“The self-spreading ‘WannaCry’ internet worm, which ripped through 160,000 computers and crippled hospitals and other businesses, is now being linked to a North Korean cyber gang,” reports Kevin Poulsen at Daily Beast.
Snip from his reporting:
Google security researcher Neel Mehta was first to cautiously connect the DPRK to the WannaCry attack. In a cryptic tweet Monday, Mehta referenced two seemingly different breeds of computer attack code. One was an early version of the WannaCry code that was found in the wild last February. The other was the “Contopee” backdoor program previously used in the Lazarus Group’s attacks on Asian financial institutions.
Mehta drew attention to a section of code that, upon inspection, turned out to be nearly identical in each program. Such commonalities are considered a key metric in determining that a common actor is behind two hacks, and other researchers quickly affirmed the importance of the find. “For now, more research is required into older versions of WannaCry,” wrote analysts at Kaspersky Lab. “We believe this might hold the key to solve some of the mysteries around this attack. One thing is for sure—Neel Mehta’s discovery is the most significant clue to date regarding the origins of WannaCry.”
Security giant Symantec says it has been thinking along similar lines. Over the weekend the company discovered that early versions of WannaCry—used before the NSA code was added—had a way of turning up on victim computers right after a confirmed Lazarus Group attack. “However, we have not yet been able to confirm the Lazarus tools deployed WannaCry on these systems,” wrote Vikram Thakur, technical director at Symantec, in a statement. “In addition, we found code in WannaCry… that historically was unique to Lazarus tools.”
Read the rest here, and for background, read Kevin's earlier piece on WannaCry.
1Password has taken Maciej Cegłowski’s demand for a “travel mode” for our technology to heart, introducing a new feature that locks you out of your own accounts when you’re in situations where you might lose control of your devices or be compelled to log into your accounts without your consent.
Whoever created the Wcry ransomware worm — which uses a leaked NSA cyberweapon to spread like wildfire — included a killswitch: newly infected systems check to see if a non-existent domain is active, and if it is, they fall dormant, ceasing their relentless propagation.
A UK weapons company called Drone Defence has sold an anti-drone product to Les Nicolles prison on Guernsey that will use 20 nonspecific “disruptors” to do something to drones that will stop them from overflying the prison and smuggling in contraband.
The Ticwatch 2 Active Smartwatch is a simpler take on an active wearable that raised over $2m dollars on Kickstarter and is currently offered in the Boing Boing Store.Somewhere in between the single-day battery life and platform-specificity of the Apple Watch and Android Wear devices, there exists the Ticwatch. Instead of trying to shoehorn another […]
Loot Crate is a subscription service that delivers a box of curated pop culture goods to your doorstep. To sample their geeky wares, you can order a single mystery box exclusively from the Boing Boing Store.Each month Loot Crate sends you 6-7 unique items and apparel, including collectibles, books, and t-shirts. Pulling inspiration from all […]
Yes, yes there is. The ultraportable Twisty Glass Mini boasts all of the simplicity of its forebear, while fitting just a little bit better in your pocket.The Mini is perfect for casual smokers, and anyone who doesn’t have the patience or fine motor skill for rolling papers. This piece keeps the convenient design of its older […]