4 ms·

I find it very irresponsible that NSA did not report these vulnerabilities to Microsoft after they had fallen into hands of shadow broker (no longer zeroday). S

I find it very irresponsible that NSA did not report these vulnerabilities to Microsoft after they had fallen into hands of shadow broker (no longer zeroday). Shadowbroker announced possession of these zerodays around 3 months ago. NSA had good 3 months to work with Microsoft to patch these. They chose not to.

SomeStupidPoint 10y ago
It's possible the NSA isn't sure what the Shadow Brokers have.
- emn13 10y ago
  ...which doesn't make it any less irresponsible. However, judging by https://technet.microsoft.com/en-us/library/security/ms17-010.aspx https://technet.microsoft.com/en-us/library/security/ms17-01... it's likely somebody had some advance knowledge, somehow. Oh, and hey: https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/ https://blogs.technet.microsoft.com/msrc/2017/04/14/protecti...
- israrkhan 10y ago
  In their original leak, Shadowbroker released a list of all file names in the encrypted part of the archive. They just did not release the password at that time. See following tweet by shadowbrokers from Jan 7. https://twitter.com/shadowbrokerss/status/817960380815306752 https://twitter.com/shadowbrokerss/status/817960380815306752
bigbugbag 10y ago
Why would they ? Have they ever done something similar ?
sigmar 10y ago
All of the vulnerabilities were patched by March. https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/ https://blogs.technet.microsoft.com/msrc/2017/04/14/protecti...
- israrkhan 10y ago
  1) Some of these exploits work on many platforms (They are truyly 0day) [1]. Windows NT, 2000, 2003, XP, Vista, 7, 2008, 8 and 2012 are vulnerable. 2) Microsoft issued a statement that NSA did not tell them about any of the leaks [2] 3) NSA knew what was coming since Jan 7 [3] [1] https://twitter.com/hackerfantastic/status/853036942342189056 https://twitter.com/hackerfantastic/status/85303694234218905... [2] https://twitter.com/samfbiddle/status/853025550096621568 https://twitter.com/samfbiddle/status/853025550096621568 [3] https://twitter.com/shadowbrokerss/status/817960380815306752 https://twitter.com/shadowbrokerss/status/817960380815306752
  - sigmar 10y ago
    re: 1) Doesn't work on updated windows 7. re: 2) You should reread that link and look at the correction. Microsoft was notified.

SomeStupidPoint 10y ago

It's possible the NSA isn't sure what the Shadow Brokers have.

emn13 10y ago
...which doesn't make it any less irresponsible. However, judging by https://technet.microsoft.com/en-us/library/security/ms17-010.aspx https://technet.microsoft.com/en-us/library/security/ms17-01... it's likely somebody had some advance knowledge, somehow. Oh, and hey: https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/ https://blogs.technet.microsoft.com/msrc/2017/04/14/protecti...
israrkhan 10y ago
In their original leak, Shadowbroker released a list of all file names in the encrypted part of the archive. They just did not release the password at that time. See following tweet by shadowbrokers from Jan 7. https://twitter.com/shadowbrokerss/status/817960380815306752 https://twitter.com/shadowbrokerss/status/817960380815306752

bigbugbag 10y ago

Why would they ? Have they ever done something similar ?

sigmar 10y ago

All of the vulnerabilities were patched by March. https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/ https://blogs.technet.microsoft.com/msrc/2017/04/14/protecti...

israrkhan 10y ago
1) Some of these exploits work on many platforms (They are truyly 0day) [1]. Windows NT, 2000, 2003, XP, Vista, 7, 2008, 8 and 2012 are vulnerable. 2) Microsoft issued a statement that NSA did not tell them about any of the leaks [2] 3) NSA knew what was coming since Jan 7 [3] [1] https://twitter.com/hackerfantastic/status/853036942342189056 https://twitter.com/hackerfantastic/status/85303694234218905... [2] https://twitter.com/samfbiddle/status/853025550096621568 https://twitter.com/samfbiddle/status/853025550096621568 [3] https://twitter.com/shadowbrokerss/status/817960380815306752 https://twitter.com/shadowbrokerss/status/817960380815306752
- sigmar 10y ago
  re: 1) Doesn't work on updated windows 7. re: 2) You should reread that link and look at the correction. Microsoft was notified.