Privacy News Leaked NSA Malware Threatens Windows users around the world

[Deleted member 178]

The ShadowBrokers, an entity previously confirmed by The Intercept to have leaked authentic malware used by the NSA to attack computers around the world, today released another cache of what appears to be extremely potent (and previously unknown) software capable of breaking into systems running Windows. The software could give nearly anyone with sufficient technical knowledge the ability to wreak havoc on millions of Microsoft users.

Then :

A group calling themselves "ShadowBrokers" has been leaking files it claims to have found when it hacked into NSA computers. Many of the leaks are concerning, but the latest exploits for Windows have many folks wondering how it affects them and their computers. We're not going to get too technical or dive into any details on how the hacks work, but we can help you understand what you need to know to protect yourself.

We tested the leaked files on virtual machines running Windows XP, Windows 7, Windows Server 2012 R2 and Windows 8 Pro to see if they're vulnerable. We also tested a local installation of Windows 10 Pro 64-bit. This is a quick list of what we found:

• Windows 10 seems to be immune to the exploits leaked on April 14, 2017.

• There are exploits that work 100 percent against Windows 7 with the April Service Pack.

• There are exploits that work 100 percent against Windows Server 2012 R2 with the latest updates as of April 14, 2017.

• There are exploits that work 100 percent against Windows XP with the latest updates.

• Windows 8 Pro doesn't grant full remote access when using these tools, but it isn't immune and some slight variation of the code could make the OS vulnerable.

What Windows users need to know about the latest 'ShadowBrokers' exploits | Windows Central

 

[Rodney74]

Years ago I remember the Clinton's went after (Bill Gates / Microsoft) supposedly for the browser, but with the Clinton's, things seem about MONEY more than anything else...

Those years looked to have been aimed at breaking Bill Gates, and teaching him, he could not just ignore Washington DC.

I wonder what he had to give up, as in access to Windows and not just cash...

Now Big Government, has the ability to infect you.

 

[Ink]

• Windows 10 seems to be immune to the exploits leaked on April 14, 2017.

• There are exploits that work 100 percent against Windows 7 with the April Service Pack.

• There are exploits that work 100 percent against Windows Server 2012 R2 with the latest updates as of April 14, 2017.

• There are exploits that work 100 percent against Windows XP with the latest updates.

• Windows 8 Pro doesn't grant full remote access when using these tools, but it isn't immune and some slight variation of the code could make the OS vulnerable.

So... Windows XP and 7 is still better than 10?

A comedy show to see paranoid Windows users reading this news would be hilarious. @Lockdown can you imagine that?

@Umbra

TheShadowBrokers rather being getting drunk with McAfee on desert island with hot babes. Maybe if all suviving WWIII theshadowbrokers be seeing you next week. Who knows what we having next time?

Source: Follow Github Steem link

 

[Myriad]

As far as I can see , this is the only official response from M$ -

Protecting customers and evaluating risk

It doesn't exactly inspire confidence ( not in me anyway ).

I thought this article at ArsTechnica was a good read :-
NSA-leaking Shadow Brokers just dumped its most damaging release yet

 

[Ana_Filiz]

To me this looks like a weak propaganda to upgrade users to new Windows 10 as Microsoft simply cannot believe that the great majority of users doesn`t want the new OS.

 

[Arequire]

Now Big Government, has the ability to infect you

Keep in mind that these kind of exploits are used for targeted surveillance. The NSA isn't going to waste their time or resources using these exploits against soft targets like is us who aren't planning to massacre innocent people.

Obviously criminals having access to these kind of tools isn't a good thing but I highly doubt they'll be widely used and patches will eventually be released to fill the holes.
Doesn't concern me even a little bit frankly.

 

[Deleted member 178]

To me this looks like a weak propaganda to upgrade users to new Windows 10 as Microsoft simply cannot believe that the great majority of users doesn`t want the new OS.

I dont believe that.

1- 90% of Windows users are average people , they won't even be aware of those kind of article.
2- Those aware and have decent security skills are already on Win10 , because everybody knows that in term of security , everything that is not win8/10 is crap. Win10 CU own all previous versions.
3- If MS really want everybody to upgrade to win10 they will just stop updates and fixes for older versions.

 

[Deleted member 178]

Now Big Government, has the ability to infect you.

They always had.

 

[Myriad]

Keep in mind that these kind of exploits are used for targeted surveillance. The NSA isn't going to waste their time or resources using these exploits against soft targets like is us who aren't planning to massacre innocent people.

I agree on that part .

The TLAs of whatever nation have the tools that they have , for as long as they've had them , and we "little folk" will never see the full picture ,
only the drip-feed from leaks .

What really disturbs me about this situation is that those tools are now "out there" , not just the details of them .
And the timing of it ; at the start of a long weekend / public holiday in many parts of the world , it's a disaster for security pros all round.

But to script kiddies everywhere this is an unbelievable gift , while the digital world is effectively snoozing ....

 

[Wingman]

Anyone has also wants the hashes and can't be bothered downloading the samples from github -link below
Latest Shadow Brokers dump — owning SWIFT Alliance Access, Cisco and Windows

 

[ZeroDay]

To me this looks like a weak propaganda to upgrade users to new Windows 10 as Microsoft simply cannot believe that the great majority of users doesn`t want the new OS.

Exactly. This just looks like a push to get more people installing Windows 10.

A quote from the article pretty much backs that up:

If you have a PC that is affected, we urge you to upgrade it to Windows 10. That means you, too, gamers. I was reluctant to move from Windows 7 to Windows 10 on my gaming PC, but I recently took the plunge and had no problems. If you have an older PC running an earlier version of Windows, you might still be able to upgrade. Windows 10 works better on older hardware than some of the previous versions did. And if you're unsure of which "flavor" of Windows 10 is right for you, hit this link:

 

[ZeroDay]

I dont believe that.

1- 90% of Windows users are average people , they won't even be aware of those kind of article.
2- Those aware and have decent security skills are already on Windows 10 , because everybody knows that in term of security , everything that is not Windows 8/10 is crap. Windows 10 CU own all previous versions.
3- If MS really want everybody to upgrade to Windows 10 they will just stop updates and fixes for older versions.

MS are legally obliged to offer security updates for certain versions of Windows 7 such as Win 7 pro, and other versions of 8.1. if they just stop providing updates can you imagine the size of some of the corporations still using versions of Windows 7 pro or other versions still supported for updates. MS would get sued by so many companies it would make a big dent. Isn't win 7 pro supported until 2020?. So no, unless MS want to pay out millions and risk future business from huge corporations they can't just stop updates to windows versions that are still officially supported. I know they'd like to I agree on that but they can't.

They could do it but the backlash, compensation and loss of future business could be huge. Even Google replaced a huge number of Windows machines with Mac's so other companies wouldn't think twice if MS suddenly stopped providing updates to supported versions of Windows.

 

[Myriad]

They could do it but the backlash, compensation and loss of future business could be huge

I don't think they care , I truly don't .
It's small potatoes to them .

And I doubt that it's another furtive push to get everyone on W10 .... that's a bit of a stretch , even for me

There were class-action suits against M$ in Europe following the W10 roll-out .
People finding their systems borked , or an installed new OS that they had never consented to ,
or being penalized by their ISP for breaking their capped internet deals with a forced 6GB download etc etc.

I haven't heard of any compensation payouts yet ....

M$ certainly looked over the garden fence and they saw how lush and green the grass was for Facebook and Google ,
and the entire data mining industry , and they wanted in ....

.... and W10 was born

 

[ZeroDay]

I don't think they care , I truly don't .
It's small potatoes to them .

And I doubt that it's another furtive push to get everyone on W10 .... that's a bit of a stretch , even for me

There were class-action suits against M$ in Europe following the W10 roll-out .
People finding their systems borked , or an installed new OS that they had never consented to ,
or being penalized by their ISP for breaking their capped internet deals with a forced 6GB download etc etc.

I haven't heard of any compensation payouts yet ....

M$ certainly looked over the garden fence and they saw how lush and green the grass was for Facebook and Google ,
and the entire data mining industry , and they wanted in ....

.... and W10 was born

If they start messing with corporations with plenty of cash by not supporting win versions that are still supposed to be getting security updates it's a while different story than pushing win 10 on consumers. I find it very strange how the article insists on upgrading to Windows 10. I use and like Win 10. But my point to Umbra was that MS absolutely do have an obligation to support windows version that still gave support for security update. You're right they don't care, but that can change rather quickly.

There has been a few compensation payouts due to forced Windows 10 upgrades. If I remember correctly a few where for substantial amounts. Yes MS have money and monopoly, but it only takes a few big corporations getting fed up with them and joining forces then they're looking at major payouts. If I bought a new car that had full warranty for 3 years and the dealership decided they were no longer going to honour that agreement 12 months in I'd have them in court. I actually have just purchased a new car but I know the dealership will honor their warranty agreement. MS just do not care about their customers. Like I say I like and use Windows 10, but if MS have promised support for win 7 pro until 2020 and they go back on that the corporations using that OS won't take it sitting down.

 

[Azure]

I don't want to believe that some people actually think this is just a scam from Microsoft to make people upgrade to Windows 10. Are people's paranoia really that deep?

 

[Kubla]

Here is more:
The Latest Dump of Alleged NSA Tools Is ‘The Worst Thing Since Snowden’

"This is internet god mode for Microsoft computers."

This is bad news not just for the NSA, but for the internet as a whole, according to security researchers who are poring through the dump. As someone called it, this is "cyber chaos."

Perhaps the worst tool released by the hackers is called "FUZZBUNCH." This is a hacking suite or toolkit that contains several plug-and-play exploits to attack several versions of Windows operating system. Some researchers described it as something akin to Metasploit, a popular open source hacking framework.

"This FUZZBUNCH framework contains the closest thing to a cyber weapon since Stuxnet," Hacker Fantastic said. "It is packed full of exploits. It's Metasploit but with zero-days."

The way I see it is this is one of those the glass is half full half empty things; the bad new is that the whole world now has these industrial caliber hacks, the good news is everyone knows about them which will force companies like Microsoft to fix the security breaches they use and we get more secure products.

 

[Myriad]

@Kubla

Re: FUZZBUNCH

Yes indeed , people in the pen-testing world are very well acquainted with Metasploit ,
and to see a "weaponized" version out in the wild is alarming to say the least !

Also , in the ArsTechnica article there are some specific details on the group of tools with "eternal" in their name ,
and that ports 445 and 139 are vulnerable .

It might be worth starting a new thread on how we can protect against these ?
Simple port monitoring , setting some basic firewall rules etc

I'll start one if anyone else is interested ....

 

[Exterminator]

Here is an update article The NSA's Windows-hacking arsenal leaked, affects Windows 2000 through 8, servers included [Update]

Update: Microsoft has put up a blog post, stating that the majority of the vulnerabilities exposed by this leak have been patched. They are, as follows:


Codename Patch / Solution
EternalBlue MS17-010
EmeraldThread MS10-061
EternalChampion CVE-2017-0146 and CVE-2017-0147
ErraticGopher Addressed prior to the release of Vista
EskimoRoll MS14-068
EternalRomance MS17-010
EducatedScholar MS09-050
EternalSynergy MS17-010
EclipsedWing MS08-067

The firm goes on to state that the three remaining vulnerabilities, EnglishmanDentist, EsteemAudit, and ExplodingCan are not able to be reproduced on any of the operating systems it still supports. This means that "customers running Windows 7 and more recent versions of Windows or Exchange 2010 and newer versions of Exchange are not at risk". Naturally, the software giant encourages people to upgrade to the latest versions to keep safe.

What is interesting is that although most of these patches do show up in the acknowledgements section on TechNet, MS17-010 does not, as noticed by the grugq on Twitter. The researcher goes on to state that it may be due to the NSA themselves reporting the exploit to Microsoft.

 

[Myriad]

Here is an update article The NSA's Windows-hacking arsenal leaked, affects Windows 2000 through 8, servers included [Update]

Yeah , it's a good article !
And yet again I see a reference to "Hacker Fantastic"

I already have my eye on the stuff that is coming from her/him/it

The detail tells me that it is good quality info , and very well sourced ....

 

[Deleted member 178]

@ZeroDay

guess i was not so wrong

Windows 7 - Microsoft begins denying updates to some Windows 7 users