WOW!!! Microsoft blames NSA for "wannacry" ransomware attacks.!!!

[ShootSpeeders]

Don't see this very often. A huge elitist company like mickeysoft attacking the US govt.!!!

Microsoft president blasts NSA for its role in 'WannaCry' computer ransom attack

may 14 2017 A Microsoft executive sharply criticized a U.S. spy agency Sunday for its role in weaponizing a weakness in Windows and allowing it to be stolen by hackers and used to launch history’s largest ransomware attack.

"This attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem," Brad Smith, president and chief legal officer at Microsoft, wrote in the wake of the “WannaCry” computer virus attack, which crippled computers worldwide.

The fast-moving virus, which first hit Friday, exploits a vulnerability in the Windows operating system that had been discovered by the U.S. National Security Agency. That information was stolen by hackers and published online.

 

[waltky]

No. Korea suspected in Wannacry cyber attack...

Did North Korea cook up the sinister ransomeware cyber plot that infected over 150 countries?
Wednesday 17th May, 2017 - In a bid to catch the extortionists behind the global cyberattack that affected more than 150 countries, investigators are now searching for digital clues.

Cybersecurity experts now reveal that circumstantial evidence indicates that North Korea may be behind the global “ransomware” attack - citing the modus operandi from previous similar cyberattacks attributed to North Korea According to Simon Choi, who advises the South Korean government and has been analyzing North Korean malware since 2008 - North Korea is no newcomer to the world of bitcoins. Choi, who is also a director at South Korean anti-virus software company Hauri Inc. has said that North Korea has been mining the digital currency using malicious computer programs since as early as 2013.

In the ransomware attack that has gripped the world since the weekend, hackers demand payment from victims in bitcoins to regain access to their encrypted computers. The malware struck hospitals, factories, government agencies, banks and other businesses - taking all the data hostage since Friday. However, as opposed to expert predictions - the second-wave outbreak largely failed to materialize after the weekend. Like Choi, a number of researchers around the world have suggested a possible link between the “ransomware” known as WannaCry and hackers linked to North Korea. According to researchers at Symantec and Kaspersky Lab - similarities between WannaCry and previous attacks blamed on North Korea have been found.

However, so far there has been no conclusive evidence of the links. Authorities meanwhile continue to investigate the ransomware and are focussed on the digital clues and following the money. Choi said, “We are talking about a possibility, not that this was done by North Korea.” Experts meanwhile have also said that the rapid spread of the worm globally suggests it did not rely on phishing, a method whereby an email is sent to people with the aim of having them click on infected documents or links. Analysts at the European Union cybersecurity agency have said that the hackers likely scanned the internet for systems that were vulnerable to infection and exploited those computers remotely.

They explained that the worm is likely to have spread through a channel that links computers running Microsoft Windows in a network. A similar method has been found in previously known North Korean cyberattacks, including the 2014 Sony hack that was blamed on North Korea. Choi said, “Since a July 2009 cyberattack by North Korea, they used the same method. It’s not unique in North Korea but it’s also not a very common method.” He has cited an accidental communication he had last year with a hacker traced to a North Korean internet address who admitted development of ransomware. According to Kaspersky Lab, portions of the WannaCry program use the same code as malware previously distributed by the Lazarus Group, a hacker collective that was said to be behind the 2014 Sony hack.

MORE

 

[EverCurious]

^ That's... weird. I've been out of the loop for a few days because of my kido's graduation and such, but I thought Shadow Brokers had claimed the attack was their doing? (Although I suppose I should say I thought it odd that Shadow Brokers would deploy this ransomware - they typically black hat hack and sell stolen software and hacking tools, sometimes infos, not really in their MO to deploy malware.)

Curious that Kaspersky (a free Russian anti-virus) speaks up, I heard a rumor they were being blamed for it as well (saying the anti-virus was actually an in for Russian spies - personally I don't buy that, Kapersky has been around for ages, very popular with gamers the world over for it's low processing overhead, not so much with businesses who need more comprehensive coverage. /If/ Russia were using it to spy, I doubt they'd throw it away for bitcoin.) Symantec is one of the best known (that's Norton Anti-virus) and more popular with businesses (I don't know for sure what folks are using these days as I've been retired a while, but back in the day /every/ business was running Norton.) That they come out with Kaspersky in blaming NK is very interesting to me and leans me toward believing it.

 

[waltky]

EverCurious wrote: Kaspersky (a free Russian anti-virus)

Got a link?

Thought it was fer pay.

 

[ShootSpeeders]

No. Korea suspected in Wannacry cyber attack...

That's BS. America has not been hit very hard by the ransomware and that's hard to believe if NK is behind it. OTOH, it's easy to believe if the US govt is behind this. THINK

 

[EverCurious]

EverCurious wrote: Kaspersky (a free Russian anti-virus)

Got a link?

Thought it was fer pay.

Was free last time I checked, but I've gotten super lazy about virus protection since I retired. I keep regular backups and know enough to tell when I'm getting infected heh

https://usa.kaspersky.com/downloads

 

[EverCurious]

No. Korea suspected in Wannacry cyber attack...

That's BS. America has not been hit very hard by the ransomware and that's hard to believe if NK is behind it. OTOH, it's easy to believe if the US govt is behind this. THINK

Yeah. Last I heard it was mostly the UK that got slapped.

Rumor I heard was that Shadow Brokers sold a bunch of NSA toys a few months ago. I had actually figured someone bought them from SB and had deployed their ransomware through NSA backdoors - but again, I've not been up to speed on the development with home life going on.

 

[waltky]

Another large-scale cyberattack underway...

Another large-scale cyberattack underway: experts
May 17, 2017 • Another large-scale, stealthy cyberattack is underway on a scale that could dwarf last week's assault on computers worldwide, a global cybersecurity firm told AFP on Wednesday.

The new attack targets the same vulnerabilities the WannaCry ransomware worm exploited but, rather than freeze files, uses the hundreds of thousands of computers believed to have been infected to mine virtual currency. Following the detection of the WannaCry attack on Friday, researchers at Proofpoint discovered a new attack linked to WannaCry called Adylkuzz, said Nicolas Godier, a researcher at the computer security firm. "It uses the hacking tools recently disclosed by the NSA and which have since been fixed by Microsoft in a more stealthy manner and for a different purpose," he said.

Instead of completely disabling an infected computer by encrypting data and seeking a ransom payment, Adylkuzz uses the machines it infects to "mine" in a background task a virtual currency, Monero, and transfer the money created to the authors of the virus. Virtual currencies such as Monero and Bitcoin use the computers of volunteers to record transactions. They are said to "mine" for the currency and are occasionally rewarded with a piece of it.

A global cybersecurity firm has warned that another large-scale, stealthy cyberattack is underway on a scale that could dwarf last week's assault on computers worldwide.​

Proofpoint said in a blog that symptoms of the attack include loss of access to shared Windows resources and degradation of PC and server performance, effects which some users may not notice immediately. "As it is silent and doesn't trouble the user, the Adylkuzz attack is much more profitable for the cyber criminals. It transforms the infected users into unwitting financial supporters of their attackers," said Godier. Proofpoint said it has detected infected machines that have transferred several thousand dollars worth of Monero to the creators of the virus.

The firm believes Adylkuzz has been on the loose since at least May 2, and perhaps even since April 24, but due to its stealthy nature was not immediately detected. "We don't know how big it is" but "it's much bigger than WannaCry", Proofpoint's vice president for email products, Robert Holmes, told AFP. A US official on Tuesday put the number of computers infected by WannaCry at over 300,000. "We have seen that before -- malwares mining cryptocurrency -- but not this scale," said Holmes. The WannaCry attack has sparked havoc in computer systems worldwide.

MORE

 

[EverCurious]

Ah yes "secret miners" they've been around for a long time, got a big boost when MS said they were no longer going to provide security updates to older versions of Windows.

What's more amusing is that the global cyber security firm just "discovered" it. More like the folks that do dark mining just got their hands on NSA back doors and can now deploy it with far more effect.

Move away from outdated Windows products and you should come out of both these attacks just fine. I'm more worried about the /other/ back doors NSA put into Macs, Linux, and Win10 than these fluffy malwares. I can imagine some pretty nasty shit happening if our government has a Win10 backdoor - like banks the world over, the stock market, government finances... Could be seriously bad for the US if the wrong peeps get ahold of something like that.

 

[toobfreak]

Don't see this very often. A huge elitist company like mickeysoft attacking the US govt.!!!

Microsoft president blasts NSA for its role in 'WannaCry' computer ransom attack

Actually, yes. Quite true. The technology for the virus originally came from something developed by the NSA. Just one of those funny little things we've lost control of with all of our loose handling of sensitive information by spies, hackers, leaks and antiquated computer systems. Maybe even some of it sold to foreign interests by ambitious former secretaries of state?

 

[waltky]

North Korea's cyber wars...

WannaCry cyberattack linked to N. Korea
Saturday 17th June, 2017 - There's mounting evidence that North Korea was behind last month's WannaCry ransomware attack that hit hundreds of thousands of computers around the world. U.K. security services believe that Lazarus, a group that has been linked to the government of North Korea, was responsible, U.K. intelligence sources said.

That appears to confirm the view of private cybersecurity experts who said last month it was "highly likely" that the attack was linked with the isolated state. The U.K.'s National Cyber Security Centre declined to comment. The Washington Post reported Thursday that the U.S. National Security Agency had produced a similar internal assessment last week. The NSA assessment was based on an analysis of tactics, techniques and targets, the newspaper reported. It said the evidence points with "moderate confidence" to North Korea's spy agency. Private cybersecurity firms have reached similar conclusions about the software that infected computers in around 150 countries and crippled parts of Britain's National Health Service.

Security researchers at Symantec said last month that the "tools and infrastructure used in the WannaCry ransomware attacks have strong links to Lazarus." "We have high probability that these two are absolutely connected," Vikram Thakur, the firm's security response technical director, said at the time. The ransomware, also called WannaCrypt, locks down files on an infected computer and asks its administrator to pay in order to regain control. The software was designed around a NSA hacking tool that was leaked online last year. The bug was able to spread quickly because many major companies and organizations rely on "legacy software," or old, outdated technology that no longer receives software updates.

Cyberattack WannaCry possibly linked to North Korea code​

Yet Symantec also said the attackers had made some rookie mistakes. "The WannaCry attacks do not bear the hallmarks of a nation-state campaign," Thakur said. North Korea's cyber targets have shifted in recent years. In 2013, when South Korea's banks and broadcasters were attacked, the government blamed its neighbor to the north. In 2014, the U.S. government blamed North Korea for the the hack on Sony Pictures. Clues in both cases pointed to Lazarus. By late 2015, the Lazarus hackers had shifted their attention to the global financial system, according to researchers. The group has since been linked to attacks on banks in 18 countries, including a major theft from Bangladesh's central bank.

WannaCry cyberattack linked to North Korea