that are trying to help them while kissing up to their masters. you're transparent.
(Score: 2) by fadrian on Sunday May 21 2017, @04:47PM (3 children)
Ha ha ha. You don't have the wherewithal to "make" your computer secure. It's insecure from the ground up. We could have done better. We didn't. Now you live with your insecure system because no matter how much you patch, there are always going to be new holes. And even if you keep up today, there's always tomorrow.
That is all.
(Score: 0) by Anonymous Coward on Sunday May 21 2017, @06:11PM (2 children)
That's a pretty arrogant thing to say to somebody you know absolutely nothing about.
(Score: 0) by Anonymous Coward on Monday May 22 2017, @04:18AM
Actually not really, we've had plenty of stories come through here about computers being compromised on the hardware level. Maybe you can be more secure than some, but never fully secure as long as you have a connection to the net.
(Score: 2) by fadrian on Tuesday May 23 2017, @01:06PM
Get back to me when you've proven your BIOS to be error free. And you haven't even gotten to the OS level yet.
That is all.