Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Windows Bug EU Security

Windows Flaw Allowed Hackers To Spy On NATO, Ukraine, Others 97

Posted by Soulskill from the hand-in-the-cookie-jar dept.
An anonymous reader writes: Reuters reports that a cybersecurity firm has found evidence that a bug in Microsoft's Windows operating system has allowed hackers located in Russia to spy on computers used by NATO, Ukraine, the European Union, and others for the past five years. Before disclosing the flaw, the firm alerted Microsoft, who plans to roll out a fix on Tuesday. "While technical indicators do not indicate whether the hackers have ties to the Russian government, Hulquist said he believed they were supported by a nation state because they were engaging in espionage, not cyber crime. For example, in December 2013, NATO was targeted with a malicious document on European diplomacy. Several regional governments in the Ukraine and an academic working on Russian issues in the United States were sent tainted emails that claimed to contain a list of pro-Russian extremist activities, according to iSight."
This discussion has been archived. No new comments can be posted.

Windows Flaw Allowed Hackers To Spy On NATO, Ukraine, Others More

Windows Flaw Allowed Hackers To Spy On NATO, Ukraine, Others

Comments Filter:

  • Hilarious (Score:5, Funny)

    by Anonymous Coward on Tuesday October 14, 2014 @05:34AM (#48138885)

    Russians using American software to spy on NATO. The irony is mind blowing.

  • Read here for a more detailed perspective (Score:4, Informative)

    by Anonymous Coward on Tuesday October 14, 2014 @05:59AM (#48138935)

    Read here for a more detailed perspective
    http://www.isightpartners.com/2014/10/cve-2014-4114/

  • Sensationalize much? (Score:5, Interesting)

    by palemantle ( 1007299 ) on Tuesday October 14, 2014 @06:17AM (#48138973)
    1 - ISight claims this has been a five year campaign and then add that "hackers began only in August to exploit a vulnerability found in most versions of Windows". So where did the "five year" timeline come from?

    2 - "Russian hackers target NATO, Ukraine and others" the article screams and then we find this wishy washy explanation from ISight's John Hullquist on his claim about the hackers being Russian:
    "Your targets almost certainly have to do with your interests. We see strong ties to Russian origins here".

    Sounds like a bunch of FUD to me

    • So where did the "five year" timeline come from?

      From TFA

      iSight is not the first to spot the attackers in the wild. Other security firms, including F-Secure in Finland, have uncovered victims over the years. But iSight was able to tie various attacks together to expose commonalities in the five-year campaign. It was encoded references to Dune—which appear in URLs for the attackers’ command-and-control servers—that helped tie some of the attacks together. The URLs include base64 strings that

    • Re:Sensationalize much? (Score:5, Interesting)

      by benjymouse ( 756774 ) on Tuesday October 14, 2014 @07:27AM (#48139171)

      1 - ISight claims this has been a five year campaign and then add that "hackers began only in August to exploit a vulnerability found in most versions of Windows". So where did the "five year" timeline come from?

      2 - "Russian hackers target NATO, Ukraine and others" the article screams and then we find this wishy washy explanation from ISight's John Hullquist on his claim about the hackers being Russian:

      Sounds like a bunch of FUD to me

      While I suspect that ISight (like all "security research" companies) deliberately stirs the pot (it helps generate awareness of their products), they do not actually claim that the specific vulnerability has been used for 5 years.

      One could imagine that the "Sandworm" operation has been ongoing for 5 years. If they continually and persistently try to infiltrate NATO and other organizations they will probably use whatever opportunity presents itself. They actually also try to exploit vulnerabilities that have long been patched, hoping to hit an unpatched machine.

      So while they do try to sensationalize, it is conceivable that the hacker group is older than just the most recently used vulnerability.

    • 1) "So where did the "five year" timeline come from?"

      Some Sandworm attacks also use five older vulnerabilities that have already been patched. The exploits are used to install various versions of BlackEnergy, a malicious tool used by cybercriminals. The tool gained notoriety in 2008 when botnets infected with the malware were used to launch denial-of-service attacks against systems in Georgia during a standoff between that country and Russia.

      2) "wishy washy explanation from ISight's John Hullquist on his claim about the hackers being Russian"

      Hulquist said he believed they were supported by a nation state because they were engaging in espionage, not cyber crime.

      crime can be anyone, espionage is reserved for a very select set of parties. it's a mere matter of deduction but feel free to believe what you wish, just stop posting it.

  • User clicks on a malicious PPT file, which installs a backdoor. Don't people check task manager for unscrupulous executables running on their systems?

    • Re: (Score:2)

      by Anonymous Coward

      well some malware has the ability to hide from task manager.
      couple this with the fact that the average user will have something like 100 processes running on boot up, they won't trim down unnecessary stuff.
      And has no idea what most of them are.

      I am of the opinion MS needs to make the above process simpler by trimming down the number of processes that run by default. Obviously keep separate things that do need to run in different security contexts, but there are way too many processes that run by default.

      • Re: (Score:1)

        by AqD ( 1885732 )

        They can be hidden by 1) obtaining the administrator privilege and thus modifying process list in kernel, or 2) removing a line from the process table/list of Task Manager UI of the current user. It's part of centralized GUI / automation feature on Windows - also theoretically doable on X-window but nearly impossible due to massive use of lightweight widgets which are painted on the main window like it's a canvas (might have to do OCR on bitmaps...)

        1) is even easier on Linux if malware is run on root permis

    • Re: (Score:2, Insightful)

      by Ol Olsoc ( 1175323 )

      User clicks on a malicious PPT file, which installs a backdoor. Don't people check task manager for unscrupulous executables running on their systems?

      I'm envisioning a CEO at the big yearly meeting checking for "unscrupulous executables" when he starts his PowerPoint presentation.

      This is the problem with you apologists. You have all of these excuses for Microsoft's flaws, and all of your "I can't believe that you didn't (insert really unlikely geek action performed by normal user here) , so it's all your fault."

      If almost everyone is too stupid to use Microsoft OS, despite normal or high intelligence, maybe it really isn't their problem.

  • I wonder how long the NSA (Score:5, Insightful)

    by wiredog ( 43288 ) on Tuesday October 14, 2014 @06:38AM (#48139029) Journal

    has had this one on the shelf, without disclosing it?

    • Re:I wonder how long the NSA (Score:5, Insightful)

      by TheRaven64 ( 641858 ) on Tuesday October 14, 2014 @06:47AM (#48139063) Journal
      That's the real question. And again, the NSA needs to answer the following question:

      Were they sufficiently technically incompetent that they didn't discover an attack that the Russians have been using, or were they sufficiently inept in a more general intelligence sense that they didn't realise that leaving US and allied machines vulnerable might be a problem?

      • Since Microsoft added the vulnerability at the request of the NSA, the NSA thought it was secret and only they new about it. /s

      • Re:I wonder how long the NSA (Score:4, Insightful)

        by skgrey ( 1412883 ) on Tuesday October 14, 2014 @08:43AM (#48139539)
        If they did have the exploit (and they probably did) the issue is visibility - they know they have this exploit, and probably a lot more, that can be used to easily get access to a system. How do you only patch "friendly" computers? Alerting Microsoft that this issue exists means that they will push out the patch to everyone, they simply aren't going to write patches for "friendly" computers. There allegiance is to the market, not to the country.

        That's probably the big problem the NSA has in general - they have all these great exploits, but others could have them as well. They are the method for being able to do some of the critical things they need to do to get access, especially abroad, but the second they disclose they potentially lose their ability to utilize them. It becomes a spy race at that point - get as much important data as you can while hoping the "bad guys" aren't doing the same or are slower at it.

        I wonder if the NSA ever feels a little guilty, knowing they have these exploits and could get them patched, and ultimately one of the could be used to do something very, very bad.

  • Governments (Score:3, Insightful)

    by ruir ( 2709173 ) on Tuesday October 14, 2014 @06:43AM (#48139049)
    Using foreign proprietary technology and using in particular Windows are retarded. What are they really expecting?
  • holy shit ! NATO uses Windows ??

  • Oral phase (Score:1)

    by Anonymous Coward

    Seems our computer (users) are in their oral phase: stick everything you find on the street in your mouth.

    "I want everything to happen automagically when I stuff a random $USB_DEVICE in my box"

    "I want everything to happen automagically when I open some $RANDOM_DOCUMENT I found on the intratubes"

    "I want any $RANDOM_APP linked from some $MORE_RANDOM_WEBSITE to be automagically installed in my browser (which I also use for banking, ferchrissake) and to take over my life from then on"

    Well, duh.

    Now, don't take m

    • If you see a huge flashing "It's a trap!" sign hanging over a big red button labeled "Push Me", and oyu push the button anyway, it's not really victim blaming to blame you for whatever happens next. Just sayin'. When you see the same people get owned the same way, over and over, and you explain to them how it happened, why what they did exposed them to the attack, and what they should do instead, and they come back to you a week later having done the same thing, with the same results, so you explain it agai

  • oh you naive people. (Score:1)

    by Anonymous Coward

    It its not a 'Flaw' its a feature.

  • ... a bug in Microsoft's Windows operating system has allowed hackers located in Russia to spy on computers used by NATO, Ukraine, the European Union, and others

    Did the bug somehow prevent NATO, Ukraine, EU and others from spying on Russia?

  • Security (Score:2, Insightful)

    by Anonymous Coward

    Put your computers in a locked room.

    Do not attach your computers to an external network.

    If you don't trust your employers, don't attach your computers to any network.

    Lock the door to the computer room and allow no one but trusted individuals entry.

    Lock the door.

    We knew this in 1975 when I worked at Burroughs. We knew this in 1973 when I was in charge of changing the paper tapes used for batch printing. Why don't we seem to know this today?

  • No mention of Kaspersky link to FSB (Score:3, Insightful)

    by Anonymous Coward on Tuesday October 14, 2014 @09:08AM (#48139745)

    Article fails to mention that Kaspersky anti-virus maker themselves has been linked to Russian state security services and computers using Kaspersky may contain back doors accessible to FSB.

  • What's the news about this? It's not like the US hasn't used the same leaks, or any other country...

  • Blimey, get with the times!

    22 years ago at school we were all using Object Packager in Windows 3.1 to smuggle in arbitary EXEs - long before any of this current hoo-ha erupted. Of course, we were more concerned with smuggling in games rather than using it for spying...

    The only surprising thing is that it's taken them over 22 years to realise that yes, allowing random EXEs to be packaged up isn't really a good idea!

  • An undocumented ability to spy on NATO countries? Sounds to me like a feature, not a bug.

    Correction: spy back on NATO countries. I'm living in one of the snoopiest.

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close