Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Operating Systems Security Bug Government Privacy Software Windows

NSA's DoublePulsar Kernel Exploit a 'Bloodbath' (threatpost.com) 187

msm1267 quotes a report from Threatpost: A little more than two weeks after the latest ShadowBrokers leak of NSA hacking tools, experts are certain that the DoublePulsar post-exploitation Windows kernel attack will have similar staying power to the Conficker bug, and that pen-testers will be finding servers exposed to the flaws patched in MS17-010 for years to come. MS17-010 was released in March and it closes a number of holes in Windows SMB Server exploited by the NSA. Exploits such as EternalBlue, EternalChampion, EternalSynergy and EternalRomance that are part of the Fuzzbunch exploit platform all drop DoublePulsar onto compromised hosts. DoublePulsar is a sophisticated memory-based kernel payload that hooks onto x86 and 64-bit systems and allows an attacker to execute any raw shellcode payload they wish. "This is a full ring0 payload that gives you full control over the system and you can do what you want to it," said Sean Dillon, senior security analyst at RiskSense. Dillon was the first to reverse-engineer a DoublePulsar payload, and published his analysis last Friday. "This is going to be on networks for years to come. The last major vulnerability of this class was MS08-067, and it's still found in a lot of places," Dillon said. "I find it everywhere. This is the most critical Windows patch since that vulnerability." Dan Tentler, founder and CEO of Phobos Group, said internet-net wide scans he's running have found about 3.1 percent of vulnerable machines are already infected (between 62,000 and 65,000 so far), and that percentage is likely to go up as scans continue. "This is easily describable as a bloodbath," Tentler said.
This discussion has been archived. No new comments can be posted.

NSA's DoublePulsar Kernel Exploit a 'Bloodbath'

Comments Filter:
  • by Anonymous Coward on Monday April 24, 2017 @07:27PM (#54295175)

    For fuck sake, can we please stop calling these things 'exploits' as if Microsoft had nothing to do with it?

    These are FEATURES, people...

  • by Anonymous Coward on Monday April 24, 2017 @07:30PM (#54295183)

    company, and I think all of our Internet-facing Windows servers have been compromised. We do everything we can, but there's still processes that use tons of bandwidth with outgoing traffic that we can't stop.

    • by Anonymous Coward

      Same here. We record outgoing traffic, and our Windows servers keep getting rotted no make what we do. I even found my own social security number in the logs.

    • by ewhac ( 5844 ) on Monday April 24, 2017 @08:23PM (#54295415) Homepage Journal
      ...I guess I have to be Doctor Obvious here:

      Why do you have Windows hosts on the public-facing Internet??? WHY WOULD YOU DO THAT PROFOUNDLY STUPID THING?!???!?

      • by Anonymous Coward

        Because Linux wouldn't boot and recognize the hardware properly?

        • by Anonymous Coward

          Excuse me, but you could put a 35 dollar raspberry pi as an inline firewall and essentially block the outgoing incoming traffic.

          • Or you could save $35 and some labor costs by just unplugging the telephone company's data line. If you're willing to wait a while, don't pay the telco, and they'll unplug it for you.

            BTW, I haven't tried it personally. But I suspect that if the mystery traffic is on port 443 (HTTPS) and is intermixed with legitimate traffic, the Raspberry Pi may have some trouble distinguishing real from bogus. And we're all supposed to use HTTPS because it's secure, right?

      • by gweihir ( 88907 ) on Monday April 24, 2017 @09:30PM (#54295715)

        One reason and one reason only: It is cheaper. Well, it is cheaper in the short run. That is all management focused on the year's end bonus if often caring about. I see it all the time. But even used internally, Windows "servers" are a constant problem, they never can compete to UNIX on maintenance cost, flexibility and reliability and performance. Sure, they are cheaper initially, but you pay for that for a long, long time. It becomes grossly obvious when you have global changes, and the windows servers are _always_ those lagging behind or needing special exceptions and the like. Windows on the server is a "90% OS": It only has 90% of what is really needed.

      • Re: (Score:2, Informative)

        by thegarbz ( 1787294 )

        Why do you have Windows hosts on the public-facing Internet??? WHY WOULD YOU DO THAT PROFOUNDLY STUPID THING?!???!?

        Because the meme that security is gained by not using Windows is just that, and sensible people realise that just because it isn't Windows doesn't mean you're secure?

    • Jut claim NSA did it and you've been forbidden to elaborate.

    • there's still processes that use tons of bandwidth with outgoing traffic that we can't stop.

      Unplug the computer?

  • And you can expect to find it used in the wild in about a few seconds next...

    (At least, luckily it got discovered though public channels : It got published by shadowbrocker and got analysed by experts.
    So at least our sysadmin have heard about it.
    Security solutions vendor will try to get ways to detect and neutralize it.

    Imagine if instead it was discovered by a few blackhats who reverse engineered a sample, and decided to incorporate the technology into their exploits, without the information ever reaching t

  • by Snotnose ( 212196 ) on Monday April 24, 2017 @07:37PM (#54295201)
    They would immediately tell Intel, Microsoft, and Mr Torvalds exactly what flaws they are exploiting so they could be closed. Instead, being the evil assholes they are, they won't tell anyone. Cuz we all know the NSA is smarter than the Chinese, Russians, and random hacker groups who exploit the same holes.

    I guess it's a difference of philosophy. I want my computing to be as secure as possible. The NSA wants to hack anyone's system at anytime.

    My philosophy is comment sense, the NSA's is pure evil considering it lessens my security.
    • by Anonymous Coward

      I would point out that there's a pretty subtle difference between the programmers and engineers that come up with this stuff, and the PHBs that tell them what to do.

      When you're using these tools to "fight evil", you're doing good work. When you've been fooled by someone into thinking that you're fighting evil when you're really doing nothing but ensuring slavery and starvation will continue in several third world countries for the next two generations, you're still doing good work, but the PHB that gave you

      • Ah, a "just doing my job" apologist...

        • by gweihir ( 88907 )

          Indeed. Same thing the KZ guards and those sending people there (often regular police) claimed.

          Evil on a large scale (and the NSA qualifies) cannot being done without large numbers of those willing helpers. They are the actual problem.

        • But he vas just following ohrdahs!

      • Re: (Score:2, Troll)

        by gweihir ( 88907 )

        I do not see that difference. Engineers and coders that decided to work for the NSA are leaving their morality at the door when they come to work. They knew what the NSA was doing or they know now and have decided to stay. They are just as guilty as the ones taking the decisions.

      • ...but ensuring slavery and starvation will continue in several third world countries for the next two generations...

        That'll likely happen on its own anyhow; the real goal is to bring it about everywhere else.

    • by Anonymous Coward

      Here's some irony for you: The S in NSA stands for security.

    • They would immediately tell Intel, Microsoft, and Mr Torvalds exactly what flaws they are exploiting so they could be closed. Instead, being the evil assholes they are, they won't tell anyone. Cuz we all know the NSA is smarter than the Chinese, Russians, and random hacker groups who exploit the same holes.

      I guess it's a difference of philosophy. I want my computing to be as secure as possible. The NSA wants to hack anyone's system at anytime.

      My philosophy is comment sense, the NSA's is pure evil considering it lessens my security.

      Wrong. The government is ordering to put the flaw in!! If Snowden is correct under the American Patriot Act they can arrest those who do not comply making their products with backdoors so the government doesn't have to get a court order.

      To me that is pure evil. You think Apple and Android LOVE putting in hidden apps that secret turn your phones into recording devices that send the GPS and conversations wihtout you knowing while appearing off?

    • They would immediately tell Intel, Microsoft, and Mr Torvalds exactly what flaws they are exploiting

      The NSA is an offensive organisation. Their purpose is not to allow you to provide yourself protection. There's nothing evil about it, just that your view of them is incompatible with what they are actually set out to do.

      The CIA on the other hand, they would have a good case for reporting such issues.

      • Ugh, what? The CIA is clearly a more offensive organization than the NSA. You don't hear about foreign entities complaining about NSA in their politics, they complain about the CIA. Colombia, Egypt, Syria, etc. All of these NSA programs are about extraction without detection. They're not trying to brick your device or leave a sign of being there.
        • It's not about who is offensive. It's about their primary mission. CIA's mission is to improve the safety and security of America through intelligence. The NSA's mission is to provide intelligence to the military and command.

          Of course you hear complaints about foreign agencies, but it's not foreign vs domestic which is the topic of discussion here, just: Disclose known issues that put Americans at risk, vs don't disclose. The CIA would have a mandate to disclose for the common good. The NSA would not.

    • You're right, you don't have common sense, just comment sense. Saying NSA should report and close exploits they developed and need is a really, really stupid thing to say.
  • by brxndxn ( 461473 ) on Monday April 24, 2017 @08:09PM (#54295337)
    What do we use to scan for this exploit being present on our servers and networks? With the nature of the work I am in, I connect to a lot of different client networks with admin access.. I remember with Conficker, there was a Professor's website that basically listed all sorts of information about it and how to mitigate the problem. It resulted in a lot of consulting hours for me since I read all about it and was able to completely remove it whereas previous IT people just ran a scan and removed what it found only to have a later version of Conficker installed a day or two later. This seems like another one of those opportunities..
    • by Anonymous Coward on Monday April 24, 2017 @08:28PM (#54295437)

      > What do we use to scan for this exploit being present on our servers and networks?

      1- Go to each server, and run:
      2- uname -r

      If you get a result that displays a valid kernel, you are safe. If you are infected, it will say:

      'uname' is not recognized as an internal or external command, operable program or batch file.

      3- If you are infected, you can follow the cleaning steps here:
      http://www.tecmint.com/fedora-... [tecmint.com]

      • Re: (Score:3, Funny)

        by Anonymous Coward

        I get 4.4.0-43-Microsoft on Windows 10 Creators Update :-p

      • by gweihir ( 88907 )

        I would mod this "Funny", but I have already commented. Sorry ;-)

      • by brxndxn ( 461473 )
        You had me going.. my first thought was 'Okay.. this guy made a joke to say I gotta switch to linux or I'm infected.' But then I thought 'Oh wait.. Doesn't Windows 10 have a built-in bash now? I better research this.' Then.. Google.. they're in on it.. and it basically looks like 'uname' should be a built-in Windows 10 command from the results. So anyway.. 5 minutes I can't get back. You got me.
      • by Dwedit ( 232252 )

        Having mingw, msys, and cygwin installed, I actually get results for the uname command.

    • by AHuxley ( 892839 )
      Try a lot of different AV products from the US, EU, Russia, Japan long term depending on what can be used on a network.
      Be unexpected and random with different AV products.
      Someone will have just the right kind of behaviour software update that might find something.
      Try the new tools some security experts are now offering to help with todays issues.
    • by raymorris ( 2726007 ) on Monday April 24, 2017 @10:41PM (#54295955) Journal

      A first-pass screening test is to see if TCP port 445 is open. Most hosts will have 445 blocked by the firewall, thereby providing a degree of protection for the vulnerable SMB.

      If 445 is open, that does not mean the host is compromised, but it is likely to vulnerable. This Metasploit module is one check that can be run:

      https://github.com/rapid7/meta... [github.com]

      More information can be found on the Alert Logic blog and our various teams will continue to post there and elsewhere as more information is made available.
      https://www.alertlogic.com/res... [alertlogic.com]

      I know Alert Logic has other resources posted elsewhere, but unfortunately I don't know the exact URLs off hand. My team sends technical details to another team, who aggregates it with information developed by other teams, then they forward it to the PR people who post it for you to read, with other, more detailed information provided to customers. So personally I only know where I send the information internally, but not where you can read all of it.

    • by DarkOx ( 621550 )

      use the metasploit framework. Its already got code to test this exploit, and the many eyeballs on it probably make it the safest bet among hackers tools for not having anything in it that should not be there.

  • by Anonymous Coward on Monday April 24, 2017 @09:42PM (#54295759)

    We've been asking for this ever since Windows 10 was released. Someone should develop and release an adaptation for regular users who want to take control of their own computers back.

  • by aster_ken ( 516808 ) on Monday April 24, 2017 @10:42PM (#54295961)

    Who the hell is still using operating system software that hasn't been patched since October 2008? And even then, only one of the affected operating systems (Windows Server 2008) is still receiving security updates. If there are public-facing Windows 2000, Windows XP, and Windows Server 2003 machines still in the wild, I'd go so far as to say those companies deserve to be compromised.

    • You would be amazed at how many pieces of mission critical software will only run on Win2008 or WinXT. Small shops can't always afford to drop $50K on new hardware, that has the new software that runs on Win10 or Win2012; not to mention another $50K for new clients and server.

    • Who the hell is still using operating system software that hasn't been patched since October 2008?

      ATM's still run Windows XP, many Point of Sale systems too. If you've ever paid close attention in a doctor's office, the computer they are running is very likely XP, maybe Vista or 7. Hardware-controlling computers may even go back to Windows 98 due to their ability to read/write directly to hardware and do in-line controlling with ease.

      It's just not feasible to keep medical equipment up-to-date with the latest OS for various reasons, not the least of which is it's bundled as a unit and costs many tens (hu

  • Use Linux servers? (Score:4, Insightful)

    by TheOuterLinux ( 4778741 ) on Tuesday April 25, 2017 @03:57AM (#54296639)
    Seriously, why do people even use Window$ on servers? Any real advantage to it? It's not like the command line dark ages anymore with Linux to figure out how to do it. Tons of videos on how to set it up too. And if you want, you can set it up graphically and then run it without graphics to save resources.
    • by Anonymous Coward

      Seriously, why do people even use Window$ on servers? Any real advantage to it? It's not like the command line dark ages anymore with Linux to figure out how to do it. Tons of videos on how to set it up too. And if you want, you can set it up graphically and then run it without graphics to save resources.

      Exchange, MSSQL, LDAP servers, .NET services, BI tools, SAP.

      When people get out of their garage, they find people have actual business needs that aren't met by KOffice or vim.

    • Re: (Score:3, Insightful)

      by thegarbz ( 1787294 )

      Seriously, why do people even use Window$ on servers?

      There are plenty of serious answers to this question but ultimately they're unlikely to be understood by someone with a mentality that extends to calling a product "Window$" and thinking they are clever.

      Tons of videos on how to set it up too.

      Ladies and gentlemen: How to setup an insecure facing internet server 101: Let's not have a clue and follow some video tutorial! Now I know where the $ came from, it's all the money that will be stolen from any server set up by those who follow your expert advice.

      • Ladies and gentlemen: How to setup an insecure facing internet server 101: Let's not have a clue and follow some video tutorial! Now I know where the $ came from, it's all the money that will be stolen from any server set up by those who follow your expert advice.

        I think what you're describing is exactly how this came about in the first place. Even a modicum of firewalls and proxies would mitigate most of the attack vectors for this exploit, yet we see lots of infections. That sounds like lots of people set

      • The videos are just to get you started. IT people hate it when you use anything other than Window$, yeah I'll do it again, because they would be out of a job without it. Linux forces users to be more proactive. If you blindly follow a video without knowing a little bit as to how servers or Linux works, of course that could cause problems. But, you can be an expert with Window$ and still have more security issues than you will ever come across with a proper Linux setup; that's the beauty of TRUE open source
        • The videos are just to get you started.

          Except those videos are where it ends. We only just ran an article on security errors introduced through tutorials the other day.

          no one else gets offended by my spelling but those nut jobs.

          Oh I'm not offended, not in the slightest. I just happen to be over the age of 12 and draw instant conclusions into the maturity of people who find it funny to use misspellings in that way. Mind you it's quite fitting with your suggestion to start setting up something with a video tutorial.

          Tip for you: If you every come across the need to use a video tutorial even as a starting po

          • But aren't we all students at first? I would rather be proactive than let someone else handle my system. By the way, I got a family member that was 12 when he started his first website and that was about ten years ago, and guess what? YouTube got him started. Now, he does IT work for doctors, manages a radio station, and is helping to construct a small hydroelectric dam; no college and only a single doctor above him (his boss) and no underlings to help manage the servers. So, I don't know what videos you be
    • Do you somehow think Linux isn't hacked daily? Have you looked at a yum/apt update for all their security updates? I've never been personally affected by a windows infection, but years ago we ran software that used JBOSS on Centos. Hackers used Google search alerts to find JBOSS servers and notify the hacker of vulnerable systems. That was brilliant. Low effort and detection.
      • I'm not saying Linux is bullet proof but comparatively, I do believe it to be one of the safest options you can have because of how far you can go in customization. The problem with JAVA is that it's JAVA. That was in ~2006 though, and JAVA 8 isn't nearly as vulnerable as 6 was. Hackers were using JMX console and people weren't paying attention to file permissions. You could also use intitle:”JBoss Management Console – Server Information” “application server” inurl:”web-c
  • Can anyone address as to whether any of the major AV apps (Norton, Kaspersky, Bitware, McAfee, ...) are working on finding/remediating this crap?

"Kill the Wabbit, Kill the Wabbit, Kill the Wabbit!" -- Looney Tunes, "What's Opera Doc?" (1957, Chuck Jones)

Working...