Slashdot Mirror
One Year After WannaCry, EternalBlue Exploit Is Bigger Than Ever (bleepingcomputer.com)
An anonymous reader quotes a report from Bleeping Computer: Exactly one year after the biggest cyber-security incident in history, the exploit at the heart of the WannaCry attack is now more popular than ever, according to telemetry data gathered by Slovak antivirus vendor ESET. Named EternalBlue, the exploit was supposedly developed by the cyber division of the U.S. National Security Agency. EternalBlue was part of a large cache of tools that a hacker group known as The Shadow Brokers stole from NSA servers in 2016 and then leaked online from August 2016 to April 2017. Many suspect the NSA might have notified Microsoft of what the Shadow Brokers stole, because in March 2017, a month before EternalBlue was released, Microsoft released MS17-010, a security bulletin containing patches for the many SMB-targeting exploits included in the Shadow Broker leak.
Even if EternalBlue is not being used anymore to help ransomware become a virulent nightmare on a global level (only on a network level), most regular users don't know that it's still one of today's biggest threats. This threat doesn't only come from malware authors continuing to weaponize it for a diverse set of operations. Malware authors wouldn't ever bother with an inefficient exploit. ExploitBlue continues to be a threat because of the vulnerable machines still available online. According to Nate Warfield of the Microsoft Security Response Center, there are still plenty of vulnerable Windows systems exposing their SMB service available online.
Even if EternalBlue is not being used anymore to help ransomware become a virulent nightmare on a global level (only on a network level), most regular users don't know that it's still one of today's biggest threats. This threat doesn't only come from malware authors continuing to weaponize it for a diverse set of operations. Malware authors wouldn't ever bother with an inefficient exploit. ExploitBlue continues to be a threat because of the vulnerable machines still available online. According to Nate Warfield of the Microsoft Security Response Center, there are still plenty of vulnerable Windows systems exposing their SMB service available online.
BleepingTypo, not BleepingComputer.
The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
You can explain to people that to work better, live without paranoia have increased security, have stability and control go use linux.
It just does not work though, if we were logical animals out for our best interest and getting things done windows would have sank into oblivion decades ago but there is something mentally wrong with the vast majority of us and the obvious solution sitting under everyones nose is ignored to continue what we already know doesn't work.
*shrug*
Humans, weird lil monkies I must say, but unless we aerosol spray a retro virus to change our nature you can keep screaming at them full force with all the effect of a summer breeze against a mountain of stupid.
Could all be part of the National Time Sensitive Systems tasks. Along with BLUEBERRY, BLUESKY, BLUESTREAM.
Domestic spying is now "Benign Information Gathering"
Almost a year after WannaCry and there's still over a million SMB servers without auth exposed to the world. At least it looks like "only" 66k of them are running Windows
Samba is still using SMB v1 by default on many configurations for legacy purpose.
Microsoft Windows strikes again ..
You got to feel sorry for the poor NSA, getting hacked by hackers and all that fake news jazz. It's almost as scary as the terrorists who terrorized us on 9-11. I sleep better at night knowing the NSA is keeping me safe and secure. And heil Hillary as mandated by law! ae911truth dot org
Isn't it time Microsoft started changing Windows so that it no longer exposes the horridly broken SMB protocol to the Internet at large (rather than the local LAN) unless you explicitly turn on the ability for the Internet at large to speak SMB to your computer?
I don't think it is open by default to the internet, because inbound packets on SMB port will surely be blocked by your routers firewall anyway. The problem is that some websites might attack this local SMB port on your machine and hence spread ransomwares. I am on Windows and I patched this SMB hole manually by myself. Fire up your beloved disassembler and pinpoint those hex codes responsible then replace them and then dump the original buggy file. Won't take you more than 2 hours. Verify by running netstat -ano
If you wan't an easier solution, download MS patch for SMBv1.
Microsoft doesn't. It's blocked by default. SMBv1 is also disabled by default and has been for quite a while. Unfortunately there are just as many idiots in the Linux admin world as there are in the Windows world, and the vast majority of these are nothing to do with Windows.
The summary tweet in TFA:
"Almost a year after WannaCry and there's still over a million SMB servers without auth exposed to the world. At least it looks like "only" 66k of them are running Windows"
My cybersecurity company is still finding MS08-067 all over the place. IT'S ten years old, and it's "bigger than ever!" It's every burgeoning hacker's favorite, since it is so trivial to exploit.
Many security vulnerabilities can be exploited through multiple attack vectors. I'm more interested in where the actual flaw(s) are than which attack vectors are most convenient or popular at the moment.
If Firefox has an issue that allows JavaScript to be loaded from URLs it shouldn't load from, bad on Firefox. If Windows (or Linux) had a big in the kernel that allowed JavaScript, in any browser, to bypass the separation between processes and read memory assigned to another process, bad on Microsoft. It is the kernel's job to enforce that protection. The flaw could be exploited in any number of ways, by any program, including via JavaScript.
It is the sworn testimony of Microsoft's top executives Microsoft intertwined their browser so deep into the OS internals that it's impossible for Microsoft to make a version of Windows that can even boot without running browser code. Linux isn't designed that way. The browser isn't intertwined with the kernel or key parts of the OS. The browser (actually browsers) are completely separate applications like any other application, and the Linux OS is in no way dependant on the browser.
It is fair, I think, to take Microsoft at their word, especially given the supporting evidence. When they testify under oath that their engineers are unable to remove legacy Internet Explorer code from Windows because it's so intertwined with the OS, and we see that in fact browser-based exploits do in fact infect the Windows OS at a deep level, we can only conclude that their testimony is true and they really did embed IE code deep in the OS.
Unless we get some strong evidence that Microsoft was committing perjury, it does make sense to acknowledge that their browser is an intrinsic part of their OS. It also makes sense to acknowledge the fact that Linux is not designed that way.
"According to Nate Warfield of the Microsoft Security Response Center, there are still plenty of vulnerable Windows systems exposing their SMB service available online."
That's a Windows feature, right?
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
The SMB protocol itself isn't "horridly broken", although SMB1 doesn't support the integrity protection that prevents man-in-the-middle downgrade attacks (SMB3 does).
Specific *implementations* can be broken, but if you're fully patched there are no existing vulnerabilities here.
will surely be blocked by your routers firewall anyway
I'll be sure to bring my router with me the next time I use my laptop at the local coffee shop.
Have gnu, will travel.
No, because MSWind frequently failed on demos.
I think we've pushed this "anyone can grow up to be president" thing too far.
Calling someone stupid is always rude, but calling them stupid while you spout "facts" that well-known to be completely false makes you look really silly.
For a few weeks, Microsoft TALKED ABOUT maybe releasing an "E" version of Windows 7 for Europe, which would have the IE icon removed from the desktop and such. It would still be installed, because it's required by a lot of other system components, but the shortcut to launch a pure IE window wouldn't be there by default. A few weeks later they announced they wouldn't be doing that, Europe would get Windows with IE pre-installed.
I completely agree Microsoft has changed a lot in the last ten years or so. As their Windows revenue has been falling every year for a long time, they've shifted their focus to profitable products instead.