6 ms·
This entire article is a gross mischaracterisation of the facts and risks. The only major zero days released for Windows in this bundle targeted SMB (SMBv1, SM
by UnoriginalGuy 10y ago
This entire article is a gross mischaracterisation of the facts and risks.
The only major zero days released for Windows in this bundle targeted SMB (SMBv1, SMBv2, & SMBv3). By default Windows firewalls SMB and has since Windows XP SP2. Many home and business users then typically have a NAT between the Windows Firewall and the internet, offering a second layer of protection.
Few companies intentionally expose SMB to the internet. Generally users are required to VPN in before then being able to contact an SMB endpoint.
The type of language in this article is designed to mislead non-technical readers into believing they're at risk e.g.:
> The software could give nearly anyone with sufficient technical knowledge the ability to wreak havoc on millions of Microsoft users.
So either the article author lacks the technical literacy to understand why this is untrue, or they know it to be untrue and are trying to implant fear into their readership. In either case, not a good look for The Intercept.
- 086421357909764 10y agoIsn't that the Intercepts whole M.O. though?
- jacquesm 10y ago> Few companies intentionally expose SMB to the internet. True, but in your average coffee shop setup if a user has SMB running you could reach them via a local IP if it isn't firewalled off on the machine itself.
- linkregister 10y ago1. This is actually a big deal. Look on Shodan and see how many systems have the CIFS port open, bannering on Win8 and older. 2. There are other risks: pivoting, RDP, etc. 3. Greenwald's entire point of founding The Intercept was to capitalize on bombastic Snowden leak stories without intermediaries such as The Guardian. It seems like it would be counterproductive for the editors to write something measured or that give NSA any benefit of the doubt. Readers should expect alarmist journalism from The Intercept as much as they should expect anti-conservative viewpoints from the NYT.
- UnoriginalGuy 10y agoI did look on Shodan before I wrote the above, am not seeing "millions" of machines like this hyperbolic article claimed. But never let fact get in the way of hyperbole and clickbait, it doesn't matter that Windows is secure against this out of the box since XP SP2, it doesn't matter that a simple NAT "firewall" will protect you, all that matters is that some article told you to be afraid and no amount of technical facts is going to get in the way of that. Too many of these types of articles and threads appearing today completely void of rationality about the scope of this because they don't understand the attack vector and "journalists" like The Intercept are not helping. But naturally outside of a few Netsec discussion boards the fear-party is in full swing, and people will downvote those not fully committed to that narrative.
- mschuster91 10y ago> Few companies intentionally expose SMB to the internet. Generally users are required to VPN in before then being able to contact an SMB endpoint. And what did (and likely still does) the NSA possess? Exploits for Cisco gear, which many enterprises and universities use to provide VPN access. > So either the article author lacks the technical literacy to understand why this is untrue, or they know it to be untrue and are trying to implant fear into their readership. In either case, not a good look for The Intercept. Place a drive-by-infection malware on a news site, or a well done email, which contains a payload that exploits said SMB issue, and boom you've infected the entire network. Also, many people don't upgrade their Windows servers if not absolutely neccessary.