It’s been more than a year since some of the NSA’s most capable hacking tools were stolen and leaked online, and despite a concerted effort to see PCs and systems patched against them, many thousands are still vulnerable to the attacks, which continue to work. Worse still, new and more advanced attack methods are being used to make these tools even more effective, leading to hackers taking over systems in their entirety.
The NSA has long been known to be involved in developing clever hacking tools that can snoop on all sorts of networked hardware all over the world. The Edward Snowden revelations provided just a small insight into their capabilities and just over a year ago, when some of the agency’s hacking tools leaked online, we learned even more. But that leak was far worse in many ways, as it meant that hackers could take advantage of those hacking tools, and they still are, to great effect.
The UPnProxy attack was first spotted earlier this year, with cloud service provider Akamai Technologies highlighting how more than 3.5 million devices around the world were potentially vulnerable to the hack, which used port-forwarding on a router to send malicious traffic to a connected system. Months later, that number of vulnerable systems has been limited to just 277,000, but that’s still a huge pool for hackers to draw from, and Akamai is now reporting that some 45,000 of those have already been compromised.
As TechCrunch reports, hackers are now using a pair of exploits developed by the NSA to burrow through the router and attack connected systems. The two exploits, known as EternalBlue and EternalRed, target Windows and Linux-based systems respectively. This new attack is being termed “EternalSilence” by Akamai, which warns that with 45,000 infected devices, more than a million connected computers could also be vulnerable.
Suggestions on how to protect yourself and your system from the attack include patching to the latest version of your operating system — Microsoft has patched most of the vulnerabilities these tools exploit — and updating your router firmware. If there is any suggestion that your network may have been compromised though, Akamai suggests that replacing the potentially infected router entirely may be the best course of action.
Concerned about PC security? Check out our regular [in]secure column to learn more.
