Microsoft
Windows Intruded by CIA
Submitted by Rianne Schestowitz on Friday 19th of May 2017 02:20:40 PM Filed under

-
Athena
Today, May 19th 2017, WikiLeaks publishes documents from the "Athena" project of the CIA. "Athena" - like the related "Hera" system - provides remote beacon and loader capabilities on target computers running the Microsoft Windows operating system (from Windows XP to Windows 10). Once installed, the malware provides a beaconing capability (including configuration and task handling), the memory loading/unloading of malicious payloads for specific tasks and the delivery and retrieval of files to/from a specified directory on the target system. It allows the operator to configure settings during runtime (while the implant is on target) to customize it to an operation.
According to the documentation (see Athena Technology Overview), the malware was developed by the CIA in cooperation with Siege Technologies, a self-proclaimed cyber security company based in New Hampshire, US. On their website, Siege Technologies states that the company "... focuses on leveraging offensive cyberwar technologies and methodologies to develop predictive cyber security solutions for insurance, government and other targeted markets.". On November 15th, 2016 Nehemiah Security announced the acquisition of Siege Technologies.
-
WikiLeaks Reveals 'Athena' CIA Spying Program Targeting All Versions of Windows
WikiLeaks has published a new batch of the ongoing Vault 7 leak, detailing a spyware framework – which "provides remote beacon and loader capabilities on target computers" – allegedly being used by the CIA that works against every version of Microsoft's Windows operating systems, from Windows XP to Windows 10.
Dubbed Athena/Hera, the spyware has been designed to take full control over the infected Windows PCs remotely, allowing the agency to perform all sorts of things on the target machine, including deleting data or uploading malicious software, and stealing data and send them to CIA server.
-
Microsoft held back free patch that could have slowed WannaCry
- Login or register to post comments
Printer-friendly version
- Read more
- 1958 reads
PDF version
Why Europe’s dependency on Microsoft is a huge security risk
Submitted by Rianne Schestowitz on Thursday 18th of May 2017 12:04:01 PM Filed under
On May 12, hackers hit more than a hundred countries, exploiting a stolen N.S.A. tool that targeted vulnerabilities of Microsoft software. The attacks infected only machines running on Windows operative system. Among the victims are public administrative bodies such as NHS hospitals in the UK. Investigate Europe spent months to investigate the dire dependency of European countries on Microsoft – and the security risks this entails
- Login or register to post comments
Printer-friendly version
- Read more
- 1252 reads
PDF version
NHS mulling Ubuntu switch after Windows XP fail?
Submitted by Rianne Schestowitz on Thursday 18th of May 2017 08:48:44 AM Filed under



-
NHS mulling Ubuntu switch after Windows XP fail?
The NHS could be considering switching its software infrastructure from Windows to Ubuntu, after Windows XP vulnerabilities were exploited in the recent cyber attack that crippled the National Health Service. Or is it just an elaborate gag?
The NHSbuntu platform came to our attention via Dr Dean Jenkins, a Fellow of the Royal College of Physicians and editor-at-large of BMJ Case Reports, who writes about it on Differential Diagnosis, his blog.
-
Possible Protections To Take Against WannaCry Ransomware Attack
-
Ubuntu Login Screen Security Flaw Could Allow Anyone To Access Your Files [Ed: No, not true. But then again, Fossbytes is better at plagiarism than at grasping what it ‘writes’ about. Expect corporate media, funded by Bill Gates and Microsoft, to run "Linux not secure" stories amid WannaCry fiasco.)
- Login or register to post comments
Printer-friendly version
- Read more
- 1355 reads
PDF version
Security News, Notably Microsoft/NSA Catastrophe
Submitted by Roy Schestowitz on Sunday 14th of May 2017 09:55:20 AM Filed under

-
Major cyber attack hits companies, hospitals, schools worldwide
Private security firms identified the ransomware as a new variant of "WannaCry" that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft's Windows operating system.
-
Massive cyberattack hits several hospitals across England
-
Rejection Letter
We start with a shadowy US government agency, the NSA, systematically analyzing the software of the biggest American computer companies in search of vulnerabilities. So far, so plausible: this is one of the jobs of an intelligence and counter-espionage agency focussed on information technology. However, instead of helping Microsoft fix them, we are supposed to believe that the NSA hoard their knowledge of weaknesses in Microsoft Windows, a vitally important piece of their own nation's infrastructure, in case they'll come in handy againt some hypothetical future enemy. (I'm sorry, but this just won't wash; surely the good guys would prioritize protecting their own corporate infrastructure? But this is just the first of the many logical inconsistencies which riddle the back story and plot of "Zero Day".)
-
Microsoft issues ‘highly unusual’ Windows XP patch to prevent massive ransomware attack
-
Is it prudent to ask if Britain’s nuke subs, which also run Windows XP, have also been hit by ransomware?
Let’s reword this to drive the point home. How likely is it that the United States NSA, through its persistent interest in keeping us unsafe, has managed to hand control of Britain’s nuclear weapons platforms to unknown ransomware authors, perhaps in Russia or Uzbekistan?
-
Current wave of ransomware not written by ordinary criminals, but by the NSA
The lesson here is that the NSA’s mission, keeping a country safe, is in direct conflict with its methods of collecting a catalog of vulnerabilities in critical systems and constructing weapons to use against those systems, weapons that will always leak, instead of fixing the discovered weaknesses and vulnerabilities that make us unsafe.
-
Wana Decrypt0r Ransomware Outbreak Temporarily Stopped By "Accidental Hero"
A security researcher that goes online by the nickname of MalwareTech is the hero of the day, albeit an accidental one, after having saved countless of computers worldwide from a virulent form of ransomware called Wana Decrypt0r (also referenced as WCry, WannaCry, WannaCrypt, and WanaCrypt0r).
-
DDOS attacks in Q1 2017
In Q1 2017, the geography of DDoS attacks narrowed to 72 countries, with China accounting for 55.11% (21.9 p.p. less than the previous quarter). South Korea (22.41% vs. 7.04% in Q4 2016) and the US (11.37% vs. 7.30%) were second and third respectively.
The Top 10 most targeted countries accounted for 95.5% of all attacks. The UK (0.8%) appeared in the ranking, replacing Japan. Vietnam (0.8%, + 0.2 p.p.) moved up from seventh to sixth, while Canada (0.7%) dropped to eighth.
-
Applied Physical Attacks and Hardware Pentesting
This week, I had the opportunity to take Joe Fitzpatrick’s class “Applied Physical Attacks and Hardware Pentesting”. This was a preview of the course he’s offering at Black Hat this summer, and so it was in a bit of an unpolished state, but I actually enjoyed the fact that it was that way. I’ve taken a class with Joe before, back when he and Stephen Ridley of Xipiter taught “Software Exploitation via Hardware Exploitation”, and I’ve watched a number of his talks at various conferences, so I had high expectations of the course, and he didn’t disappoint.
-
SambaXP 2017: John Hixson’s Reflection
The next talk was given by Jeremy Allison on the recent symlink CVE. Jeremy explained how it was discovered and the measures that were taken to fix it.
- Login or register to post comments
Printer-friendly version
- Read more
- 1217 reads
PDF version
NHS Cautionary Tale About Windows
Submitted by Roy Schestowitz on Saturday 13th of May 2017 11:04:30 AM Filed under

-
Ransomware mess: high time for Microsoft to act [iophk: "close, it's high time to ditch Windows across the board"]
Lets' remember one thing: the ransomware and exploits are just the effects. The vulnerabilities in Windows are the cause.
-
NHS hospitals across the UK hit by large-scale ransomware attack
Malware said to be spreading via Windows SMB exploit first outed in February
-
Tories cut security support for outdated NHS computers a year ago despite warnings of vulnerability to hackers
The Government Digital Service, set up by David Cameron, decided not to extend a £5.5million one-year support deal with Microsoft for Windows XP.
- Login or register to post comments
Printer-friendly version
- Read more
- 1135 reads
PDF version
Windows Chaos
Submitted by Rianne Schestowitz on Saturday 13th of May 2017 05:46:03 AM Filed under

-
‘CIA malware plants Gremlins’ on Microsoft machines – WikiLeaks
WikiLeaks has released the latest instalment in the #Vault7 series, detailing two apparent CIA malware frameworks dubbed ‘AfterMidnight’ and ‘Assassin’ which it says target the Microsoft Windows platform.
-
WannaCry ransomware used in widespread attacks all over the world
Earlier today, our products detected and successfully blocked a large number of ransomware attacks around the world. In these attacks, data is encrypted with the extension “.WCRY” added to the filenames.
Our analysis indicates the attack, dubbed “WannaCry”, is initiated through an SMBv2 remote code execution in Microsoft Windows. This exploit (codenamed “EternalBlue”) has been made available on the internet through the Shadowbrokers dump on April 14th, 2017 and patched by Microsoft on March 14.
-
NHS left reeling by cyber-attack: ‘We are literally unable to do any x-rays’
Thousands of patients across England and Scotland have been in limbo after an international cyber-attack hit the NHS, with many having operations cancelled at the last minute.
Senior medics sought to reassure patients that they could be seen in the normal way in emergencies, but others were asked to stay away if possible.
According to one junior doctor who works in a London hospital, the attack left hospitals struggling to care for people. “However much they pretend patient safety is unaffected, it’s not true. At my hospital we are literally unable to do any x-rays, which are an essential component of emergency medicine,” the doctor told the Guardian.
-
"Worst-Ever Recorded" Ransomware Attack Strikes Over 57,000 Users Worldwide, Using NSA-Leaked Tools
Update 4: According to experts tracking and analyzing the worm and its spread, this could be one of the worst-ever recorded attacks of its kind. The security researcher who tweets and blogs as MalwareTech told The Intercept “I’ve never seen anything like this with ransomware," and "the last worm of this degree I can remember is Conficker.” Conficker was a notorious Windows worm first spotted in 2008; it went on to infect over nine million computers in nearly 200 countries.
- Login or register to post comments
Printer-friendly version
- Read more
- 2564 reads
PDF version
Microsoft Windows and Ransom
Submitted by Roy Schestowitz on Friday 12th of May 2017 07:30:46 PM Filed under

-
Massive ransomware attack hits UK hospitals, Spanish banks [Ed: Microsoft shows its real cost]
A large number of hospitals, GPs, and walk-in clinics across England have been locked down by a ransomware attack, reports suggest. There are also some reports of a ransomware attack hitting institutions in Portugal and Spain, with telecoms provider Telefonica apparently hit hard. Further attacks have been reported in Russia, Ukraine, and Taiwan. Batten down the hatches: we might be in the middle of a global ransomware attack.
Multiple sources point to this ransomware attack being based on the EternalBlue vulnerability, which was discovered by the NSA but was leaked by a group calling itself Shadow Brokers last month.
NHS Digital has confirmed the attack and issued a brief statement, stating that there's no evidence that patient data had been accessed and that the attack was not specifically targeted at the NHS. At this point it isn't clear whether a central NHS network has been knocked offline by the ransomware or whether individual computers connected to the network are being locked out. In any case, a number of hospitals and clinics are reporting that their computer systems are inaccessible, and some telephone services are down too.
-
New ransomware Jaff demands $3,700 payments
-
Updates on CyberSecurity, WordPress and what we're cooking in the lab today.
This is a Wordfence public service security announcement for all users of computers running any version of Windows.
We have confirmed that a serious virulent ransomware threat known as WannaCrypt0r/WannaCry has affected Windows computers on shared networks in at least 74 countries worldwide, with 57,000 reported individual cases being affected. And according to the analysis team at Kaspersky Lab, that number is growing fast.
- Login or register to post comments
Printer-friendly version
- Read more
- 2686 reads
PDF version
CIA Uses "AfterMidnight" and "Assassin" Against Windows
Submitted by Roy Schestowitz on Friday 12th of May 2017 05:40:28 PM Filed under
Today, May 12th 2017, WikiLeaks publishes "AfterMidnight" and "Assassin", two CIA malware frameworks for the Microsoft Windows platform.
"AfterMidnight" allows operators to dynamically load and execute malware payloads on a target machine. The main controller disguises as a self-persisting Windows Service DLL and provides secure execution of "Gremlins" via a HTTPS based Listening Post (LP) system called "Octopus". Once installed on a target machine AM will call back to a configured LP on a configurable schedule, checking to see if there is a new plan for it to execute. If there is, it downloads and stores all needed components before loading all new gremlins in memory. "Gremlins" are small AM payloads that are meant to run hidden on the target and either subvert the functionality of targeted software, survey the target (including data exfiltration) or provide internal services for other gremlins. The special payload "AlphaGremlin" even has a custom script language which allows operators to schedule custom tasks to be executed on the target machine.
"Assassin" is a similar kind of malware; it is an automated implant that provides a simple collection platform on remote computers running the Microsoft Windows operating system. Once the tool is installed on the target, the implant is run within a Windows service process. "Assassin" (just like "AfterMidnight") will then periodically beacon to its configured listening post(s) to request tasking and deliver results. Communication occurs over one or more transport protocols as configured before or during deployment. The "Assassin" C2 (Command and Control) and LP (Listening Post) subsystems are referred to collectively as" The Gibson" and allow operators to perform specific tasks on an infected target.
- Login or register to post comments
Printer-friendly version
- Read more
- 2251 reads
PDF version
Embrace and Extend: Microsoft Wants to Control the Competition
Submitted by Roy Schestowitz on Friday 12th of May 2017 10:24:21 AM Filed under


“They’ll get sort of addicted, and then we’ll somehow figure out how to collect sometime in the next decade.”
-
Microsoft emits code for DIY Linux IoT hubs. Repeat, Linux IoT hubs (that talk to Azure, duh)
-
Pigs are flying as Apple iTunes, Ubuntu Linux head to the Windows Store
-
Pigs are flying as Apple iTunes, Ubuntu Linux head to the Windows Store
-
Coming to Microsoft’s Windows Store: Apple iTunes, and Linux distributions
-
No joke: Linux is coming to Microsoft's app store
-
Microsoft brings Fedora, SUSE, and Ubuntu Linux to the Windows Store
-
Microsoft will offer 3 flavors of Linux in the Windows Store
-
Apple is bringing iTunes to the Windows Store
-
Ubuntu, SUSE Linux, and Fedora are all coming to the Windows Store [iophk: "offering only VMs not the OS itself"]
Ubuntu, SUSE Linux, and Fedora will all be available to install directly from the Windows Store, making it easy to run Linux apps on any Windows 10 device. The Linux installations will run in a virtualized environment side by side with Windows, [...]
- Login or register to post comments
Printer-friendly version
- Read more
- 3763 reads
PDF version
Microsoft Spin
Submitted by Roy Schestowitz on Thursday 11th of May 2017 11:35:16 AM Filed under
-
Microsoft cloud to SQL Server: let's have an open (source) relationship
Microsoft loves to tell us it loves Linux. [Ed: That’s a lie. Like the lie about SQL Server “on Linux” (it’s untrue)]
-
18 things you should know about using Linux tools in Windows 10 [Ed: Argh! Not Mary Branscombe again. A Microsoft mouthpiece; might as well disclose that.]
-
Well this is awkward. As Microsoft was bragging about Office at Build, Office 365 went down
Microsoft scrambled to get its Office 365 service back online after the cloud productivity suite was hit with a mid-day outage.
Loads of people reported that, at around 1245 PT, access to the service went out. Microsoft confirmed shortly after it was having problems, and said it was looking into the matter. Subscribers in New York, Denver, Texas, and Portland, in the US, were, for example, unable to access the service.
- Login or register to post comments
Printer-friendly version
- Read more
- 1038 reads
PDF version

More in Tux Machines
- Highlights
- Front Page
- Latest Headlines
- Archive
- Recent comments
- All-Time Popular Stories
- Hot Topics
- New Members
Recent comments
1 day 27 min ago
1 day 54 min ago
1 day 12 hours ago
1 day 13 hours ago
2 days 8 hours ago
2 days 9 hours ago
3 days 13 hours ago
4 days 17 hours ago
6 days 45 min ago
1 week 9 hours ago