NSA's DoublePulsar Kernel Exploit a 'Bloodbath' (threatpost.com) 187
msm1267 quotes a report from Threatpost: A little more than two weeks after the latest ShadowBrokers leak of NSA hacking tools, experts are certain that the DoublePulsar post-exploitation Windows kernel attack will have similar staying power to the Conficker bug, and that pen-testers will be finding servers exposed to the flaws patched in MS17-010 for years to come. MS17-010 was released in March and it closes a number of holes in Windows SMB Server exploited by the NSA. Exploits such as EternalBlue, EternalChampion, EternalSynergy and EternalRomance that are part of the Fuzzbunch exploit platform all drop DoublePulsar onto compromised hosts. DoublePulsar is a sophisticated memory-based kernel payload that hooks onto x86 and 64-bit systems and allows an attacker to execute any raw shellcode payload they wish. "This is a full ring0 payload that gives you full control over the system and you can do what you want to it," said Sean Dillon, senior security analyst at RiskSense. Dillon was the first to reverse-engineer a DoublePulsar payload, and published his analysis last Friday. "This is going to be on networks for years to come. The last major vulnerability of this class was MS08-067, and it's still found in a lot of places," Dillon said. "I find it everywhere. This is the most critical Windows patch since that vulnerability." Dan Tentler, founder and CEO of Phobos Group, said internet-net wide scans he's running have found about 3.1 percent of vulnerable machines are already infected (between 62,000 and 65,000 so far), and that percentage is likely to go up as scans continue. "This is easily describable as a bloodbath," Tentler said.
It's not a kernel exploit (Score:3, Insightful)
For fuck sake, can we please stop calling these things 'exploits' as if Microsoft had nothing to do with it?
These are FEATURES, people...
I work for a medical billing software... (Score:4, Interesting)
company, and I think all of our Internet-facing Windows servers have been compromised. We do everything we can, but there's still processes that use tons of bandwidth with outgoing traffic that we can't stop.
Re: (Score:1)
Same here. Our Dell IDS records traffic with Canadian SINs, like SSNs bit they have a checksum, and we are leaking a lot of information from our Windows servers.
So good to hear from Another Satisfied Microsoft Customer. Be sure to buy them again, won't you?
Re: I work for a medical billing software... (Score:1, Interesting)
Same here. We record outgoing traffic, and our Windows servers keep getting rotted no make what we do. I even found my own social security number in the logs.
Re: I work for a medical billing software... (Score:2)
Re: I work for a medical billing software... (Score:1)
After firing their QA, they proved they don't care.
Re: (Score:1)
Re:I work for a medical billing software... (Score:5, Insightful)
Why do you have Windows hosts on the public-facing Internet??? WHY WOULD YOU DO THAT PROFOUNDLY STUPID THING?!???!?
Re: (Score:1)
Because Linux wouldn't boot and recognize the hardware properly?
Re: I work for a medical billing software... (Score:1, Informative)
Excuse me, but you could put a 35 dollar raspberry pi as an inline firewall and essentially block the outgoing incoming traffic.
Re: (Score:3)
Or you could save $35 and some labor costs by just unplugging the telephone company's data line. If you're willing to wait a while, don't pay the telco, and they'll unplug it for you.
BTW, I haven't tried it personally. But I suspect that if the mystery traffic is on port 443 (HTTPS) and is intermixed with legitimate traffic, the Raspberry Pi may have some trouble distinguishing real from bogus. And we're all supposed to use HTTPS because it's secure, right?
Re: (Score:2)
Just trying to point out that in many cases a simple firewall is going to block everything. (or maybe nothing). Either way it's more or less a waste of time and money. I would assume that anyone savvy enough to know they are sending out way more traffic than they should would have considered and rejected a firewall appliance within the first 10 minutes after deciding that they have a problem.
Re:I work for a medical billing software... (Score:5, Insightful)
One reason and one reason only: It is cheaper. Well, it is cheaper in the short run. That is all management focused on the year's end bonus if often caring about. I see it all the time. But even used internally, Windows "servers" are a constant problem, they never can compete to UNIX on maintenance cost, flexibility and reliability and performance. Sure, they are cheaper initially, but you pay for that for a long, long time. It becomes grossly obvious when you have global changes, and the windows servers are _always_ those lagging behind or needing special exceptions and the like. Windows on the server is a "90% OS": It only has 90% of what is really needed.
Re: (Score:2)
Indeed. And apparently, the ones that caused huge losses for society and cost a lot of people their jobs are somehow regarded as above punishment.
Re: (Score:2, Informative)
Why do you have Windows hosts on the public-facing Internet??? WHY WOULD YOU DO THAT PROFOUNDLY STUPID THING?!???!?
Because the meme that security is gained by not using Windows is just that, and sensible people realise that just because it isn't Windows doesn't mean you're secure?
Re: I work for a medical billing software... (Score:1)
Re: I work for a medical billing software... (Score:2)
Re: (Score:2)
What was said
What was said and what you think were said may as well have been in two different languages.
I mean both comments were effectively two full sentences and yet what you think was said and what was actually said has the words "you" and "windows" in common.
Re: I work for a medical billing software... (Score:1)
Re: (Score:2)
If you think it's the same thing it's time to fire whatever translator or language teacher you had. Idiot.
Re: I work for a medical billing software... (Score:1)
Re: (Score:1)
All the NSA needs to do is identify the employee who took the data.
Sounds awfully easy, doesn't it?
Re: (Score:2)
"You know that you are old ..."
Hell, man. I AM old. Heck, I can remember when they told me that I should switch to NT based Windows because it was much more secure than Windows 98.
Re: I work for a medical billing software... (Score:1)
Re: (Score:3)
Windows was a cheap, low-end desktop OS, that has grown up enough for some people to try to use as a server. Commercial Unix is an expens
Re: (Score:2)
Jut claim NSA did it and you've been forbidden to elaborate.
Unplug it? (Score:3)
there's still processes that use tons of bandwidth with outgoing traffic that we can't stop.
Unplug the computer?
In the wild (Score:2)
And you can expect to find it used in the wild in about a few seconds next...
(At least, luckily it got discovered though public channels : It got published by shadowbrocker and got analysed by experts.
So at least our sysadmin have heard about it.
Security solutions vendor will try to get ways to detect and neutralize it.
Imagine if instead it was discovered by a few blackhats who reverse engineered a sample, and decided to incorporate the technology into their exploits, without the information ever reaching t
If the NSA wasn't evil (Score:5, Interesting)
I guess it's a difference of philosophy. I want my computing to be as secure as possible. The NSA wants to hack anyone's system at anytime.
My philosophy is comment sense, the NSA's is pure evil considering it lessens my security.
Re: (Score:1)
I would point out that there's a pretty subtle difference between the programmers and engineers that come up with this stuff, and the PHBs that tell them what to do.
When you're using these tools to "fight evil", you're doing good work. When you've been fooled by someone into thinking that you're fighting evil when you're really doing nothing but ensuring slavery and starvation will continue in several third world countries for the next two generations, you're still doing good work, but the PHB that gave you
Re: If the NSA wasn't evil (Score:3)
Ah, a "just doing my job" apologist...
Re: (Score:1)
Indeed. Same thing the KZ guards and those sending people there (often regular police) claimed.
Evil on a large scale (and the NSA qualifies) cannot being done without large numbers of those willing helpers. They are the actual problem.
Re: (Score:2)
But he vas just following ohrdahs!
Re: If the NSA wasn't evil (Score:1)
Re: (Score:3)
Much of the code was developed outside the US. For example, AES was developed in Belgium (https://en.wikipedia.org/wiki/Advanced_Encryption_Standard).
Limiting hardware exports
Re: (Score:2)
Banning crypto software and hardware exports was tried before, and didn't work (https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States). It's far to easy to illegally export the code, or an algorithm, on a micro-sd card. It's easy to find loopholes in the law, by printing the code on a t-shirt or in book.
Much of the code was developed outside the US. For example, AES was developed in Belgium (https://en.wikipedia.org/wiki/Advanced_Encryption_Standard).
Limiting hardware exports is also long obsolete, China now has the top two (publicly announced) supercomputers in the world (https://www.top500.org/lists/2016/11/). We don't knows what secret computers any government has, but that's irrelevant for export laws.
Congress just needs to legislate harder.
Re: (Score:2, Troll)
I do not see that difference. Engineers and coders that decided to work for the NSA are leaving their morality at the door when they come to work. They knew what the NSA was doing or they know now and have decided to stay. They are just as guilty as the ones taking the decisions.
Re: If the NSA wasn't evil (Score:2)
...but ensuring slavery and starvation will continue in several third world countries for the next two generations...
That'll likely happen on its own anyhow; the real goal is to bring it about everywhere else.
Re: (Score:1)
Here's some irony for you: The S in NSA stands for security.
Re: (Score:3)
It's No Security Anymore isn't it?
Re: If the NSA wasn't evil (Score:2)
Re: (Score:1)
It not like they can't afford to pay for a couple thousand engineer-years of testing and code review.
Testing reveals the presence of bugs, never their absence.
Re: (Score:3)
They would immediately tell Intel, Microsoft, and Mr Torvalds exactly what flaws they are exploiting so they could be closed. Instead, being the evil assholes they are, they won't tell anyone. Cuz we all know the NSA is smarter than the Chinese, Russians, and random hacker groups who exploit the same holes.
I guess it's a difference of philosophy. I want my computing to be as secure as possible. The NSA wants to hack anyone's system at anytime.
My philosophy is comment sense, the NSA's is pure evil considering it lessens my security.
Wrong. The government is ordering to put the flaw in!! If Snowden is correct under the American Patriot Act they can arrest those who do not comply making their products with backdoors so the government doesn't have to get a court order.
To me that is pure evil. You think Apple and Android LOVE putting in hidden apps that secret turn your phones into recording devices that send the GPS and conversations wihtout you knowing while appearing off?
Re: (Score:2)
They would immediately tell Intel, Microsoft, and Mr Torvalds exactly what flaws they are exploiting
The NSA is an offensive organisation. Their purpose is not to allow you to provide yourself protection. There's nothing evil about it, just that your view of them is incompatible with what they are actually set out to do.
The CIA on the other hand, they would have a good case for reporting such issues.
Re: If the NSA wasn't evil (Score:1)
Re: (Score:2)
It's not about who is offensive. It's about their primary mission. CIA's mission is to improve the safety and security of America through intelligence. The NSA's mission is to provide intelligence to the military and command.
Of course you hear complaints about foreign agencies, but it's not foreign vs domestic which is the topic of discussion here, just: Disclose known issues that put Americans at risk, vs don't disclose. The CIA would have a mandate to disclose for the common good. The NSA would not.
Re: If the NSA wasn't evil (Score:1)
Blade style blood bath? (Score:2)
https://www.youtube.com/watch?... [youtube.com]
Re: (Score:1)
I'm pretty sure his hosts file program actually installs DOUBLEPULSAR.
Re: All part of the Hegellian Dialectic @ work (Score:1)
Re: (Score:2)
I think it's about time for the Butlerian Jihad ;-)
Seriously, every new technology just gives greed and hate more power. There seems to be nothing anyone can do about it, which baffles me. Why can't they catch ransomware assholes and throw them into jail for a long long time? They can do anything else but catch the bad guys. WTF - must be no MONEY in it. MONEY MONEY MONEY. That's the only arbiter of anything in our broken 'culture'.
Re: (Score:2)
International standards. Banking and payments, mil, police cooperation, educational grants and charity.
Get a free US computer system with working crypto for a nation that can link to the world.
If a nation wanted to network it would have to accept some US backed crypto, software, crypto and OS.
Cost could be kept very low or products offered as part of deals, charity
What do we use to scan for it? (Score:5, Interesting)
Re:What do we use to scan for it? (Score:5, Funny)
> What do we use to scan for this exploit being present on our servers and networks?
1- Go to each server, and run:
2- uname -r
If you get a result that displays a valid kernel, you are safe. If you are infected, it will say:
'uname' is not recognized as an internal or external command, operable program or batch file.
3- If you are infected, you can follow the cleaning steps here:
http://www.tecmint.com/fedora-... [tecmint.com]
Re: (Score:3, Funny)
I get 4.4.0-43-Microsoft on Windows 10 Creators Update :-p
Re: (Score:2)
I would mod this "Funny", but I have already commented. Sorry ;-)
Re: (Score:2)
Re: (Score:3)
Having mingw, msys, and cygwin installed, I actually get results for the uname command.
Re: (Score:2)
Be unexpected and random with different AV products.
Someone will have just the right kind of behaviour software update that might find something.
Try the new tools some security experts are now offering to help with todays issues.
TCP port 445 screening, Metasploit, Alert Logic (Score:4, Informative)
A first-pass screening test is to see if TCP port 445 is open. Most hosts will have 445 blocked by the firewall, thereby providing a degree of protection for the vulnerable SMB.
If 445 is open, that does not mean the host is compromised, but it is likely to vulnerable. This Metasploit module is one check that can be run:
https://github.com/rapid7/meta... [github.com]
More information can be found on the Alert Logic blog and our various teams will continue to post there and elsewhere as more information is made available.
https://www.alertlogic.com/res... [alertlogic.com]
I know Alert Logic has other resources posted elsewhere, but unfortunately I don't know the exact URLs off hand. My team sends technical details to another team, who aggregates it with information developed by other teams, then they forward it to the PR people who post it for you to read, with other, more detailed information provided to customers. So personally I only know where I send the information internally, but not where you can read all of it.
Re: (Score:2)
use the metasploit framework. Its already got code to test this exploit, and the many eyeballs on it probably make it the safest bet among hackers tools for not having anything in it that should not be there.
"gives you full control over the system" (Score:3, Funny)
We've been asking for this ever since Windows 10 was released. Someone should develop and release an adaptation for regular users who want to take control of their own computers back.
Re: "gives you full control over the system" (Score:1)
Kind of like how rooting Android is considered 'hacking'?
Comment removed (Score:5, Informative)
Re: (Score:2)
You would be amazed at how many pieces of mission critical software will only run on Win2008 or WinXT. Small shops can't always afford to drop $50K on new hardware, that has the new software that runs on Win10 or Win2012; not to mention another $50K for new clients and server.
Re: (Score:2)
Who the hell is still using operating system software that hasn't been patched since October 2008?
ATM's still run Windows XP, many Point of Sale systems too. If you've ever paid close attention in a doctor's office, the computer they are running is very likely XP, maybe Vista or 7. Hardware-controlling computers may even go back to Windows 98 due to their ability to read/write directly to hardware and do in-line controlling with ease.
It's just not feasible to keep medical equipment up-to-date with the latest OS for various reasons, not the least of which is it's bundled as a unit and costs many tens (hu
Use Linux servers? (Score:4, Insightful)
Re: (Score:1)
Seriously, why do people even use Window$ on servers? Any real advantage to it? It's not like the command line dark ages anymore with Linux to figure out how to do it. Tons of videos on how to set it up too. And if you want, you can set it up graphically and then run it without graphics to save resources.
Exchange, MSSQL, LDAP servers, .NET services, BI tools, SAP.
When people get out of their garage, they find people have actual business needs that aren't met by KOffice or vim.
Re: (Score:2)
oh you mean like the RHEL enterprise license my work has?
Re: (Score:3, Insightful)
Seriously, why do people even use Window$ on servers?
There are plenty of serious answers to this question but ultimately they're unlikely to be understood by someone with a mentality that extends to calling a product "Window$" and thinking they are clever.
Tons of videos on how to set it up too.
Ladies and gentlemen: How to setup an insecure facing internet server 101: Let's not have a clue and follow some video tutorial! Now I know where the $ came from, it's all the money that will be stolen from any server set up by those who follow your expert advice.
Re: (Score:3)
Ladies and gentlemen: How to setup an insecure facing internet server 101: Let's not have a clue and follow some video tutorial! Now I know where the $ came from, it's all the money that will be stolen from any server set up by those who follow your expert advice.
I think what you're describing is exactly how this came about in the first place. Even a modicum of firewalls and proxies would mitigate most of the attack vectors for this exploit, yet we see lots of infections. That sounds like lots of people set
Re: (Score:2)
Re: (Score:2)
The videos are just to get you started.
Except those videos are where it ends. We only just ran an article on security errors introduced through tutorials the other day.
no one else gets offended by my spelling but those nut jobs.
Oh I'm not offended, not in the slightest. I just happen to be over the age of 12 and draw instant conclusions into the maturity of people who find it funny to use misspellings in that way. Mind you it's quite fitting with your suggestion to start setting up something with a video tutorial.
Tip for you: If you every come across the need to use a video tutorial even as a starting po
Re: (Score:2)
Re: Use Linux servers? (Score:1)
Re: (Score:2)
Major AV apps working on this??? (Score:1)
Re: (Score:2)
If you have the April rollup installed then you have the March one installed. Microsoft doesn't let you pick and choose when it comes to the (cumulative) rollup updates.
Re: We watch outgoing bandwidth like a hawk... (Score:1)