Tag: nsa

‘WannaCry’ ransomware attack spreads worldwide (update)

England’s healthcare system came under a withering cyberattack Friday morning, with ” at least 25 ” hospitals across the country falling prey to ransomware that locked doctors and employees out of critical systems and networks. The UK government now reports that this is not a (relatively) isolated attack but rather a single front in a massive regionwide digital assault. #nhscyberattack pic.twitter.com/SovgQejl3X — gigi.h (@fendifille) May 12, 2017 The attack has impacted hospitals and transportation infrastructure across Europe, Russia and Asia. Organizations in dozens of countries have all been hit with the same ransomware program, a variant of the WannaCry virus, spouting the same ransom note and demanding $300 for the encryption key, with the demand escalating as time passes. The virus’s infection vector appears to through a known vulnerability, originally exploited and developed by the National Security Agency. That information was subsequently leaked by the hacking group known as Shadow Broker which has been dumping its cache of purloined NSA hacking tools onto the internet since last year. The virus appears to have originally spread via email as compressed file attachment so, like last week’s Google Docs issue, make sure you confirm that you email’s attachments are legit before clicking on them. Also, make sure your computers are using software that’s still receiving security updates, and that you’ve installed the latest updates available. Microsoft released a fix for the exploit used as a part of its March “Patch Tuesday” release, but unpatched Windows systems remain vulnerable. Update : Reuters reports a statement from Microsoft indicating that engineers have added detection and protection against the “Ransom:Win32.WannaCrypt” malware, so make sure your Windows Defender or other antivirus is updated before logging on to any corporate networks that may be infected. In a statement, a FedEx representative confirmed its systems are being impacted, saying “Like many other companies, FedEx is experiencing interference with some of our Windows-based systems caused by malware. We are implementing remediation steps as quickly as possible. We regret any inconvenience to our customers.” Source: New York Times

More here:
‘WannaCry’ ransomware attack spreads worldwide (update)

‘WannaCry’ ransomware attack spreads worldwide (update)

England’s healthcare system came under a withering cyberattack Friday morning, with ” at least 25 ” hospitals across the country falling prey to ransomware that locked doctors and employees out of critical systems and networks. The UK government now reports that this is not a (relatively) isolated attack but rather a single front in a massive regionwide digital assault. #nhscyberattack pic.twitter.com/SovgQejl3X — gigi.h (@fendifille) May 12, 2017 The attack has impacted hospitals and transportation infrastructure across Europe, Russia and Asia. Organizations in dozens of countries have all been hit with the same ransomware program, a variant of the WannaCry virus, spouting the same ransom note and demanding $300 for the encryption key, with the demand escalating as time passes. The virus’s infection vector appears to through a known vulnerability, originally exploited and developed by the National Security Agency. That information was subsequently leaked by the hacking group known as Shadow Broker which has been dumping its cache of purloined NSA hacking tools onto the internet since last year. The virus appears to have originally spread via email as compressed file attachment so, like last week’s Google Docs issue, make sure you confirm that you email’s attachments are legit before clicking on them. Also, make sure your computers are using software that’s still receiving security updates, and that you’ve installed the latest updates available. Microsoft released a fix for the exploit used as a part of its March “Patch Tuesday” release, but unpatched Windows systems remain vulnerable. Update : Reuters reports a statement from Microsoft indicating that engineers have added detection and protection against the “Ransom:Win32.WannaCrypt” malware, so make sure your Windows Defender or other antivirus is updated before logging on to any corporate networks that may be infected. In a statement, a FedEx representative confirmed its systems are being impacted, saying “Like many other companies, FedEx is experiencing interference with some of our Windows-based systems caused by malware. We are implementing remediation steps as quickly as possible. We regret any inconvenience to our customers.” Source: New York Times

See the article here:
‘WannaCry’ ransomware attack spreads worldwide (update)

‘WannaCry’ ransomware attack spreads worldwide (update)

England’s healthcare system came under a withering cyberattack Friday morning, with ” at least 25 ” hospitals across the country falling prey to ransomware that locked doctors and employees out of critical systems and networks. The UK government now reports that this is not a (relatively) isolated attack but rather a single front in a massive regionwide digital assault. #nhscyberattack pic.twitter.com/SovgQejl3X — gigi.h (@fendifille) May 12, 2017 The attack has impacted hospitals and transportation infrastructure across Europe, Russia and Asia. Organizations in dozens of countries have all been hit with the same ransomware program, a variant of the WannaCry virus, spouting the same ransom note and demanding $300 for the encryption key, with the demand escalating as time passes. The virus’s infection vector appears to through a known vulnerability, originally exploited and developed by the National Security Agency. That information was subsequently leaked by the hacking group known as Shadow Broker which has been dumping its cache of purloined NSA hacking tools onto the internet since last year. The virus appears to have originally spread via email as compressed file attachment so, like last week’s Google Docs issue, make sure you confirm that you email’s attachments are legit before clicking on them. Also, make sure your computers are using software that’s still receiving security updates, and that you’ve installed the latest updates available. Microsoft released a fix for the exploit used as a part of its March “Patch Tuesday” release, but unpatched Windows systems remain vulnerable. Update : Reuters reports a statement from Microsoft indicating that engineers have added detection and protection against the “Ransom:Win32.WannaCrypt” malware, so make sure your Windows Defender or other antivirus is updated before logging on to any corporate networks that may be infected. In a statement, a FedEx representative confirmed its systems are being impacted, saying “Like many other companies, FedEx is experiencing interference with some of our Windows-based systems caused by malware. We are implementing remediation steps as quickly as possible. We regret any inconvenience to our customers.” Source: New York Times

Read the article:
‘WannaCry’ ransomware attack spreads worldwide (update)

NSA will stop illegally collecting American emails

The National Security Agency has enjoyed relatively broad authority to monitor communications among suspected terrorists and their associates, even when those people happen to be American citizens and even without a warrant . However, The New York Times reports the NSA is stopping one of its most controversial practices: the collection of Americans’ international emails and text messages that mention a foreigner under surveillance. The NSA is attempting to adhere to a 2011 ruling by the Foreign Intelligence Surveillance Court. The court found this “about the target” collection program violated the Fourth Amendment because some internet companies packaged and processed emails in bundles — meaning if one message contained a foreign target’s email address, the entire group was swept up. The NSA was intercepting domestic communications, resulting in illegal searches. FISC allowed the surveillance to continue, but with a new safeguard in place: The NSA proposed a program where it would keep these bundled emails in a separate repository where analysts would not be able to see them. In 2016, the NSA reported the revamped program was not going as planned and analysts were, in fact, still searching the sequestered documents, The New York Times says. FISC delayed renewing the agency’s warrantless surveillance program until it promised to cancel the entire “about the target” collection process. The NSA has argued its bulk-collection methods help officials track potential threats, as contact with someone under surveillance is grounds for suspicion. Privacy advocates like the American Civil Liberties Union argue otherwise. “This development underscores the need for Congress to significantly reform Section 702 of FISA, which will continue to allow warrantless surveillance of Americans, ” ACLU legislative counsel Neema Singh Guliani says in response to today’s news. “While the NSA’s policy change will curb some of the most egregious abuses under the statute, it is at best a partial fix. Congress should take steps to ensure such practices are never resurrected and end policies that permit broad, warrantless surveillance under Section 702, which is up for reauthorization at the end of the year.” I’m going to go out on a limb & add a big reason: bulk access going darker 1—email providers moved to TLS/https 2—targets moved to E2E apps https://t.co/zz5WCxOHmZ — Thomas Rid (@RidT) April 28, 2017 Of course, technology continues to rapidly advance, and online communication has changed a lot since 2011. Today, more people are using end-to-end encryption and email providers are offering more secure ways to communicate, potentially making it harder for the NSA to round up these messages in the first place. In 2014, Google announced it would use HTTPS connections in Gmail specifically because the NSA was poking around in users’ business. Source: The New York Times

Read More:
NSA will stop illegally collecting American emails

NSA-Leaking Shadow Brokers Just Dumped Its Most Damaging Release Yet

An anonymous reader quotes a report from Ars Technica: The Shadow Brokers — the mysterious person or group that over the past eight months has leaked a gigabyte worth of the National Security Agency’s weaponized software exploits — just published its most significant release yet. Friday’s dump contains potent exploits and hacking tools that target most versions of Microsoft Windows and evidence of sophisticated hacks on the SWIFT banking system of several banks across the world. Friday’s release — which came as much of the computing world was planning a long weekend to observe the Easter holiday — contains close to 300 megabytes of materials the leakers said were stolen from the NSA. The contents (a convenient overview is here) included compiled binaries for exploits that targeted vulnerabilities in a long line of Windows operating systems, including Windows 8 and Windows 2012. It also included a framework dubbed Fuzzbunch, a tool that resembles the Metasploit hacking framework that loads the binaries into targeted networks. Independent security experts who reviewed the contents said it was without question the most damaging Shadow Brokers release to date. One of the Windows zero-days flagged by Hickey is dubbed Eternalblue. It exploits a remote code-execution bug in the latest version of Windows 2008 R2 using the server message block and NetBT protocols. Another hacking tool known as Eternalromance contains an easy-to-use interface and “slick” code. Hickey said it exploits Windows systems over TCP ports 445 and 139. The exact cause of the bug is still being identified. Friday’s release contains several tools with the word “eternal” in their name that exploit previously unknown flaws in Windows desktops and servers. Read more of this story at Slashdot.

Read this article:
NSA-Leaking Shadow Brokers Just Dumped Its Most Damaging Release Yet

Mark Zuckerberg’s Absurd ‘Social VR’ Demo Was Brutal

Facebook CEO Mark Zuckerberg showed off the company’s experiments with social virtual reality experiences that allow you to chat with your friends using avatars in headsets like Oculus’s Rift. It was really weird. The demo app allows you to chat with avatars of your friends, travel to places like Mars or Facebook’s Headquarters, and take virtual reality selfies to share to Facebook. Read more…

View article:
Mark Zuckerberg’s Absurd ‘Social VR’ Demo Was Brutal

Here’s how the NSA spied on Cisco firewalls for years

Edward Snowden leaks revealed that the NSA had the ability to spy on Cisco firewall traffic for years , but just how did the agency do it? We now have a clearer idea. An analysis of data from the Equation Group hack shows that the NSA used a specialized tool, BenignCertain, that uses an exploit in Cisco’s Internet Key Exchange implementation to extract encryption keys and read otherwise secure virtual private network data. Cisco has confirmed that the attack can compromise multiple versions of its old PIX firewalls, which were last supported in 2009. The issue doesn’t crop up in PIX 7.0 or in Cisco’s newer Adaptive Security Appliance, but that isn’t going to reassure many security experts. Ars Technica warns that there appear to be over 15, 000 networks still clinging on to PIX, and there’s a real possibility that many of them are vulnerable. Other platforms have comparable security holes , too, suggesting that the NSA might have snooped on many VPNs . To make matters worse, the Equation Group breach lets any would-be hacker use the exploit. While the past surveillance is alarming, you may need to worry more about everyday criminals going forward. Via: Ars Technica Source: Musalbas , Cisco

View original post here:
Here’s how the NSA spied on Cisco firewalls for years