McAfee Labs' security research blog publishes malware and vulnerability analyses, covering ransomware, zero-days, firmware scanning and nation-state malware.
HN links it for technical write-ups on incidents like WannaCry, a Chrome zero-day, and CHIPSEC, and as a source for ransomware background.
Occam’s razor. I’m a very conspiratorial person and I’ve seen nothing to suggest any nefarious activity or collusion so I’m not getting carried away on this.
https://securingtomorrow.mcafee.com/executive-perspectives/agile-secure-intels-approach-designing-world-class-security/
This is a statement by the Intel CTO from 2016 on the ME discussions, and briefly reassured us that Intel is conscious of the security of the ME, and that they have teams dedicated to it and can push firmware updates out to cover vulnerabilities.
https://www.intel.com/content/www/us/en/architecture-and-technology/intel-amt-vulnerability-announcement.html
Intel made an official announcement in May that they have discovered an escalation of privilege vulnerability and are addressing it accordingly as you would expect. It also notes that consumer hardware and firmware is not affected by the vulnerability, demonstrating that Intel actually does release two different chips, and prioritizes privacy and security more over features on the consumer models.
https://newsroom.intel.com/news/important-security-information-intel-manageability-firmware/
Intel releases a software tool for checking if your system is one of the vulnerable units or not, they have a fix already for the firmware and confirm it is not due to physical design flaws, and are working with manufacturers to push the updates ASAP.
Overall, I don’t feel like Intel is at all intentionally sabatoging it’s customers, and genuinely considers…
This is a better link (it is Intel's original blog post):
https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/
It includes a few more details about what was released:
It extracts EFI firmware from flash ROM memory
automatically if the firmware file is not
specified.
We recommend generating an EFI whitelist after
purchasing a system or when you are sure it has
not been infected:
# chipsec_main -m tools.uefi.whitelist -a generate
Then check the EFI firmware on your system
periodically or whenever you are concerned, such
as when a laptop was left unattended:
...
An analysis of the approach they are taking would lead to some pretty easy improvements.
Allegedly it's the CLOP ransomware.
"All dhcp-servers, Exchange-servers, domaincontrollers and networkdrives have been encrypted."
Source in Dutch: https://tweakers.net/nieuws/161538/deel-diensten-universiteit-maastricht-offline-door-cyberaanval.html
Clop: https://securingtomorrow.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/
Interestingly it does not seem to be a new concept:
https://www.reddit.com/r/netsec/comments/37ko5v/introducing_raas_ransomware_as_a_service/
https://securingtomorrow.mcafee.com/mcafee-labs/meet-tox-ransomware-for-the-rest-of-us
They used to take 20% 'commission'.
Are we forgetting that Chrome had a zero-day literally three months ago?
https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analysis-of-a-chrome-zero-day-cve-2019-5786/
> Google is aware of reports that an exploit for CVE-2019-5786 exists in the wild.
Reputable brands that passed FIPS testing have also been hacked in the past. https://securingtomorrow.mcafee.com/business/vulnerability-in-some-secure-usb-sticks/