Leaked NSA exploit blamed for global ransomware cyberattack
A zero-day vulnerability tool, covertly exploited by US intelligence agencies and exposed by the Shadow Brokers hacking group has been blamed for the massive spread of malware that infected tens of thousands of computer systems globally.
The ransomware virus which extorts Windows users by blocking their personal files and demanding payment to restore access, allegedly exploits a vulnerability that was discovered and concealed for future use by the National Security Agency (NSA), according to a range of security experts.
“Our analysis indicates the attack, dubbed “WannaCry”, is initiated through an SMBv2 remote code execution in Microsoft Windows. This exploit (codenamed “EternalBlue”) has been made available on the internet through the Shadowbrokers dump on April 14th, 2017,” Russian cybersecurity firm, Kaspersky Lab, wrote in a blog post about the attack.
Although Microsoft had already patched the backdoor roughly a month before it became public, many users who did not install the latest security updates seem to have become the primary victims of the attack.
NOTE: WikiLeaks has not released exploit code to the CIA's "zero day" hacking software. See https://t.co/h5wzfrReyy for details— WikiLeaks (@wikileaks) May 12, 2017
Meanwhile, NSA whistleblower Edward Snowden has led the discussion on NSA’s role and responsibility in Friday’s extensive cyberattacks, noting that if the NSA had “privately disclosed the flaw used to attack hospitals when they found it, not when they lost it, this may not have happened.”
If NSA builds a weapon to attack Windows XP—which Microsoft refuses to patches—and it falls into enemy hands, should NSA write a patch? https://t.co/TUTtmc2aU9— Edward Snowden (@Snowden) May 12, 2017
This is true. Patching lags releases because IT needs to be conservative and slow. This is the danger of leaving 0-days in the wild. https://t.co/TaEz1fxuTJ— David Auerbach (@AuerbachKeller) May 12, 2017
Lots to digest on latest hack, but 1 critical point for encryption debate: The "we can keep centralized secrets safe" arg has taken a hit.— Alex Abdo (@AlexanderAbdo) May 12, 2017
Curious... does it matter that this was NSA malware? Or is the bigger issue the missing patches, open ports, and legacy systems?— Steve Ragan (@SteveD3) May 12, 2017
Snowden noted that the NSA developed these “dangerous attack tools that could target Western software” despite warnings, and that it’s now up to congress to question the agency on its knowledge of any other software vulnerabilities.
Wikileaks also referred to its dealings with the whistleblower behind its Vault 7 CIA releases who warned of the extreme proliferation risk in the creation of cyber weapons.
The impact the cyberattack has had on hospitals has raised the greatest concerns. Some 39 hospital trusts as well as GP practices and dental services in the NHS system were targeted across England and Scotland.
British journalists should be asking if GCHQ knew of the vulnerability being used to attack NHS but kept it secret so they could use it.— WikiLeaks (@wikileaks) May 12, 2017
The worm has also reportedly hit universities, a major Spanish telecom, FedEx, and the Russian Interior Ministry.
Bruno Kramm, the chairman of the Berlin branch of the Pirate Party told RT that a lot of vulnerabilities lie in the backdoors built into operating systems.
“But the sad thing is the more we find out [about] the NSA having this software, the more we also know that this software is also of course traded. There is no software which you can keep inside of the system.
From the moment the NSA works with the software, you can also get the software, and once you get the software you can use it in your own way. So basically, it’s really a problem they have started.”
The American Civil Liberties Union reiterated Snowden’s calls for congress to intervene. It also expressed concerns that the NSA could have been aware that Microsoft was vulnerable but failed to disclose this until after the tools were stolen.
It would be deeply troubling if the NSA knew Microsoft was vulnerable in this way but waited to disclose. Congress can and should fix this. https://t.co/jdAr6kkB6N— ACLU National (@ACLU) May 12, 2017
“It is past time for Congress to enhance cybersecurity by passing a law that requires the government to disclose vulnerabilities to companies in a timely manner.
Patching security holes immediately, not stockpiling them, is the best way to make everyone’s digital life safer,” Patrick Toomey, a staff attorney with the American Civil Liberties Union’s National Security Project.