Language Selection

English French German Italian Portuguese Spanish

Microsoft

Windows Intruded by CIA

Filed under
Microsoft
Security
  • Athena

    Today, May 19th 2017, WikiLeaks publishes documents from the "Athena" project of the CIA. "Athena" - like the related "Hera" system - provides remote beacon and loader capabilities on target computers running the Microsoft Windows operating system (from Windows XP to Windows 10). Once installed, the malware provides a beaconing capability (including configuration and task handling), the memory loading/unloading of malicious payloads for specific tasks and the delivery and retrieval of files to/from a specified directory on the target system. It allows the operator to configure settings during runtime (while the implant is on target) to customize it to an operation.

    According to the documentation (see Athena Technology Overview), the malware was developed by the CIA in cooperation with Siege Technologies, a self-proclaimed cyber security company based in New Hampshire, US. On their website, Siege Technologies states that the company "... focuses on leveraging offensive cyberwar technologies and methodologies to develop predictive cyber security solutions for insurance, government and other targeted markets.". On November 15th, 2016 Nehemiah Security announced the acquisition of Siege Technologies.

  • WikiLeaks Reveals 'Athena' CIA Spying Program Targeting All Versions of Windows

    WikiLeaks has published a new batch of the ongoing Vault 7 leak, detailing a spyware framework – which "provides remote beacon and loader capabilities on target computers" – allegedly being used by the CIA that works against every version of Microsoft's Windows operating systems, from Windows XP to Windows 10.

    Dubbed Athena/Hera, the spyware has been designed to take full control over the infected Windows PCs remotely, allowing the agency to perform all sorts of things on the target machine, including deleting data or uploading malicious software, and stealing data and send them to CIA server.

  • Microsoft held back free patch that could have slowed WannaCry

Why Europe’s dependency on Microsoft is a huge security risk

Filed under
Microsoft

On May 12, hackers hit more than a hundred countries, exploiting a stolen N.S.A. tool that targeted vulnerabilities of Microsoft software. The attacks infected only machines running on Windows operative system. Among the victims are public administrative bodies such as NHS hospitals in the UK. Investigate Europe spent months to investigate the dire dependency of European countries on Microsoft – and the security risks this entails

Read more

NHS mulling Ubuntu switch after Windows XP fail?

Filed under
GNU
Linux
Microsoft
Security

Security News, Notably Microsoft/NSA Catastrophe

Filed under
Microsoft
Security
  • Major cyber attack hits companies, hospitals, schools worldwide

    Private security firms identified the ransomware as a new variant of "WannaCry" that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft's Windows operating system.

  • Massive cyberattack hits several hospitals across England
  • Rejection Letter

    We start with a shadowy US government agency, the NSA, systematically analyzing the software of the biggest American computer companies in search of vulnerabilities. So far, so plausible: this is one of the jobs of an intelligence and counter-espionage agency focussed on information technology. However, instead of helping Microsoft fix them, we are supposed to believe that the NSA hoard their knowledge of weaknesses in Microsoft Windows, a vitally important piece of their own nation's infrastructure, in case they'll come in handy againt some hypothetical future enemy. (I'm sorry, but this just won't wash; surely the good guys would prioritize protecting their own corporate infrastructure? But this is just the first of the many logical inconsistencies which riddle the back story and plot of "Zero Day".)

  • Microsoft issues ‘highly unusual’ Windows XP patch to prevent massive ransomware attack
  • Is it prudent to ask if Britain’s nuke subs, which also run Windows XP, have also been hit by ransomware?

    Let’s reword this to drive the point home. How likely is it that the United States NSA, through its persistent interest in keeping us unsafe, has managed to hand control of Britain’s nuclear weapons platforms to unknown ransomware authors, perhaps in Russia or Uzbekistan?

  • Current wave of ransomware not written by ordinary criminals, but by the NSA

    The lesson here is that the NSA’s mission, keeping a country safe, is in direct conflict with its methods of collecting a catalog of vulnerabilities in critical systems and constructing weapons to use against those systems, weapons that will always leak, instead of fixing the discovered weaknesses and vulnerabilities that make us unsafe.

  • Wana Decrypt0r Ransomware Outbreak Temporarily Stopped By "Accidental Hero"

    A security researcher that goes online by the nickname of MalwareTech is the hero of the day, albeit an accidental one, after having saved countless of computers worldwide from a virulent form of ransomware called Wana Decrypt0r (also referenced as WCry, WannaCry, WannaCrypt, and WanaCrypt0r).

  • DDOS attacks in Q1 2017

    In Q1 2017, the geography of DDoS attacks narrowed to 72 countries, with China accounting for 55.11% (21.9 p.p. less than the previous quarter). South Korea (22.41% vs. 7.04% in Q4 2016) and the US (11.37% vs. 7.30%) were second and third respectively.

    The Top 10 most targeted countries accounted for 95.5% of all attacks. The UK (0.8%) appeared in the ranking, replacing Japan. Vietnam (0.8%, + 0.2 p.p.) moved up from seventh to sixth, while Canada (0.7%) dropped to eighth.

  • Applied Physical Attacks and Hardware Pentesting

    This week, I had the opportunity to take Joe Fitzpatrick’s class “Applied Physical Attacks and Hardware Pentesting”. This was a preview of the course he’s offering at Black Hat this summer, and so it was in a bit of an unpolished state, but I actually enjoyed the fact that it was that way. I’ve taken a class with Joe before, back when he and Stephen Ridley of Xipiter taught “Software Exploitation via Hardware Exploitation”, and I’ve watched a number of his talks at various conferences, so I had high expectations of the course, and he didn’t disappoint.

  • SambaXP 2017: John Hixson’s Reflection

    The next talk was given by Jeremy Allison on the recent symlink CVE. Jeremy explained how it was discovered and the measures that were taken to fix it.

NHS Cautionary Tale About Windows

Filed under
Microsoft
Security

Windows Chaos

Filed under
Microsoft
Security
  • ‘CIA malware plants Gremlins’ on Microsoft machines – WikiLeaks

    WikiLeaks has released the latest instalment in the #Vault7 series, detailing two apparent CIA malware frameworks dubbed ‘AfterMidnight’ and ‘Assassin’ which it says target the Microsoft Windows platform.

  • WannaCry ransomware used in widespread attacks all over the world

    Earlier today, our products detected and successfully blocked a large number of ransomware attacks around the world. In these attacks, data is encrypted with the extension “.WCRY” added to the filenames.

    Our analysis indicates the attack, dubbed “WannaCry”, is initiated through an SMBv2 remote code execution in Microsoft Windows. This exploit (codenamed “EternalBlue”) has been made available on the internet through the Shadowbrokers dump on April 14th, 2017 and patched by Microsoft on March 14.

  • NHS left reeling by cyber-attack: ‘We are literally unable to do any x-rays’

    Thousands of patients across England and Scotland have been in limbo after an international cyber-attack hit the NHS, with many having operations cancelled at the last minute.

    Senior medics sought to reassure patients that they could be seen in the normal way in emergencies, but others were asked to stay away if possible.

    According to one junior doctor who works in a London hospital, the attack left hospitals struggling to care for people. “However much they pretend patient safety is unaffected, it’s not true. At my hospital we are literally unable to do any x-rays, which are an essential component of emergency medicine,” the doctor told the Guardian.

  • "Worst-Ever Recorded" Ransomware Attack Strikes Over 57,000 Users Worldwide, Using NSA-Leaked Tools

    Update 4: According to experts tracking and analyzing the worm and its spread, this could be one of the worst-ever recorded attacks of its kind. The security researcher who tweets and blogs as MalwareTech told The Intercept “I’ve never seen anything like this with ransomware," and "the last worm of this degree I can remember is Conficker.” Conficker was a notorious Windows worm first spotted in 2008; it went on to infect over nine million computers in nearly 200 countries.

Microsoft Windows and Ransom

Filed under
Microsoft
Security
  • Massive ransomware attack hits UK hospitals, Spanish banks [Ed: Microsoft shows its real cost]

    A large number of hospitals, GPs, and walk-in clinics across England have been locked down by a ransomware attack, reports suggest. There are also some reports of a ransomware attack hitting institutions in Portugal and Spain, with telecoms provider Telefonica apparently hit hard. Further attacks have been reported in Russia, Ukraine, and Taiwan. Batten down the hatches: we might be in the middle of a global ransomware attack.

    Multiple sources point to this ransomware attack being based on the EternalBlue vulnerability, which was discovered by the NSA but was leaked by a group calling itself Shadow Brokers last month.

    NHS Digital has confirmed the attack and issued a brief statement, stating that there's no evidence that patient data had been accessed and that the attack was not specifically targeted at the NHS. At this point it isn't clear whether a central NHS network has been knocked offline by the ransomware or whether individual computers connected to the network are being locked out. In any case, a number of hospitals and clinics are reporting that their computer systems are inaccessible, and some telephone services are down too.

  • New ransomware Jaff demands $3,700 payments
  • Updates on CyberSecurity, WordPress and what we're cooking in the lab today.

    This is a Wordfence public service security announcement for all users of computers running any version of Windows.

    We have confirmed that a serious virulent ransomware threat known as WannaCrypt0r/WannaCry has affected Windows computers on shared networks in at least 74 countries worldwide, with 57,000 reported individual cases being affected. And according to the analysis team at Kaspersky Lab, that number is growing fast.

CIA Uses "AfterMidnight" and "Assassin" Against Windows

Filed under
Microsoft

Today, May 12th 2017, WikiLeaks publishes "AfterMidnight" and "Assassin", two CIA malware frameworks for the Microsoft Windows platform.

"AfterMidnight" allows operators to dynamically load and execute malware payloads on a target machine. The main controller disguises as a self-persisting Windows Service DLL and provides secure execution of "Gremlins" via a HTTPS based Listening Post (LP) system called "Octopus". Once installed on a target machine AM will call back to a configured LP on a configurable schedule, checking to see if there is a new plan for it to execute. If there is, it downloads and stores all needed components before loading all new gremlins in memory. "Gremlins" are small AM payloads that are meant to run hidden on the target and either subvert the functionality of targeted software, survey the target (including data exfiltration) or provide internal services for other gremlins. The special payload "AlphaGremlin" even has a custom script language which allows operators to schedule custom tasks to be executed on the target machine.

"Assassin" is a similar kind of malware; it is an automated implant that provides a simple collection platform on remote computers running the Microsoft Windows operating system. Once the tool is installed on the target, the implant is run within a Windows service process. "Assassin" (just like "AfterMidnight") will then periodically beacon to its configured listening post(s) to request tasking and deliver results. Communication occurs over one or more transport protocols as configured before or during deployment. The "Assassin" C2 (Command and Control) and LP (Listening Post) subsystems are referred to collectively as" The Gibson" and allow operators to perform specific tasks on an infected target.

Read more

Embrace and Extend: Microsoft Wants to Control the Competition

Filed under
GNU
Linux
Microsoft

“They’ll get sort of addicted, and then we’ll somehow figure out how to collect sometime in the next decade.”

--Bill Gates

Microsoft Spin

Filed under
Microsoft
Syndicate content

More in Tux Machines

today's howtos

Linux Foundation: Juniper/OpenContrail and Bell Canada at Open Network Automation Platform (ONAP)

  • Juniper Expands Contrail, Moves Open-Source Project to the Linux Foundation
    "Fortunately at Juniper we have a secrect weapon and one that i'm so very proud of and that's Contrail," Rami Rahim, Juniper Networks CEO said during his keynote. "The way we have been investing and innovating in Contrail over the last few years is sort of similar to how a car company would invest in a Formula 1 car, it's essentially a proving ground for the world's best technology." Rahim commented that the use-cases for Contrail so far have been somewhat limited, but that's about to change. "The future of Contrail is as a platform, a single controller that can solve a variety of really compelling use-cases with ease and simplicity," Rahim said. "Whether it's management of overlay and underlay, or SD-WAN connectivity, or multi-cloud fabric management." Juniper originally acquired Contrail in December 2012 in a deal valued at $176 million. In September 2013, Juniper open-sourcedthe Contrail technology, creating the OpenContrail project.
  • Juniper Networks' OpenContrail software defined network joins The Linux Foundation
    The Linux Foundation is far more than just Linux. It's also the home of many open-source networking projects such as the software-defined network (SDN) OpenDaylight, Open Platform for Network Function Virtualization (OPNFV), and Open Network Automation Program (ONAP). Now, networking power Juniper Networks has announced that OpenContrail, its open-source network virtualization cloud platform, will join the others as part of The Linux Foundation.
  • Juniper Moves OpenContrail to the Linux Foundation
    Juniper first released its Contrail products as open source in 2013 and built a community around the project. However, many stakeholders complained that Juniper didn’t work very hard to build the community, and some called it “faux-pen source.”
  • Juniper Moves SDN-Based OpenContrail Project to The Linux Foundation
    Juniper Networks today announced the codebase for OpenContrail, its open source network virtualization platform for the cloud, is moving to The Linux Foundation.
  • Bell Canada says open source ONAP adds modularity, flexibility to its network
    Bell Canada has become one of the first service providers to deploy Open Network Automation Platform (ONAP), focusing its initial attention on automating its data center tenant network provisioning process. By making this transition in its network, the service provider said it will provide its operations teams with a new tool to improve efficiency and time to market. This is the first step in using ONAP as a common platform across Bell’s networks on its journey towards a multipartner DevOps model.
  • Bell Canada First to Deploy Open Source ONAP in Production
    Canadian communications provider Bell is the first organization to deploy an open source version of the Open Network Automation Platform (ONAP) in a production environment. The milestone was noted in a blog post by Arpit Joshipura, general manager of networking and orchestration with the Linux Foundation.

Software: Everdo, GIMP, Notepadqq

  • Everdo – A Todo List and Getting Things Done App for Linux
    Everdo is a modern and beautifully-designed Electron-based task management application with which you can keep track of your work using tags, project folders, smart filters, and schedules. It doesn’t need a cloud account to work so your data will remain save on your PC. Everdo features a modern and minimalist User Interface with an extremely clean, clutter-less, and uniform design in order to enhance speedy and distraction-free productivity.
  • GIMP 2.9.8 Released with On-Canvas Gradient Editing, Better PSD Support
    GIMP 2.9.8 has been released with on-canvas gradient editing, better handling of Adobe Photoshop PSD files, and support for those using GIMP on Wayland.
  • GIMP 2.9.8 Released With On-Canvas Gradient Editing, Wayland Support
    GIMP 2.9.8 has been released as the newest development version of this widely-used, open-source Photoshop-like program in its road to GIMP 2.10. Earlier this week I happened to highlight many of the changes building up for GIMP 2.9.8 as featured in A Lot Of Improvements Are Building Up For GIMP 2.9.8, Including Better Wayland Support.
  • Getting started with the Notepadqq Linux text editor
    I don't do Windows. The operating system, I mean. At least, not on my own computers and not with any of my own work. When I was a consultant, I often had to work out of my clients' offices, which meant using their hardware, which also meant using Windows at many of those offices. Even when using Windows, I tried to install as much open source software as I could. Why? Because it works as well as (if not better than) its proprietary equivalents. One of the applications I always installed was Notepad++, which Opensource.com community moderator Ruth Holloway looked at in 2016.

Getting started with the Notepadqq Linux text editor

I don't do Windows. The operating system, I mean. At least, not on my own computers and not with any of my own work. When I was a consultant, I often had to work out of my clients' offices, which meant using their hardware, which also meant using Windows at many of those offices. Even when using Windows, I tried to install as much open source software as I could. Why? Because it works as well as (if not better than) its proprietary equivalents. One of the applications I always installed was Notepad++, which Opensource.com community moderator Ruth Holloway looked at in 2016. Read more