Udon Map wrote:

rjj04 wrote:If those other people could have written the code themselves they wouldn't have needed to steal it from the NSA in the first place.

Or, they decided that it was easier to steal it than write it themselves. Why reinvent the wheel?

Perhaps, but if the NSA was able to detect the intrusion and trace back to individuals.... drone strike in 3...2...1
Seems a bit dangerous, but I have zero expertise in this area, so who knows.

From what I read at the time..

A considerable time ago, the NSA discovered a flaw in the Microsoft software. That is not unusual, private security consultants discover these sort of flaws every month.
The official process is then for the private security consultants to privately inform Microsoft (or whichever of the Software Manufacturers it is) of the flaw & give them a 'reasonable amount of time' to create & issue a 'patch' to fix the flaw. If the company does nothing 'after a reasonable amount of time' then it is generally considered 'fair & reasonable' for the consultants to announce it to the world & so shame the company into fixing their software.

In the case of the flaw discovered by the NSA, they just kept quiet about it. They would have had little need to do that unless they had intentions to exploit it themselves.

Then the NSA were hacked earlier this year & the flaw discovered by the hackers. The 'official' line then was
'Yeah, well this is old stuff & doesn't effect anyone now'.
I think the events on Friday have pointed out the flaw in that..

It would seem that this is another case of where 'watching the watchers' has proved highly inadequate.

BobHelm wrote:From what I read at the time..

A considerable time ago, the NSA discovered a flaw in the Microsoft software. That is not unusual, private security consultants discover these sort of flaws every month.
The official process is then for the private security consultants to privately inform Microsoft (or whichever of the Software Manufacturers it is) of the flaw & give them a 'reasonable amount of time' to create & issue a 'patch' to fix the flaw. If the company does nothing 'after a reasonable amount of time' then it is generally considered 'fair & reasonable' for the consultants to announce it to the world & so shame the company into fixing their software.

In the case of the flaw discovered by the NSA, they just kept quiet about it. They would have had little need to do that unless they had intentions to exploit it themselves.

Then the NSA were hacked earlier this year & the flaw discovered by the hackers. The 'official' line then was
'Yeah, well this is old stuff & doesn't effect anyone now'.
I think the events on Friday have pointed out the flaw in that..

It would seem that this is another case of where 'watching the watchers' has proved highly inadequate.

Also a golden opportunity for MS to tout the advantages of using only legitimate and registered copies of Windows and keeping automatic updating options fully enabled. As I understand it, this only affected XP users. XP support was terminated a few years ago. Users of subsequent legitimate versions of Windows received a security update to protect against this and were not affected, right?

It was mainly XP users, who were certainly not protected, anyone still using Windows 8 would have been similarly vulnerable.
As long as users of newer versions of the Microsoft OS - 7 & 8.1 - had applied the March 14th. update then they would not have had issues..
Not sure about Windows 10, certainly no worse than Windows 7 & 8.1 users & I imagine that the new 10 Creator update that Microsoft just rolled out would not need patching.

Interestingly, Microsoft themselves are, publicly, less than pleased with the NSA than users

‘Like letting Tomahawk missiles get stolen’: Microsoft slams NSA mishandling of exploits

https://www.rt.com/usa/388374-microsoft ... wk-attack/

A couple of decades ago the NSA actually was a positive force. It did things like collaborate with Red Hat and other Linux developers to create Security Enhanced Linux (SELinux), which is a mainstay of Fedora security. They helped keep the "National Security". Since then, we see through the Snowden revelations and others, that they are doing quite the opposite and actually creating malware tools and harming overall security. That the NSA just "discover" holes in code, sit there in an "aw-shucks" manner, and just twiddle their toes... come on, please!! How many more whistle-blowers need risk their lives before people see the light? The "official process" Why don't they use a tiny bit of their massive budget and try to enhance the cyber security of the nation... as they used to do.

Perhaps it's possible they (NSA) want to keep the discovered holes to themselves.....to allow the US government to target these holes on an as needed basis (Iranian/North Korean nuclear programs, North Korean missile development, as examples).
In my younger days, concerned citizens stocked their cellars/basements in the event of nuclear war. Today, it'd probably be a good idea to consider how you would survive if you couldn't use an ATM, internet, telephone, bank, credit card, email, maybe even your vehicle because of a grand hack. It probably won't take the likes of a well-funded military or government to make such an attack. North Korea or Iran or Pakistan serve up a few nukes......we're probably safer here in Thailand than back in our home countries. But if somebody lays the golden hack on worldwide computer systems....we're probably as vulnerable here as any where else in the world.

"Former NSA Director: Malware Attack ‘Poses a Very Serious Threat to the Future of the Agency’"...

1) NSA not only finds holes in sw, but they create malware to use those holes.
2) They can not defend their own malware from hackers.

http://www.truthdig.com/eartotheground/ ... +Headlines


Thank goodness the US military are better at protecting their nukes than the NSA are at protecting their malware

Yep!
https://en.m.wikipedia.org/wiki/List_of ... _accidents

Wow, some close calls there Parrot. A few lost lives, yes. A couple of "lost" weapons at sea.... not thought to have been recovered by nuclear treasure hunting deep sea diving terrorists yet though [-o<

The first 'rule of law' concerning nukes should be........you can't have them until you can protect them from slipping out of your hands (or falling into the ocean!!). Likewise, cyber warfare techniques........you can't let some guy walk out of work with the equivalent of the nuclear codes (hacking techniques).
Micheal Hayden, former director of both the CIA and NSA, had a piece the past few days about protecting such information......but I can't find it.

"some guy walk out of work with"... is that what happened in this case?

Well, not too long after WannaCry comes Petya.
It looks like Petya is just a tool to destroy rather than the original aim of ransomware - to make money..
Security experts are saying that if you are hit with it then the chances of regaining you data, even if you pay the $300 worth of bit coin is zero, because of the way that the data is hijacked.
So, if you get a screen that looks like this when you sign into your computer then say goodbye to any personal data it contained.. For starters, the email address quoted to mail to has been blocked by posteo.net!!!

It is, however, difficult to have much sympathy with any company who is caught, updates & solutions to the flaws have been available, for free, for a long time.

Anti-Ransomware Tool, it's an MSI.

https://go.kaspersky.com/Anti-ransomware-tool.html