To try everything Brilliant has to offer -free- for a full 30 days, visit 👉 brilliant.org/DanielBoctor/. You'll also get 20% off an annual premium subscription! PART TWO IS OUT NOW 👉 ua-cam.com/video/L1LZpWqbJG8/v-deo.html THANKS FOR WATCHING ❤ **EDIT - please read** Just to be clear, Kaspersky are the ones who discovered the Equation Group in the first place. They announced the discovery on February 16, 2015, at the Kaspersky Security Analysts Summit held in Mexico. The quote @ 3:38 was actually taken from their official report, that they published on the same day. I definitely should have made this more clear, and I can see why there is a lot of confusion. JOIN THE DISCORD! 👉 discord.gg/WYqqp7DXbm 👇 Let me know what type of content you would like to see next! 👇 Thank you for all of the support, I love all of you
SOMEONE WITH HACKING SKILLS could be very dangerous in the coming months and yrs,all it take is the right motivations/attitude and mind set /bad bad actor villain lvl
So many malware tutorials all using the same attack vector clearly emphasize how exactly nothing has been patched. The real upsell of updating your OS is free tech support (monitoring) for the current generation OS
What was their reasoning to ban Deepcool then? it is actually just as simple as their relation to Russia... And what of the other previous bans years prior like DJI or SMIC?
haha, every security department of a government has those tools under their sleeve, specially "capitalist" ones, you will be surprised if you catch the embebed code of VISA and MasterCard debit and credit card code, those also work in that way, macOS is the one with the most notable backdoors, microsoft second, and for linux you need to cling into the tools the system use (because you can find a custom linux OS that does not require outside the country code to mitigate backdoors).
They hacked a sub contractor who had an exploit but nobody wanted to buy because they would become a target because NSA spent millions in development of the exploit.
More like NSA. They never informed Microsoft until it was too late. Microsoft patched the vulnerability almost as soon as they were eventually made aware by the NSA. So big tech doesn't really have much guilt on this, the guilt lies with the NSA.
@@danwic You assume that Microsoft did an oopsie that noone discovered within their development and the NSA didn't ask for an obscure backdoor... ...again. Which is a very bold assumption, or should I say, a quite mentally handicapped assumption. Eternal Blue wasn't necessary an accident or a coding error, it could have been and most likely was a feature, intended for the use of USA government agencies - not necessary limited to the NSA -, then the NSA decided to act like NSA does: not reminding Microsoft in time that they got hacked, hoping their favorite toy wasn't stolen.
@@danwic just look at Snowden's revelations. Microsoft does was Big 3-Letter Intel tells them to, pun intended. Microsoft builds soft-side code, alphabet smiths exploit it, not to say they're spoonfed, it has to look innocuous. I have zero proof however similar instances of intentional backdoors have been well documented.
I must say, after 2 years of studying IT, programming, red and blue team, no one ever explained this vulnerability better than you did here. Subscribed. I'll watch all of your videos, and will be waiting for the 2nd part. And thanks for sharing that defcon talk, I'll watch that as well!
@@DanielBoctor I have gone so far as to complete my bs in comp sci and have years of IT experience (though I do lack programming experience as a junior dev) and I have to agree with Bobert this video was insanely good especially when explaining this sort of thing to someone non-technical (they’ll tune out often but your “recaps”, visuals, style etc can keep the smarter ones watching)
it's a deep dive without the first step: how did we get infected, thru which channel? were ports mentioned? ports opened to web, ports opened locally? in that aspect this doesn't help much to protect yourself, but 'grc shields up' might...
@@homeistheearth That's really all you need. 'Brute force' style attacks are the ones that require insane computational power, and for the most part those don't happen any more.
@@daryljenkins4391 The "thing" that happened with Debian showed us that open source doesn't mean anything, unless it has been audited independently by reputable auditors/cybersec experts, multiple times in various different ways, with the results being published. Good luck with finding something like that. Maybe Red Hat/SuSe products but I highly doubt it. Potentially something like OpenBSD comes to mind but I don't think it can meet all of the listed requirements. I do think it comes the closest to them.
Providing those backdoors gives Microsoft permission from the government to remain in the Apple, MS duopoly. We all know Linux is an option but remains an option for nerds only and is nowhere near any form of mass adoption. Microsoft is a member of the Linux board to keep it that way.
@@jamiewilliams1410 “Microsoft has confirmed that they have more Linux servers than Windows servers on their Azure cloud platform. Over 50% of Azure virtual machine cores are running Linux.”…the good news is that things are changing. At some point they have to listen to their customers.
Well MS just wrote Buggy code. NSA found the bug and decided that rather than to alert Microsoft, so people could be protected from malicious actors, do keep it for themselves.
@soundspark How can they ban Kaspersky in 2017 and bringing this attention and have people know. This has blew it all off the lid. What's worse is that Kaspersky is so good, that it gives you a performance boost. My laptop went from 3-4 hours of work time on battery, to 6 to 8 hours.
@@soundspark They started a smearing campaign exactly in 2017. After Kaspersky ability to detect government's malwares went public. Google for articles from the time.
Yes, countries should rename their departments of "defence" back to departments of war, like how it was before world war 1. Because it sounds more epic.
its just part of the landscape, what army(even IT) doesn't attack or have to defend, at some point.... not entirely sure it's justice, since nothing will come of it.
The US State Department just accuses however meets their current strategic goals the best, so I really don't trust their attributions to North Korea and Russia. Ultimately their cyber weapons are to blame regardless.
Well the USA did invent the internet and they accelerated computer development to where the world could have computers so, they basically own everyone's computers anyway. No matter how much China tries to steal our technology we will always be ahead.
If it was just US whatever or NSA i'd get you, but no software engineer who looked at it, from US to S. Korea has objected to the evidence, of which there are more than plenty. And you, worm for a brain, are doing _exactly_ what all US enemies whant you to do. Becoming an enemy to yourselves.
My friend, your explanation of the exploit is STELLAR! Even as a guy in this industry, it boggles my mind how complicated this exploit is, and moreover, how others found the actual exploit itself! Crazy stuff, appreciate the effort you put into this man!
@@DanielBoctorwhat does this have to do with kaspersky? the title is leading people to believe kaspersky is being banned for uncovering or "stopping" wannacry, when that isn't the case and has no correlation in timing.
the only connection i can make here is kaspersky's leak from an nsa contractor. i am not seeing that connection explained in the video. is this an old video you already uploaded?
@@DanielBoctorcould you out more ads in it? Its almost 60% ads vs content. You could easily reach 100% efficiency. Just play ads. Start and End with brilliant ads, and fill the rest with youtube ads.
This is why you should always take advices and try to understand why someone is warning you to fix the bug and not just dismiss it as a joke attempt. Happens often with superiors who think they are more superior then you, just because they want it done faster and get that chachink.
The Internet IS a USA invention in the first place. Duh. You're welcome. You're not going to out internet the USA on it's own invention & creation. It's not "thinking it's superior", it just simply is. Facts are facts. Be mad about it. Doesn't really matter.
@@PenguinCrayon269 Conterfeit money at the hundreds of millions or even billions might be really hard to actually spend. You can't just walk into a bank and slap down a few tens of millions without having to answer some questions. If you're paying in cash you also will only be able to use relatively small quantities in order to not become extremely suspicious. Then again, that does in a way apply to all kinds of illegally obtained currency.
Maybe it's because Eugene Kaspersky was an FSB graduate? That's a secondary reason, the main reason was that KAV has ring 0 permissions (required to scan for rootkits) and is able to push overnight updates. Just add 2 and 2. Ring 0 is the most privileged ring. Everything that runs here is said to be in kernel mode because, well, the Windows kernel runs here. Also the drivers. Here everything has the most privileges. The other ring in Windows is ring 3. Processes that run here are said to run in user mode. There are no rings 1 and 2 in Windows (technically Windows wasn't implemented with rings, but the principles of segregating the privileges still do apply). Any antivirus needs to run in kernel mode for obvious, now, reasons. And, to make that 2+2 for you, albeit Eugene Kaspersky didn't prove to do everything his "colleague" Putin probably asked, the risk is there and the risk is to have in the morning tens to hundreds of thousands of computers being completely Russian puppets. It would be impossible to scan every antivirus update for backdoors especially when you don't see the source code. That scan would have been mandatory because Russia put cyberwarfare in its Military Doctrine in 2014 as part of the hybrid war, basically declaring war on the whole West. So the US took the sane approach: when you have no defense against an unconvicted criminal, better not invite him into your home.
Had this been open source, it is still uncertain that anyone would have noticed this exploit. In fact, had it been open source, the hack might have been discovered sooner and used longer. Don't get me wrong, I gave up Windows long ago and now use Linux strictly.
lol this is why Elon is freaking out at the people he gave money to in order to research AI for humanities greater good (i.e. open source).. now they’re turning around and selling it directly to the highest bidder. We’re screwed.
It would help if you thought a little more globally. How much do you trust a Russian program? They likely have trojans, too. The lesson is to trust neither without being unpatriotic. It is cyber-warfare that has been continually going on.
The IME and the PSE are official utilities available to the network administrator. That makes it more of a normal feature than a real stealth backdoor IMO. Although the NSA did complain about it to Intel as a potential vulnerability 😆
Wait, so the NSA knew about a vulnerability, but were so full of arrogance and hubris that they didn't even bother to secure their systems so that it can't be used against them? Shocker. Even if SMB2 didn't exist at the time, they tailor the OS to their needs anyway, and could've easily either switched to NFS or even wrote their own more secure protocol to reduce the giant attack surface caused by SMB1 Edit: SMB2 was released in 2006, Microsoft Deprecates SMB1 in 2013, NSA gets hacked in 2016. They literally just had to disable SMB1 🤦♂️
Nope. They were banned from government comp back in 2015 after NSA Equation Group hacker took his NSA malware home. His home PC Kaspersky anti virus picked it up on their servers in their Russian HQ. Kaspersky is controlled by Russian intelligence due to Russian state laws. So in 2015 Russian hackers leaked the NSA Malware and documentation to embarrass the U.S.
"they tailor the OS to their needs anyway" ain't a very easy feat... the switching protocols part though could be "easy", it would just involve a bunch of custom drivers.
Was it ever specified that the attack against the NSA was carried out using the EternalBlue vulnerability? I would think that they would have secured their systems against this vulnerability, and a different attack vector was used. Could easily be wrong, but I don't recall that being stated in this video.
It's not arrogance, they were using it or planning to use it to spy on people. This is not exactly the first time they discovered an exploit and used it for spying.
Damn yo I’m a software engineer and I feel stupid as fuck watching this. Super complicated exploit but u did a good ass job explaining. Not sure how this doesn’t have way more views lol
Dude but that’s with every new project or thing you learn in coding. You always feel lost and find your way lol if it was easy software/programming engineers positions would be handed out like free water
@@MaillonRecordz haha yeah I mean normally I have a easy enough time following along and have enough knowledge to like have a general idea of what’s happening but this vid I had to pay laser focus to or else I had to go back and rewatch . But I agree, the constant learning is what makes software engineering such a great job!
it's more so that kaspersky had buddied itself up with the kremlin (everyone in cybersecurity knew this) and that it was only a matter of time before the kremlin started using it for foul play. 2017 spooked the us gov, but it wasn't clear if the kremlin was in on that or if it was just kremlin negligence and kaspersky luck, part of why they weren't fully sanctioned on the spot. but over time, non-government researchers started sounding alarms after seeing more of this ambiguous foul play, and this really hit a peak in 2022 with stuff that looked more clear-cut. the 2024 ban may have been the us finally finding a smoking gun that private security researchers were suspecting existed
I worked in a SOC on night shift at the time of this, I grabbed one of the screenshots and set it as the slideshow screensaver on every machine in the room. The next morning my relief was late so i left, she finally showed up about a half hour later and i got a panicked phone call from her on my drive home. I had to pull over and catch my breath because i was laughing so hard.
Jobs done!? La banda che opprime e sfrutta i cittadini usa e del mondo, e tu sei contento? O sei uno che ci mangia, o sei uno che non ha capito un gran ché. Pensi che "lo stato profondo" abbia a cuore l'interesse del cittadino?
I feel like I’ve been hacked just by watching this video. I am by no means a hacker, just an everyday computer-user, but I still watched the whole video. I understood very little, and I feel like I am not qualified to comment or compliment. That said, I felt as if the explanations were very thorough and yet succinct at the same time! Well done!
Just as aside, our servers were invulnerable to WannaCry because we disabled SMBv1 YEARS ago as per MS security guidance, which is freely published. That’s the difference between knowing what to to and “install Linux because ima rocket scientist now, hurdy durdy”
@@o0Donuts0o I don’t know which is more laughable. The fact that the attack was planned years only to get discovered because some dev didn’t like his performance numbers. Actually thanks to that we learned not to rely on critical libraries that are maintained by a single person.
@@wyattarich Question? Did he start going to saunas with FSB officials recently or he was doing it before as well? If he was why not ban Kaspersky earlier? The fact remains that Kaspersky is one of the best anti-virus in the market. Besides the US policy has been simple, if you cant control them, ban them. They did this with Huawei, now Kaspersky.
@@masoodjalal1152 Kaspersky is an FSB graduate too. This alone was never enough to justify keeping his company out, they must've found a new reason and his FAB ties are a secondary reason.
Bro you're the only channel in youtube ill ring the bell for. You're amazing. Your capacity of explaining ultra complex subjects into digestible videos is amazing!!!
Hits close to home. My Dad built most of the fundamentals of NFS while at Sun Microsystems. Suddenly he got an invite to give a lecture about it at the NSA. This was around the mid to late 90s.
And the political trolls on the comments section have the same effect, giving the impression of clickbait hype. In actuality yes, this is pure tech, nice!!
If something connects to a network. It can be accessed. Nothing is safe unless it's completely unattached. If you have files you want to keep safe, back them on up external drives and after back up disconnect it from the network and store it away. Use a computer not connected to the main network to access files. Middle man if you will. It's a hassle but it will guarantee security.
The complexity of the crafting of this video essay, let alone the words leaving your head by your mouth in a sensical, comprehensible and eloquent way (without stumbling at any point) is, in my opinion, as significant in effort as the input that the actual exploit initially was to uncover. How you managed to convey some of the complexity of this sophisticated attack in an incredibly interesting digestible 20min video i have no idea?! But it was brilliant!! 👏👏👏
This is why open source operating systems (like Linux) and open source software in general is better. Anyone can look into the code, and if they find a bug, they can fix it themselves, or ask someone else to fix it. With closed source software, like Windows, you are forced to just ask Microsoft if they could fix the issue... which in many cases they just ignore (there are several security issues that are in Windows 11 that have been there since at least Windows 7)
This is why all servers use Linux, including much of Azure (Microsoft actually maintains their own distro), any person or group who knows the dangers of proprietary software should avoid it like the plague. Microsoft is forced to share their source code with the US government, so they can develop all the Eternal Blues they want, and Windows will be at the whims of whoever has access to that network, be it spys on our side, or North Korea. Use Linux, and samba to serve your files, it will save you much headache and security.
It works the other way around and the reason why security agencies like the NSA and CIA don't use open source products. Because with open source, you can go to the source code itself, find bugs and exploit them. One of the requirements to store secret and top secret information is for the device it's stored in to not use any open source code or libraries. Specially since other foreign states with almost unlimited resources and some of the smartest security actors could easily find and exploit open source bugs that no one else has found. Most corporations and enterprises do the same, you're only allowed to use open source projects if your security team has vetted an open source project and agreed there is minimal risk in using that project
@@artu165"specially since other foreighn states could easily find and exploit open source bugs that no one else has found" and what makes the argument different for closed source? Edit: I would assume that your comment was sarcastic, as claiming that closed source is more secure under a video about NSA backdoor exploit is way too ironic.
@@C-aFilmsExcept that having a state funded dedicated team of engineers tend to find vulnerabilities far more efficiently than a bunch of hippies in their free time.
11:47 This is why Hungarian Notation is good. If that was used they could have used it to indicate the data type. Unfortunately the language they used didn't inforce the data type of the variable which was the main problem. If the compile warned that the data type didn't match (2 byte vs 4 byte) we wouldn't have this problem. I hope C/C++ compilers are smart enough to catch buffer overflows and type mismatches now.
C compilers has been catching that kind of bug since decades and C++ completely disallow it without a reinterpret cast. The problem was not the tools, it was the devs who choose to disregard compiler warnings.
So the take-home message was, that a lot of finger-pointing was done to Koreans and Russians, but the *digital rapists at the NSA* are not going to be held accountable, for not only developing this vulnerability, but also, that the lummoxes left out this cookie jar of goodies, for someone crafty enough to climb up on the counter to help themselves to these tasty treats? Yep, the National Insecurity Agency strikes again. Hundreds of billions in damage.
What happens if US customers just ignore the ban and go ahead and use VPN's to extend their subscriptions to Kaspersky and download updates for their Kaspersky products?
Apparently nothing, because that’s what my brother does and he doesn’t have any problems so far. What Kaspersky does is that they provide their VPN along with the security package. My brother is really cheap and uses Kaspersky because he gets the whole package for $40 a year. Also he isn’t very tech savvy and he likes that if you call the Kaspersky help line you usually have a real person pick up immediately. I wonder where their help desk is. He told me that the last two times he called to get support on the renewal the first person sounded Indian, but the second one sounded American.
1 minor correction the NSA is not part of the department of defense they are part of the department of Homeland security or DHS meaning they fall under title 32 not title 10
Why was the NSA never fingered as the *real* source of all the woe that these exploits caused? If, like any responsible organisation, it'd simply informed MS and others of these exploits then a great deal of fear, damage and financial loss could have been been prevented. I can, partially, understand the NSA being reticence in reporting the exploits - but weighed against the huge cost to the public and governments for their failure to do it - it's reasons are, to put it mildly, pathetic. Those exploits *would* have been found by others - there's a huge number of people constantly searching for them - and all their delayed reporting did, was give people the opportunity to find them... though I doubt those people thought they'd find them all documented on the NSA's servers.
The entire purpose behind the all the three letter agencies is to transform the world into a dystopian wasteland. Why would they try and seek to minimize damages? They are gleeful over every million that gets burned for nothing.
Like this format, great balance of context to be descriptive and meaningful so as not to have to go and look up specific things but also not to boil down to a CS for dummies tutorial. Nice work! Longer videos rather than multiple parts would've been much appreciated too
I've read about this before but never knew how it REALLY worked. Security research sure is an amazing field for those courageous enough to dive deep into uncharted territories
Super well done video! I love the visual components to help explain the various copying and data movements. Really helps to grasp the concept for visual learners.
13:50 - if the size has been wrongly shrunk (and thus expanded), why would the arbitrary attacker’s data overflow the NtFeaList buffer, since we expect the NtFeaListSize to be correctly calculated (which im assuming it was reading 4 bytes of the Os2FeaListSize correctly and not the UShort version)?
11:41 pretty sure "-Wincompatible-pointer-types" should prevent it unless SmbPutUshort takes "void*" as first parameter, then i can see why it failed to warn because implicitly cast to "void*" wont cause warning.
@@vectorsahel5420 Sorry, different account, still not very original and it has nothing to do with this thread. Hit ctrl-f and search for "Paul Allen" on this page. Could be coincidence. Still begs the question "what?" your comment has to do with mine. Maybe i missed something?
That’s not important… what’s important is that you fear the brown people and pledge your undying loyalty to your new overlords and hand over any and all personal information to them! It’s a new world order after all…
Yes they went to illegal black projects that operate outside of the president and congress and the public. Dr. Steven Greer and his witnesses proved it all and the there was a national press club event 2021. It’s on his UA-cam and the national press club UA-cam page. These witnesses have sworn affidavits to prove it in front of congress. It’s all there. Plus his whole archive was made public months ago, 20 terabytes available for you. 8-10 hour interviews, still classified documents available for public access cause they were illegally classified and can’t be silenced now. Enjoy there is so much more.
@@creekmonster17 yes Illegal Special Access project, it’s on Dr Steven Greer website, the national press club events, both the 2001, and 2021. It’s on the National Press Club UA-cam page too. His whole archive is free to everyone world wide including all the still illegally classified documents that they don’t want you to see but you can cause no court will ever support them. Hundreds upon hundreds of first hand accounts, financial data, names, dates. All there
100% it's just that because they got banned like they should have. It's like a propaganda video really, "oh the protection works and they find stuff", yeah; but they can still be stealing. I noticed a lot of people in the comments don't understand that.
Kaspersky was mentioned like once in the video and it was a comment about the NSA that has nothing to do with content of the video yet they managed to make it all the way to the title. Logic Kaspersky = Russian = BAD = Must Watch 😀
12:30 I don't understand why this doesn't happen with a non-malformed packet if it treats the size of list as a word anyway, and how 0000 turns into FF5D there
Ah, good question. if you send a non-malformed packet, the SizeOfListInBytes shrinking process will *not occur* at all. The shrinking process only happens in response to a malformed packet, when the FEAs extend beyond what was expected, based off the value of SizeOfListInBytes. With a non-malformed packet, the SrvOs2FeaListSizeToNT function would have *only* performed step 1, as it would have no reason to move onto step 2, as mentioned @ 10:30. Hopefully this makes sense!
@@DanielBoctor Oh I probably missed the part where it considers it a word only in the shrinking process. Thanks for the reply! I'm still confused about how it detects it being malformed, just a simple "SizeOfListInBytes -= SizeOfListInBytes % FeaSize" operation? edit: ohhh I get it now
Awesome video! At 12:34 you said the size may be enlarged instead of shrunk. How is this possible, considering that the low dword is shrunk and the high dword is unaltered?
ah, good question. it is able to be enlarged instead of shrunk because the lowdword is *not always* shrunk. it could be enlarged, depending on the exact values being used. let me explain: Let's put the hexadecimal digits aside and just focus on regular base 10 numbers. Imagine you want to shrink the number 20 down to the number 15. If you froze the first digit (the '2' in 20), but allowed the second digit to change (the '0' in 20), you would end up with 25, instead of 15. this is because the 2 remained a 2, whereas the 0 was turned into a 5. does this make sense? the unfrozen, right hand digits could very well end up being a larger value, so long as you shrink the original number by an amount so large that the frozen, left hand digits also need to drop down. hopefully this makes sense!
I feel like you end this video early, where is the part where you relate this to kaspersky? or did you just use the name for the clicks as it’s a hot topic right now. regardless though really good explanation of this exploit
More and more people might face a tough time in retirement. Low-paying jobs, inflation, and high rents make it hard to save. Now, middle-class Americans find it tough to own a home too, leaving them without a place to retire.
The increasing prices have impacted my plan to retire at 62, work part-time, and save for the future. I'm concerned about whether those who navigated the 2008 financial crisis had an easier time than I am currently experiencing. The combination of stock market volatility and a decrease in income is causing anxiety about whether I'll have sufficient funds for retirement.
Certain Ai companies are rumoured to be overvalued and might cause a market correction, I’d suggest you go with a managed portfolio, but even those don’t perform so well, so it’s best you reach out to a proper fiduciary to guide you, that’s what works for my spouse and I.
'Grace Adams Cook' , is the licensed advisor I use. Just research the name. You’d find necessary details to work with a correspondence to set up an appointment.
![Who was REALLY behind the Microsoft Backdoor [PART 2]](http://i.ytimg.com/vi/L1LZpWqbJG8/mqdefault.jpg)
![Who was REALLY behind the Microsoft Backdoor [PART 2]](/img/tr.png)
![Lp. Сердце Вселенной #60 РОЖДЕНИЕ ЛОЛОЛОШКИ [Финал] • Майнкрафт](http://i.ytimg.com/vi/YoR0pAV9FVQ/mqdefault.jpg)
To try everything Brilliant has to offer -free- for a full 30 days, visit 👉 brilliant.org/DanielBoctor/. You'll also get 20% off an annual premium subscription!
PART TWO IS OUT NOW 👉 ua-cam.com/video/L1LZpWqbJG8/v-deo.html
THANKS FOR WATCHING ❤
**EDIT - please read**
Just to be clear, Kaspersky are the ones who discovered the Equation Group in the first place. They announced the discovery on February 16, 2015, at the Kaspersky Security Analysts Summit held in Mexico. The quote @ 3:38 was actually taken from their official report, that they published on the same day. I definitely should have made this more clear, and I can see why there is a lot of confusion.
JOIN THE DISCORD! 👉 discord.gg/WYqqp7DXbm
👇 Let me know what type of content you would like to see next! 👇
Thank you for all of the support, I love all of you
Change the thumbnail it’s easier to share if it doesn’t look like I’m sharing some conspiracy stuff
SOMEONE WITH HACKING SKILLS could be very dangerous in the coming months and yrs,all it take is the right motivations/attitude and mind set /bad bad actor villain lvl
So many malware tutorials all using the same attack vector clearly emphasize how exactly nothing has been patched. The real upsell of updating your OS is free tech support (monitoring) for the current generation OS
$300 seems like a really reasonable price for an online course on the importance of making regular backups 😁
Thanks. Shalom.
Kaspersky calling them out on this (and many other things) makes banning them now look like a move to protect future backdoors and get revenge
That makes sense!
Saving this
What was their reasoning to ban Deepcool then? it is actually just as simple as their relation to Russia... And what of the other previous bans years prior like DJI or SMIC?
Kaspersky isn't under the thumb of the US gov, so they can't be forced into silence. Easy as
kaspersky didn't call out anyone and isn't even mentioned in the video. wannacry is old and has nothing to do with kaspersky's banning.
That's why you should own 2 computers.
1 plugged to the internet
1 not.
They won't ever steal my quake arena mod maps.
Yup that's how you do it. ❤
RELEASE THE UtubeH8tr MAP PACK!
Run one of those self-learning AIs in a match for a decade and they'll develop world peace.
@@Thalanoxthat’s how you start judgement day. That will find a way to get itself off the computer.
They won't collect my Club Penguin LAN server
The fact that this exploit was only discovered by hacking the NSA is insane.
haha, every security department of a government has those tools under their sleeve, specially "capitalist" ones, you will be surprised if you catch the embebed code of VISA and MasterCard debit and credit card code, those also work in that way, macOS is the one with the most notable backdoors, microsoft second, and for linux you need to cling into the tools the system use (because you can find a custom linux OS that does not require outside the country code to mitigate backdoors).
They hacked a sub contractor who had an exploit but nobody wanted to buy because they would become a target because NSA spent millions in development of the exploit.
Now we all have to pay the price for their negligence.
@@EdwardM919 the MS17 EthernalBlue exploit doesent work anymore. The damage was done in the past.
@@EdwardM919no no now they have total access to your computer and telephone 😂😂😂🎉😅
Common NSA and Big Tech moment
More like NSA. They never informed Microsoft until it was too late. Microsoft patched the vulnerability almost as soon as they were eventually made aware by the NSA. So big tech doesn't really have much guilt on this, the guilt lies with the NSA.
@@danwic You assume that Microsoft did an oopsie that noone discovered within their development and the NSA didn't ask for an obscure backdoor... ...again.
Which is a very bold assumption, or should I say, a quite mentally handicapped assumption.
Eternal Blue wasn't necessary an accident or a coding error, it could have been and most likely was a feature, intended for the use of USA government agencies - not necessary limited to the NSA -, then the NSA decided to act like NSA does: not reminding Microsoft in time that they got hacked, hoping their favorite toy wasn't stolen.
@@danwicyou assume this wasn’t intentional by Microsoft. They created it when they were told to and patched it when they were told to. I mean notified
@@danwic just look at Snowden's revelations. Microsoft does was Big 3-Letter Intel tells them to, pun intended.
Microsoft builds soft-side code, alphabet smiths exploit it, not to say they're spoonfed, it has to look innocuous. I have zero proof however similar instances of intentional backdoors have been well documented.
@@christophertoth9810 Not to say it's unlikely, but you're assuming as well.
I must say, after 2 years of studying IT, programming, red and blue team, no one ever explained this vulnerability better than you did here. Subscribed. I'll watch all of your videos, and will be waiting for the 2nd part. And thanks for sharing that defcon talk, I'll watch that as well!
wow, thanks for this comment. I appreciate the support, and I'm glad you liked the video. Happy to have you on the channel!
@@DanielBoctor
TBH $300 seems like a really reasonable price for an online course on the importance of making regular backups 😁
@@JPs-q1o or, you could tell people for free...
@@DanielBoctor I have gone so far as to complete my bs in comp sci and have years of IT experience (though I do lack programming experience as a junior dev) and I have to agree with Bobert this video was insanely good especially when explaining this sort of thing to someone non-technical (they’ll tune out often but your “recaps”, visuals, style etc can keep the smarter ones watching)
it's a deep dive without the first step: how did we get infected, thru which channel?
were ports mentioned? ports opened to web, ports opened locally?
in that aspect this doesn't help much to protect yourself, but 'grc shields up' might...
"It was North Korean hackers"
Yeah... riiiight. How convenient.
Also - NK only have shitty old western computers..
@@homeistheearth That's really all you need. 'Brute force' style attacks are the ones that require insane computational power, and for the most part those don't happen any more.
@@homeistheearth got sanctioned by the us to death. literally.
@@homeistheearth and the ever glorious RedStar OS
@@mycelia_ow nothing wrong with the OS tho, its linux and probably runs faster than windows 11
That the NSA had their little keyhole to spy on everyone used against them is comical. 😂❤
Maybe we should all use open source OSes like Linux.
@@daryljenkins4391 YES Welcome to the Open Source world comrade
@@daryljenkins4391 The "thing" that happened with Debian showed us that open source doesn't mean anything, unless it has been audited independently by reputable auditors/cybersec experts, multiple times in various different ways, with the results being published. Good luck with finding something like that. Maybe Red Hat/SuSe products but I highly doubt it.
Potentially something like OpenBSD comes to mind but I don't think it can meet all of the listed requirements. I do think it comes the closest to them.
@@daryljenkins4391 not even linux distros are safe sadly: just as an example, systemd's main maintainers are microsoft employees
@@daryljenkins4391oss is not immune to infiltration. You didn't hear about xz?
I dont get why they called it Windows. Should have called Backdoors
Same idea, isn’t it. Good point.
Providing those backdoors gives Microsoft permission from the government to remain in the Apple, MS duopoly. We all know Linux is an option but remains an option for nerds only and is nowhere near any form of mass adoption. Microsoft is a member of the Linux board to keep it that way.
@@jamiewilliams1410
“Microsoft has confirmed that they have more Linux servers than Windows servers on their Azure cloud platform. Over 50% of Azure virtual machine cores are running Linux.”…the good news is that things are changing. At some point they have to listen to their customers.
Gay backdoor big mike likes
Microsoft Backrooms... the possibilities are endless....
Sounds like Microsoft and NSA are the real adversaries here
Tale old as time
Well MS just wrote Buggy code. NSA found the bug and decided that rather than to alert Microsoft, so people could be protected from malicious actors, do keep it for themselves.
Richard Stallman was right.
No. It's CCP and Russia.
@@MaakaSakuranbo these bug might be introduced by microsoft on behalf of NSA request
That's why they're banning Kaspersky. Because it could detect even NSA's exploits.
In that case wouldn't they have been banned in 2017?
@@soundspark Gov aren't as bright as they'd have us believe.
@@soundspark But is banned now.
@soundspark How can they ban Kaspersky in 2017 and bringing this attention and have people know.
This has blew it all off the lid. What's worse is that Kaspersky is so good, that it gives you a performance boost. My laptop went from 3-4 hours of work time on battery, to 6 to 8 hours.
@@soundspark They started a smearing campaign exactly in 2017. After Kaspersky ability to detect government's malwares went public. Google for articles from the time.
Department of Defence is a misnomer. It's actually the Department of War
It was it's original name! They changed to try to cover the truth ! !! 😮😢
So do other ministries of defense in other countries, which may not be for defense only
the little hats control it all
Is that you, Winston?
Yes, countries should rename their departments of "defence" back to departments of war, like how it was before world war 1. Because it sounds more epic.
NSA being hacked is a form of poetic justice. LOL
Do you also believe in Saddam's WMD?
its just part of the landscape, what army(even IT) doesn't attack or have to defend, at some point.... not entirely sure it's justice, since nothing will come of it.
The NSA was not hacked, a stupid employee took files home and had Kaspersky installed on their home system and the files were exfiltrated that way.
But u paid the price tho
@Conserpov what do you mean?
The US State Department just accuses however meets their current strategic goals the best, so I really don't trust their attributions to North Korea and Russia.
Ultimately their cyber weapons are to blame regardless.
Well the USA did invent the internet and they accelerated computer development to where the world could have computers so, they basically own everyone's computers anyway. No matter how much China tries to steal our technology we will always be ahead.
DOH. Deciet in the Deceit, deflection is the new projection, actually since 1776.
If it was just US whatever or NSA i'd get you, but no software engineer who looked at it, from US to S. Korea has objected to the evidence, of which there are more than plenty. And you, worm for a brain, are doing _exactly_ what all US enemies whant you to do. Becoming an enemy to yourselves.
Russian, Iran, North Korean hackers = Euh.... Bad man...
US, UK, EU hackers = It's not exist, not bad man.
What a braindead take.
My friend, your explanation of the exploit is STELLAR! Even as a guy in this industry, it boggles my mind how complicated this exploit is, and moreover, how others found the actual exploit itself!
Crazy stuff, appreciate the effort you put into this man!
of course, glad you liked it!
@@DanielBoctorwhat does this have to do with kaspersky? the title is leading people to believe kaspersky is being banned for uncovering or "stopping" wannacry, when that isn't the case and has no correlation in timing.
the only connection i can make here is kaspersky's leak from an nsa contractor. i am not seeing that connection explained in the video. is this an old video you already uploaded?
the NSA has windows' source code and all the money in the world at their disposal
@@DanielBoctorcould you out more ads in it? Its almost 60% ads vs content. You could easily reach 100% efficiency.
Just play ads. Start and End with brilliant ads, and fill the rest with youtube ads.
"but I digress", the digressions were great mate.
This is why you should always take advices and try to understand why someone is warning you to fix the bug and not just dismiss it as a joke attempt. Happens often with superiors who think they are more superior then you, just because they want it done faster and get that chachink.
The Internet IS a USA invention in the first place. Duh. You're welcome. You're not going to out internet the USA on it's own invention & creation. It's not "thinking it's superior", it just simply is. Facts are facts. Be mad about it. Doesn't really matter.
Ransomware has to be the fastest way to make money ever invented
the fastest way is to print it 💀
@@PenguinCrayon269Not everyone is a banker o thr government.
@@blindedjourneymancounterfit money exists
@@PenguinCrayon269 Cant print in one day enough to multiply your net worth by 100000x
@@PenguinCrayon269 Conterfeit money at the hundreds of millions or even billions might be really hard to actually spend. You can't just walk into a bank and slap down a few tens of millions without having to answer some questions. If you're paying in cash you also will only be able to use relatively small quantities in order to not become extremely suspicious.
Then again, that does in a way apply to all kinds of illegally obtained currency.
Damn Kapersky said they're a weapon to surpass Metal Gear thats crazy
Otacon! Why is there another Metal Gear?! /MetalGearAwesome voice
RULES OF NATURE
Hmm
So what is the REAL reason the US government has labeled Kaspersky a national threat?
Maybe it's because Eugene Kaspersky was an FSB graduate? That's a secondary reason, the main reason was that KAV has ring 0 permissions (required to scan for rootkits) and is able to push overnight updates. Just add 2 and 2.
Ring 0 is the most privileged ring. Everything that runs here is said to be in kernel mode because, well, the Windows kernel runs here. Also the drivers. Here everything has the most privileges. The other ring in Windows is ring 3. Processes that run here are said to run in user mode. There are no rings 1 and 2 in Windows (technically Windows wasn't implemented with rings, but the principles of segregating the privileges still do apply). Any antivirus needs to run in kernel mode for obvious, now, reasons. And, to make that 2+2 for you, albeit Eugene Kaspersky didn't prove to do everything his "colleague" Putin probably asked, the risk is there and the risk is to have in the morning tens to hundreds of thousands of computers being completely Russian puppets. It would be impossible to scan every antivirus update for backdoors especially when you don't see the source code. That scan would have been mandatory because Russia put cyberwarfare in its Military Doctrine in 2014 as part of the hybrid war, basically declaring war on the whole West. So the US took the sane approach: when you have no defense against an unconvicted criminal, better not invite him into your home.
He literally says it in this video. They discovered closed backdoors that the NSA was using
Truth
It's based on Kaspersky Antivirus being the source of a leak of classified material originating from a NSA contractor's home computer. That's it.
In the empire of lies, truth is a national threat.
This highlights why closed-source is inherently dangerous.
Had this been open source, it is still uncertain that anyone would have noticed this exploit. In fact, had it been open source, the hack might have been discovered sooner and used longer. Don't get me wrong, I gave up Windows long ago and now use Linux strictly.
@@douglasgoodall3612 if it would have been discovered sooner it would've been patched sooner
@@baconofburger8784 - You ASSUME discovery by White Hats. Black Hats keep their own secrets.
Potentially* not inherently. You're using a closed-sourced platform, if you really believed that then you wouldn't.
lol this is why Elon is freaking out at the people he gave money to in order to research AI for humanities greater good (i.e. open source).. now they’re turning around and selling it directly to the highest bidder. We’re screwed.
And just like that their sudden banning of Kaspersky makes sense. They will not tolerate any whistle blower exposing their crime.
It would help if you thought a little more globally. How much do you trust a Russian program? They likely have trojans, too. The lesson is to trust neither without being unpatriotic. It is cyber-warfare that has been continually going on.
Like Edward Snowden the champ. Add to that Gates personally bashed Snowden.
@@softwarerevolutions Exactly.
Every intel computer is backdoored anyway with management engine
You can buy non ime chips from govt sales I think. But just don't use Intel.
AMD too with the pse.
Very angry we cant have private computing. Even arm microcontrollers have backdoors.
@@BeefIngotwelcome to 1984
The IME and the PSE are official utilities available to the network administrator. That makes it more of a normal feature than a real stealth backdoor IMO. Although the NSA did complain about it to Intel as a potential vulnerability 😆
I love my librebooted thinkpad
Wait, so the NSA knew about a vulnerability, but were so full of arrogance and hubris that they didn't even bother to secure their systems so that it can't be used against them? Shocker.
Even if SMB2 didn't exist at the time, they tailor the OS to their needs anyway, and could've easily either switched to NFS or even wrote their own more secure protocol to reduce the giant attack surface caused by SMB1
Edit: SMB2 was released in 2006, Microsoft Deprecates SMB1 in 2013, NSA gets hacked in 2016. They literally just had to disable SMB1 🤦♂️
Nope. They were banned from government comp back in 2015 after NSA Equation Group hacker took his NSA malware home. His home PC Kaspersky anti virus picked it up on their servers in their Russian HQ. Kaspersky is controlled by Russian intelligence due to Russian state laws. So in 2015 Russian hackers leaked the NSA Malware and documentation to embarrass the U.S.
"they tailor the OS to their needs anyway" ain't a very easy feat... the switching protocols part though could be "easy", it would just involve a bunch of custom drivers.
Was it ever specified that the attack against the NSA was carried out using the EternalBlue vulnerability?
I would think that they would have secured their systems against this vulnerability, and a different attack vector was used.
Could easily be wrong, but I don't recall that being stated in this video.
Super Mario Bros 2
It's not arrogance, they were using it or planning to use it to spy on people. This is not exactly the first time they discovered an exploit and used it for spying.
Damn yo I’m a software engineer and I feel stupid as fuck watching this. Super complicated exploit but u did a good ass job explaining. Not sure how this doesn’t have way more views lol
haha, it be like that sometimes. I appreciate the support 😊
u should be a software engineer then nn dog
Dude but that’s with every new project or thing you learn in coding. You always feel lost and find your way lol if it was easy software/programming engineers positions would be handed out like free water
@@MaillonRecordz haha yeah I mean normally I have a easy enough time following along and have enough knowledge to like have a general idea of what’s happening but this vid I had to pay laser focus to or else I had to go back and rewatch . But I agree, the constant learning is what makes software engineering such a great job!
Has not more vieuws because its old af already.
So Kaspersky found backdoors that the nsa was using? Makes perfect sense that they would be banned from the us 😂
Had they not interfered with Kasprski, it could have protected you & everyone else much better…
it's more so that kaspersky had buddied itself up with the kremlin (everyone in cybersecurity knew this) and that it was only a matter of time before the kremlin started using it for foul play.
2017 spooked the us gov, but it wasn't clear if the kremlin was in on that or if it was just kremlin negligence and kaspersky luck, part of why they weren't fully sanctioned on the spot.
but over time, non-government researchers started sounding alarms after seeing more of this ambiguous foul play, and this really hit a peak in 2022 with stuff that looked more clear-cut. the 2024 ban may have been the us finally finding a smoking gun that private security researchers were suspecting existed
You people are dumb
I worked in a SOC on night shift at the time of this, I grabbed one of the screenshots and set it as the slideshow screensaver on every machine in the room. The next morning my relief was late so i left, she finally showed up about a half hour later and i got a panicked phone call from her on my drive home. I had to pull over and catch my breath because i was laughing so hard.
That was mean.
American government responsible... Blame Russia and DPRK... Jobs done!
Jobs done!?
La banda che opprime e sfrutta i cittadini usa e del mondo, e tu sei contento?
O sei uno che ci mangia, o sei uno che non ha capito un gran ché.
Pensi che "lo stato profondo" abbia a cuore l'interesse del cittadino?
Petya is obviously russian
There's only one country that can target specifically Ukraine and name their virus as "petya"
I'd rather give my data to ruZZia rather than a gay country.
Because they are responsible lol
@@Athenaa13Least mental challenged americunt
The NSA was engaged in cyber gain of function research, and it got away from them.
😂
That British researcher wrote Kronos on an amphetamine binge.
_"Ferb, I know what we're gonna do today"_
After the Snowden incident, they won't repeat the same mistake near soon.
idk why but my brain read your channel as Daniel Backdoor.
haha, that's would be quite fitting
Welp, that's stuck in my mind now. Can't unread... xD
immutable buffer. (:
Daniel's backdoor 😈
I feel like I’ve been hacked just by watching this video.
I am by no means a hacker, just an everyday computer-user, but I still watched the whole video. I understood very little, and I feel like I am not qualified to comment or compliment. That said, I felt as if the explanations were very thorough and yet succinct at the same time! Well done!
Kasperski: We found this backdoor...
NSA:SHUTUP! IT WAS THE KOREAN SPIES!!! AND YOU ARE A ILLEGITIMATE COMPANY! AND ALSO.. SHUTUP!
And now, we're banning you in the US!!
On behalf of all Linux users, let me just say, "Not EVERY computer."
Linux users were lucky the xz utils backdoor CVE-2024-3094 was caught in time, Different OS, different exploit, nobody is really safe these days
Didn’t someone try to insert a back door in SSH and only found out by accident?
That’s just laughable.
Just as aside, our servers were invulnerable to WannaCry because we disabled SMBv1 YEARS ago as per MS security guidance, which is freely published.
That’s the difference between knowing what to to and “install Linux because ima rocket scientist now, hurdy durdy”
@@o0Donuts0o 🤣
@@o0Donuts0o I don’t know which is more laughable. The fact that the attack was planned years only to get discovered because some dev didn’t like his performance numbers. Actually thanks to that we learned not to rely on critical libraries that are maintained by a single person.
3:31 Yeah this is probs why Kaspersky is now banned in the US, only the US is allowed to spy on you and Kaspersky just outed them hahahhha
It's got a lot more to do with Eugene Kaspersky's habit of going to saunas with FSB officials. This isn't new information either, Google it!
@@wyattarich Nothing more than a smear campaign.
@@wyattarich Question? Did he start going to saunas with FSB officials recently or he was doing it before as well? If he was why not ban Kaspersky earlier? The fact remains that Kaspersky is one of the best anti-virus in the market. Besides the US policy has been simple, if you cant control them, ban them. They did this with Huawei, now Kaspersky.
@@wyattarich *yawn* Basic slander. Nothing new.
@@masoodjalal1152 Kaspersky is an FSB graduate too. This alone was never enough to justify keeping his company out, they must've found a new reason and his FAB ties are a secondary reason.
I don't see the work "Kaspersky" anywhere in the transcript for this video.
3:39
@@NorthernChimp Thanks!
Bro you're the only channel in youtube ill ring the bell for. You're amazing. Your capacity of explaining ultra complex subjects into digestible videos is amazing!!!
ahhh, I'm honoured! love to hear it 😊. thanks for watching and supporting :)
you are uniquely very good at laying out these exploits in a way that's simple to follow. awesome video
I'm honoured, thank you 😊
The Backdoors are now Barn Doors . 👀
Just give me back backpage 💋
Hits close to home. My Dad built most of the fundamentals of NFS while at Sun Microsystems. Suddenly he got an invite to give a lecture about it at the NSA. This was around the mid to late 90s.
The part of the story that never gets told on the news... Great video!
Glad you enjoyed it!
@@DanielBoctor can't wait to see you do Copilot next
This is easily THE most comprehensive video on the topic. Very well put together. Subscribed!
A terrible, clickbaity title (which almost caused me to ignore the video) for a brilliantly researched and explained video. Please do more of these.
And the political trolls on the comments section have the same effect, giving the impression of clickbait hype. In actuality yes, this is pure tech, nice!!
@@YoniBaruch-y3mWhich political trolls?
@@YoniBaruch-y3m oy vey you cannot call out NSA, thats russian propaganda!11
Almost expected: 'This is where today's video sponsor comes in - The NSA is an industry leading...'
If something connects to a network. It can be accessed. Nothing is safe unless it's completely unattached. If you have files you want to keep safe, back them on up external drives and after back up disconnect it from the network and store it away. Use a computer not connected to the main network to access files. Middle man if you will. It's a hassle but it will guarantee security.
The complexity of the crafting of this video essay, let alone the words leaving your head by your mouth in a sensical, comprehensible and eloquent way (without stumbling at any point) is, in my opinion, as significant in effort as the input that the actual exploit initially was to uncover. How you managed to convey some of the complexity of this sophisticated attack in an incredibly interesting digestible 20min video i have no idea?! But it was brilliant!! 👏👏👏
This is why open source operating systems (like Linux) and open source software in general is better.
Anyone can look into the code, and if they find a bug, they can fix it themselves, or ask someone else to fix it.
With closed source software, like Windows, you are forced to just ask Microsoft if they could fix the issue... which in many cases they just ignore (there are several security issues that are in Windows 11 that have been there since at least Windows 7)
This is why all servers use Linux, including much of Azure (Microsoft actually maintains their own distro), any person or group who knows the dangers of proprietary software should avoid it like the plague. Microsoft is forced to share their source code with the US government, so they can develop all the Eternal Blues they want, and Windows will be at the whims of whoever has access to that network, be it spys on our side, or North Korea. Use Linux, and samba to serve your files, it will save you much headache and security.
It works the other way around and the reason why security agencies like the NSA and CIA don't use open source products.
Because with open source, you can go to the source code itself, find bugs and exploit them.
One of the requirements to store secret and top secret information is for the device it's stored in to not use any open source code or libraries.
Specially since other foreign states with almost unlimited resources and some of the smartest security actors could easily find and exploit open source bugs that no one else has found.
Most corporations and enterprises do the same, you're only allowed to use open source projects if your security team has vetted an open source project and agreed there is minimal risk in using that project
@@artu165"specially since other foreighn states could easily find and exploit open source bugs that no one else has found" and what makes the argument different for closed source?
Edit: I would assume that your comment was sarcastic, as claiming that closed source is more secure under a video about NSA backdoor exploit is way too ironic.
@@artu165 your point is self invalidating, if you can read the code to find a bug, someone else can to FIX the bug
@@C-aFilmsExcept that having a state funded dedicated team of engineers tend to find vulnerabilities far more efficiently than a bunch of hippies in their free time.
The connection between video and the promotion was so smooth...
Well done!
So... the root cause is the NSA.
yes
Root cause is complicated code. KISS
BR
Root cause Is a SMB protocol bug.
@@kristofferjohansson3768 More like the "SMB protocol RCE suite".
For Russian spy anti-virus they helped normal PC users more than those good guys
I find them far more honest and trustworthy then the US government and all its little octopus tendrils.
11:47 This is why Hungarian Notation is good. If that was used they could have used it to indicate the data type. Unfortunately the language they used didn't inforce the data type of the variable which was the main problem. If the compile warned that the data type didn't match (2 byte vs 4 byte) we wouldn't have this problem. I hope C/C++ compilers are smart enough to catch buffer overflows and type mismatches now.
C compilers has been catching that kind of bug since decades and C++ completely disallow it without a reinterpret cast. The problem was not the tools, it was the devs who choose to disregard compiler warnings.
Insane video !
It's crazy to think that something like that can exist / be accepted
I know, it blows my mind everytime I research something like this. Thanks for watching!
It’s nuclear proliferation in cyber form
Except in this case everyone has a uranium mine, can hide the reactors and can develop their capabilities much faster.
So the take-home message was, that a lot of finger-pointing was done to Koreans and Russians, but the *digital rapists at the NSA* are not going to be held accountable, for not only developing this vulnerability, but also, that the lummoxes left out this cookie jar of goodies, for someone crafty enough to climb up on the counter to help themselves to these tasty treats? Yep, the National Insecurity Agency strikes again. Hundreds of billions in damage.
A part 2 on how an adversary could use the out of bounds memory write to gain control of the computer would be very interesting!
@0:30 Yea, so what? Clean the Drive, reinstall the OS, restore from Backup.
Offline time. It’s not always acceptable.
@@mgsxx fair point
What happens if US customers just ignore the ban and go ahead and use VPN's to extend their subscriptions to Kaspersky and download updates for their Kaspersky products?
Experimental verification of Kaspersky’s benevolence, that’s what happens.
Apparently nothing, because that’s what my brother does and he doesn’t have any problems so far. What Kaspersky does is that they provide their VPN along with the security package. My brother is really cheap and uses Kaspersky because he gets the whole package for $40 a year. Also he isn’t very tech savvy and he likes that if you call the Kaspersky help line you usually have a real person pick up immediately.
I wonder where their help desk is. He told me that the last two times he called to get support on the renewal the first person sounded Indian, but the second one sounded American.
@@Palaemon44 Sounds like a sales advert for kaspersky. 😂
I didn't know anything about any of this. Been using Kaspersky for a while now.
10/10 graphics and explaination. MORE VIDEOS KEP IT UP!
glad you thought so 😊. More is on the way 🚀🚀🚀
Offline is the new online (like the 80s)
1 minor correction the NSA is not part of the department of defense they are part of the department of Homeland security or DHS meaning they fall under title 32 not title 10
1:40 that one guy in greenland
Why was the NSA never fingered as the *real* source of all the woe that these exploits caused? If, like any responsible organisation, it'd simply informed MS and others of these exploits then a great deal of fear, damage and financial loss could have been been prevented.
I can, partially, understand the NSA being reticence in reporting the exploits - but weighed against the huge cost to the public and governments for their failure to do it - it's reasons are, to put it mildly, pathetic. Those exploits *would* have been found by others - there's a huge number of people constantly searching for them - and all their delayed reporting did, was give people the opportunity to find them... though I doubt those people thought they'd find them all documented on the NSA's servers.
The entire purpose behind the all the three letter agencies is to transform the world into a dystopian wasteland. Why would they try and seek to minimize damages? They are gleeful over every million that gets burned for nothing.
Like this format, great balance of context to be descriptive and meaningful so as not to have to go and look up specific things but also not to boil down to a CS for dummies tutorial. Nice work! Longer videos rather than multiple parts would've been much appreciated too
Now it explains why Kaspersky falls under sanctions/ - Thank you Kasperksy team for keeping us protected.
This video being free is amazing. Great content! 🙏🏼❤️
Glad you think so! Thanks for watching
Huh, no wonder there were no reports of this malware at the ISPs I worked for back then. I had port 445 blocked the the firewalls.
Dude this video is so well done. Tons of history all in one shot. Insta sub.
I'm honoured. Thank you!
I've read about this before but never knew how it REALLY worked. Security research sure is an amazing field for those courageous enough to dive deep into uncharted territories
Super well done video!
I love the visual components to help explain the various copying and data movements.
Really helps to grasp the concept for visual learners.
NSA kept information about the bug to themselves instead of disclosing it to Microsoft causing all that damage and lost information. Despicable.
Great video man, cant wait for the next one!
Appreciate it!
There is software CIA declared a pain, and its Commodo firewall+AV. Im not sure its authentic, but from experience i can say its tough.
Great job drilling down into the nuts and bolts of SMB memory space. Looking forward to part 2 and more. Subbed.
13:50 - if the size has been wrongly shrunk (and thus expanded), why would the arbitrary attacker’s data overflow the NtFeaList buffer, since we expect the NtFeaListSize to be correctly calculated (which im assuming it was reading 4 bytes of the Os2FeaListSize correctly and not the UShort version)?
Ok i rewatched i think it uses the shrunk (by extension, the 2 bytes size) size to be converted to the NtFeaListSize. Am i correct?
Love the content man, keep it up!
glad you enjoyed! thanks for the support
"every computer" shows macs that weren't affected
Shhhh the Apple fanboys might get upset.
Macs just openly funnel all your private data to Apple. No secret backdoor could compete with that.
@@Sauceyjames He is right tho. That should be clearly show affected OS. I dont give a damn about Apple or Windows but this vid is misleading AF
Dont forget about linux
Apple OS is a custom Linux shell behind a paywall.
11:41 pretty sure "-Wincompatible-pointer-types" should prevent it unless SmbPutUshort takes "void*" as first parameter, then i can see why it failed to warn because implicitly cast to "void*" wont cause warning.
You explain this so well! The order is carefully thought out and you even put asides for relevant topics (e.g. paged pool vs non-paged pool).
Nice vid, very interesting lets see part 2!
glad you liked it!
Let's see Paul Allen's part 2
@@vectorsahel5420 Not getting enough attention from the first time you made that comment?
@@daanmageddon what?
@@vectorsahel5420 Sorry, different account, still not very original and it has nothing to do with this thread. Hit ctrl-f and search for "Paul Allen" on this page. Could be coincidence. Still begs the question "what?" your comment has to do with mine. Maybe i missed something?
It's called Windows for a reason... it's made of glass and see-through. They can look into your life at will. Then they use the back door to enter.
If you are wondering why OS2 gets a mention, it's because IBM invented SMB and Microsoft adopted it for interoperability.
This was so well put together and described. CANT WAIT FOR PART 2
Do we know we're that 2.1 trillion dollars that the Pentagon lost 9/10/2001 is?
How soon people forget...
That’s not important… what’s important is that you fear the brown people and pledge your undying loyalty to your new overlords and hand over any and all personal information to them! It’s a new world order after all…
Yes they went to illegal black projects that operate outside of the president and congress and the public. Dr. Steven Greer and his witnesses proved it all and the there was a national press club event 2021. It’s on his UA-cam and the national press club UA-cam page. These witnesses have sworn affidavits to prove it in front of congress. It’s all there. Plus his whole archive was made public months ago, 20 terabytes available for you. 8-10 hour interviews, still classified documents available for public access cause they were illegally classified and can’t be silenced now. Enjoy there is so much more.
They know, it's just not popular opinion.
@@creekmonster17 yes Illegal Special Access project, it’s on Dr Steven Greer website, the national press club events, both the 2001, and 2021. It’s on the National Press Club UA-cam page too. His whole archive is free to everyone world wide including all the still illegally classified documents that they don’t want you to see but you can cause no court will ever support them. Hundreds upon hundreds of first hand accounts, financial data, names, dates. All there
You didn´t answer the title "What Kaspersky really discoverd". Clickbait.
100% it's just that because they got banned like they should have. It's like a propaganda video really, "oh the protection works and they find stuff", yeah; but they can still be stealing. I noticed a lot of people in the comments don't understand that.
As always, great video. I love how you explain things. Eagerly waiting for the next part. Pls keep making such videos :)
Thanks for the support! Will do - part two is almost done 🙌
Kaspersky was mentioned like once in the video and it was a comment about the NSA that has nothing to do with content of the video yet they managed to make it all the way to the title.
Logic
Kaspersky = Russian = BAD = Must Watch 😀
you have a great knack for making complex topics fun! ♂️
12:30 I don't understand why this doesn't happen with a non-malformed packet if it treats the size of list as a word anyway, and how 0000 turns into FF5D there
Ah, good question. if you send a non-malformed packet, the SizeOfListInBytes shrinking process will *not occur* at all. The shrinking process only happens in response to a malformed packet, when the FEAs extend beyond what was expected, based off the value of SizeOfListInBytes. With a non-malformed packet, the SrvOs2FeaListSizeToNT function would have *only* performed step 1, as it would have no reason to move onto step 2, as mentioned @ 10:30.
Hopefully this makes sense!
@@DanielBoctor Oh I probably missed the part where it considers it a word only in the shrinking process. Thanks for the reply!
I'm still confused about how it detects it being malformed, just a simple "SizeOfListInBytes -= SizeOfListInBytes % FeaSize" operation?
edit: ohhh I get it now
Wait, so this video is called "What Kaspersky really discovered", but you don't mention Kaspersky once in the video. Did you just click-bait us?
You misunderstood, the whole video talks about what kapersky discovered about this attacks and the NSA
You think these bugs were accidental?
You think that’s air you’re breathing? Hmm.
First mistake was inviting KGB agent to your computer installing Kasperski...
Haha how is the war going 😆
Are you guys still winning? Z elensky looking a little anxious these days.
🤣
Found the NSA agent 🤣
Awesome video!
At 12:34 you said the size may be enlarged instead of shrunk. How is this possible, considering that the low dword is shrunk and the high dword is unaltered?
ah, good question. it is able to be enlarged instead of shrunk because the lowdword is *not always* shrunk. it could be enlarged, depending on the exact values being used. let me explain:
Let's put the hexadecimal digits aside and just focus on regular base 10 numbers. Imagine you want to shrink the number 20 down to the number 15. If you froze the first digit (the '2' in 20), but allowed the second digit to change (the '0' in 20), you would end up with 25, instead of 15. this is because the 2 remained a 2, whereas the 0 was turned into a 5. does this make sense?
the unfrozen, right hand digits could very well end up being a larger value, so long as you shrink the original number by an amount so large that the frozen, left hand digits also need to drop down.
hopefully this makes sense!
@@DanielBoctorthanks for the wonderful explanation. I hadn't noticed the underflow :)
someone who finally explained in detail, you gained a loyal sub waiting for part 2
you got me with the cicada 3301 music
Lemmino FTW
Damn gotta buy some Kaspersky now
Adolf putin thanks you 🎉
why would you deliberatlety give a program you didnt write yourself level 0 acces in the kernel?
@@larryc1616 Ukraine has the neo nazis not Russia.
@@NitroDSSkibidi toilet brrr yes yes
@larryc1616 worship your masters on Wall Street serf. You will own nothing and be happy.
Thank you so much for these type of videos!!
of course!! glad you like them. thanks for the support
I feel like you end this video early, where is the part where you relate this to kaspersky? or did you just use the name for the clicks as it’s a hot topic right now. regardless though really good explanation of this exploit
¡Gracias!
More and more people might face a tough time in retirement. Low-paying jobs, inflation, and high rents make it hard to save. Now, middle-class Americans find it tough to own a home too, leaving them without a place to retire.
The increasing prices have impacted my plan to retire at 62, work part-time, and save for the future. I'm concerned about whether those who navigated the 2008 financial crisis had an easier time than I am currently experiencing. The combination of stock market volatility and a decrease in income is causing anxiety about whether I'll have sufficient funds for retirement.
Certain Ai companies are rumoured to be overvalued and might cause a market correction, I’d suggest you go with a managed portfolio, but even those don’t perform so well, so it’s best you reach out to a proper fiduciary to guide you, that’s what works for my spouse and I.
this is all new to me, where do I find a fiduciary, can you recommend any?
'Grace Adams Cook' , is the licensed advisor I use. Just research the name. You’d find necessary details to work with a correspondence to set up an appointment.
Thank you for the lead. I searched her up, and I have sent her an email. I hope she gets back to me soon.