Monthly Archives: April 2017

PARIS Up-to-date Microsoft customers are safe from the purported National Security Agency spying tools dumped online, the software company said Saturday, tamping down fears that the digital arsenal was poised to wreak havoc across the internet.

In a blog post , Microsoft security manager Phillip Misner said that the software giant had already built defenses against nine of the 12 tools disclosed by TheShadowBrokers, a mysterious group that has repeatedly published NSA code . The three others affected old, unsupported products.

Most of the exploits are already patched, Misner said.

The post tamped down fears expressed by some researchers that the digital espionage toolkit made public by TheShadowBrokers took advantage of undisclosed vulnerabilities in Microsofts code. That would have been a potentially damaging development because such tools could swiftly be repurposed to strike across the companys massive customer base.

Those fears appear to have been prompted by experts using even slightly out-of-date versions of Windows in their labs. One of Microsofts fixes, also called a patch, was only released last month.

I missed the patch, said British security architect Kevin Beaumont, jokingly adding, Im thinking about going to live in the woods now.

Beaumont wasnt alone. Matthew Hickey, of cybersecurity firm Hacker House, also ran the code against earlier versions of Windows on Friday. But he noted that many organizations put patches off, meaning many servers will still be affected by these flaws.

Everyone involved recommended keeping up with software updates.

We encourage customers to ensure their computers are up-to-date, Misner said.

Follow this link:
Microsoft says users are protected from alleged NSA malware - The Mercury News

Common Dreams

Snowden Says Cyberweapons Dump Underscores NSA Hacking Tools Are Not Secure Common Dreams On Friday, the hacking group Shadow Brokers released a cache of cyberweapons developed by the National Security Agency (NSA) to access computers that run on Microsoft Windows, a release described by Vice New's Motherboard as "the hacking ... and more »

Link:
Snowden Says Cyberweapons Dump Underscores NSA Hacking Tools Are Not Secure - Common Dreams

Word that President Donald Trump as well as some of his family and associates may have appeared in National Security Agency (NSA) intercepts as masked (and in some cases later unmasked) identities has caused a great deal of sturm und drang in the United States. Many Americans are convinced that the mentions of Trump-linked personalities in signals intelligence reports indicates that the deep state or the Obama administration was surveilling them and that this is a dangerous politicization of the intelligence community. Eli Lake of Bloomberg View, for instance, wrote:

One U.S. official familiar with the reports said they contained valuable political information on the Trump transition such as whom the Trump team was meeting, the views of Trump associates on foreign policy matters and plans for the incoming administration.

Lakes source is doubtless correct that these reports contained valuable political information, even if his conclusion that there is a legitimate unmasking scandal afoot is off base. Because America is important, foreigners spend a lot of time talking amongst themselves about Americans. The NSA targets the communications of influential foreigners, so we should expect the names of Americans to appear on a routine basis. Moreover, American officials who are named in intercepts often have reason to be grateful for that fact.

Consider this recently declassified NSA intercept from January 1973, part of a substantial collection of once extremely sensitive intercepts the agency posted without fanfare on its website. Back in the day, NSA entitled this particular report, U.S. Ambassador to Rome Reportedly to Succeed [U.S. Ambassador Ellsworth] Bunker in Saigon; Kissinger Reportedly Apprehensive About Possible Negotiations Failure, Surprised by Nixons Defense of [South Vietnamese President Nguyen Van] Thieu. On its face, this title makes it look like NSA is collecting on the ins and outs of State Department personnel deliberations and on the activities of President Richard Nixon and his senior aides. Shady stuff, indeed.

Actually, not really. Reading the full report makes clear that nothing of the sort was going on. In fact, the NSA says the series of intercepts

provided National Security Advisor Henry Kissinger and other senior American negotiators with unique insights into how their South Vietnamese allies were reacting to developments at the Paris Peace Talks with North Vietnamese envoy Le Duc Tho.

This particular report gave the text of a message from South Vietnamese Ambassador Pham Dang Lam in Paris to Thieu in Saigon. Saigons ambassador reported that an unnamed source close to the White House told him that U.S. diplomat Graham Martin had agreed to become ambassador to South Vietnam and had sought and received assurances from Nixon that the Communists would not be allowed to take over South Vietnam. Lam also advised Thieu that Washington Post reporter Murrey Marder had told him that National Security Advisor Henry Kissinger seemed afraid that the Paris Peace Talks would fail and was at odds with President Nixon over certain unspecified points.

This was potentially valuable information to Nixon and Kissinger because it gave them insight into what the South Vietnamese government thought the White House was planning. This information could be used to keep a step ahead of the South Vietnamese. The intercept also hinted to Nixon and Kissinger that Murrey Marder could possibly be used to influence the South Vietnamese or pass a deniable message to them. Also, the information about Kissingers pessimism and the disagreement with Nixon was potentially invaluable. If Kissinger meant to convey those impressions, then the intercept told him that he had succeeded. If, on the other hand, he had accidentally shown some of his cards, he was now aware of it and could take steps to repair the damage.

Nixon and Kissinger realized the value of having the NSA report foreign views of what they were doing. That is why you will see the notation TOHAK on this intercept and others in this lengthy series. TOHAK means to Henry A. Kissinger.

This is why I would say to Trump: Calm down, ask to read the intercepts in which you, your family members, and associates are allegedly named. The intercepts can be valuable to you. They may tell you what foreign actors really think of you and the people around you. Surely a great negotiator like you can find a way to exploit that knowledge to produce a win for the United States.

Dr. Mark Stout directs graduate programs in Global Security Studies and Intelligence at Johns Hopkins Krieger School of Arts and Sciences Advanced Academic Programs in Washington, DC. He has previously worked for the Department of the Army, the State Department, the CIA, and the Institute for Defense Analyses.

See the article here:
Whispers from the Past: Political Figures Caught Up in NSA Intercepts - War on the Rocks

By Daniel Eran Dilger Friday, April 14, 2017, 04:19 pm PT (07:19 pm ET)

As noted in a report by Lorenzo Franceschi-Bicchierai for Motherboard, the NSA tools were leaked by hacker group known as the "Shadow Brokers."

The package of exploits includes "Fuzzbunch," and easy-to-use hacking tool with basic instructions that even non-technical users could follow to gain control of PCs running multiple versions of Microsoft's Windows prior to the latest Windows 10, specifically Windows XP, Vista, 7 and 8 as well as server versions including NT, 2000, 2003, 2008 and 2012.

The report cited a former employee of the U.S. Department of Defense as saying "it's not safe to run an internet facing Windows box right now," and that the payload of exploits is "the worst thing since Snowden."

Motherboard previously cited comments from security architect Kevin Beaumont, who noted that "all of the Windows implants are new to VirusTotal [an online file scanning tool], which suggests they've not been seen before."

According to web browser stats from NetMarketshare, only 25 percent of web users are using Microsoft's latest Windows 10 (which was released in the summer of 2015), while over 66 percent of active web users are using older versions of Windows that are vulnerable to the attacks launched by the released tools.

There are many Windows PCs that are connected to the Internet but do not generate web traffic--particularly back end servers and other utilitarian machines. A worm or virus could easily launch broad exploits at Windows users and find plenty of vulnerable machines to steal data from or recruit into global botnets of exploited PCs.

Microsoft has worked aggressively to upgrade users to Windows 10, but the vast majority of PCs worldwide remain stuck on older versions with known problems. The new cache of hacker tools makes it that much easier to exploit those users.

A spokesperson for Microsoft said that it is "reviewing the report and will take the necessary actions to protect our customers."

Apple's installed base of Macs and iPad users are not affected by exploits found in Windows (apart from Macs intentionally booted up into an old version of Windows by the owner). That's a feature Apple has long advertised for Macs, and has recently noted in its ads for iPad Pro.

In part, Apple's limited exposure to malware and exploits comes from its divergence from the monoculture of Windows (or Android) software, a sort of "security by obscurity," where the easiest to use hacking tools simply don't work because the platform isn't as easy to target as Windows PCs and Android devices are.

Apple's installed base of computer users has grown rapidly however. Horace Dediu of Asymco recently noted that there are about 100-150 million Macs in active use and an installed base of over 300 million iPads. That's about the same as the 400 million PCs in the installed base of Windows 10 that Microsoft cited at its Ignite conference last fall.

The difference is that there is at least another 400-600 million PCs that are running vulnerable versions of Windows. Apple also has an even larger installed base of iPhones, but most of those are updated.

So the larger reason why Macs and iOS devices are protected from the routine efforts to hack into Android and Windows is due to Apple's far faster ability to distribute new OS updates, which it does without cost. Apple's system update efforts have resulted in the majority of iOS users rapidly adopting the latest version and regular new patches between major updates.Macs and iOS devices are protected from the routine efforts to hack into Android and Windows due to Apple's far faster ability to distribute new OS updates

As of February 20th, Apple reports that 79 percent of iOS users are on the latest iOS 10, while another 16 percent are on iOS 9, both of which are at least as recent as Microsoft's Windows 10.

Apple does not appear to report macOS version adoption figures, but Go Squared reports that 44 percent of Macs are using the latest macOS Sierra while another 21 percent are on macOS El Capitan, both of which (65 percent total) are as new as Windows 10. The same site reports adoption of Windows 10 at 49 percent, with a nearly equal number still on Windows 7.

The same site reports that 89 percent of iOS users are on the newest iOS 10, as of April.

Google notes that as of April, only 4.9 percent of devices actively accessing Google Play are using the latest Android 7 Nougat, and only another 31 percent are on 2015's Android 5 Marshmallow, released alongside iOS 9. The majority of its active users are on versions of Android older than that, most of which will never be updated. Users in other regions, particularly China, are much less likely to use Google Play and even less likely to be updated to recent versions of the OS.

See the article here:
Apple's Mac, iPad dodge an ugly new NSA hacker bomb targeting ... - AppleInsider (press release) (blog)

For a payment of nearly $8 billion, T-Mobile yesterday potentially expanded its wireless service reach to customers across the U.S. and Puerto Rico. Its acquisition of low-band spectrum came as the Federal Communication Commission (FCC) wrapped up an historic $19.8 billion auction of airwaves voluntarily relinquished by U.S. television broadcasters.

Set in motion five years ago as part of the federal Middle Class Tax Relief and Job Creation Act, the FCC auction was aimed at reallocating spectrum to better serve today's wireless communications demands. Television broadcasters that gave up portions of their low-band spectrum for auction will receive just over $10 billion in proceeds while the U.S. government plans to use more than $7 billion of the remaining proceeds to reduce the federal deficit.

In addition to T-Mobile, other companies acquiring spectrum through the FCC auction include Dish, which paid a total of $6.2 billion, and Comcast, which paid $1.7 billion. Of the other big four wireless carriers, Sprint and Verizon did not participate, while AT&T spent just $910 million for reallocated spectrum.

'Spectrum Mother Lode'

In a video blog released after the conclusion of the auction, T-Mobile president and CEO John Legere said his company acquired "the spectrum mother lode," 45 percent of all the low-band spectrum on offer from the FCC. That acquisition quadruples T-Mobile's low-band holdings nationwide, he said.

"It's the equivalent of beachfront spectrum, the stuff that works better in buildings and travels further from the tower," Legere added.

In addition to providing better communication through walls and over long distances, more low-band spectrum in the 600 MHz range will enable wireless service providers to ease congestion and lay the groundwork for 5G connectivity, according to the FCC. A total of 50 bidders acquired 70 MHz of spectrum through the auction, with another 14 MHz available for unlicensed use and wireless microphones, the FCC said.

Many of the television broadcasters relinquishing spectrum are doing so in duopoly markets where they own two stations. NBC, for example, plans to keep the channels with better coverage in markets, such as New York, Chicago and Philadelphia, and share that coverage with other channels whose spectrum was auctioned off.

'A Long Time Coming'

Over the next 39 months, most of the 175 television stations that gave up bandwidth for the auction will begin the transition to new channel assignments, while 12 are expected to go off the air.

Wireless providers that acquired low-band spectrum in the auction will have as many as 12 years to begin using that bandwidth for services, although Legere said T-Mobile expects to begin "lighting up" its new airwave holdings later this year.

"This day has been a long time coming," FCC chairman Ajit Pai said in a statement after the auction results were announced. "While we celebrate reaching the official close of the auction, there is still much work ahead of us. It's now imperative that we move forward with equal zeal to ensure a successful post-auction transition, including a smooth and efficient repacking process."

Read the original post:
New Leak Suggests NSA Penetrated Mideast Banking Networks - NewsFactor Network

This morning, a new set of hacking tools was released by TheShadowBrokers group, revealing new techniques for hacking both Windows and certain financial networks.

Likely originating with the NSA, the tools give new clues as to the groups targets in recent years, which seem to include both international anti-money-laundering groups and oil companies in the Persian Gulf region. Some of the hacking tools were flagged by antivirus services as early as 2012, but experts believe the dump contains at least some undisclosed vulnerabilities for older versions of Windows. The leak also contains new attacks against the SWIFT banking network, used to transfer money internationally.

The files are mirrored on Github here, and researchers are already poring through the findings in a dedicated #shadowbrokers room on the Freenode IRC channel. A full list of the implants is available here.

TheShadowBrokers rather being getting drunk with McAfee on desert island with hot babes.

First emerging in August, the ShadowBrokers are believed to have stolen hacking tools from the NSA, with many analysts tracing the exploits to a compromised listening post used by the service to launch attacks remotely. Less is known about the ShadowBrokers themselves, although some have speculated the group may have ties to Russia.

Like previous drops, the data was accompanied by an enigmatic message in purposefully broken English. Is being too bad nobody deciding to be paying theshadowbrokers, one portion reads. TheShadowBrokers rather being getting drunk with McAfee on desert island with hot babes, an apparent reference to eccentric anti-virus mogul John McAfee.

The drop comes just days after an earlier drop of Unix-focused exploits on April 8th. Those files were accompanied by a short blog post taking President Trump to task for launching military strikes in Syria, among other recent actions. TheShadowBrokers voted for you, the post read. TheShadowBrokers supports you. TheShadowBrokers is losing faith in you.

Read the original:
New leak shows how a major hacking group cracked Windows and international banks - The Verge