9 ms·
Shadow Brokers exploits are patched or inactive on supported Windows platforms
- hexadecimated 10y agoNice to see that these weren't zero day exploits after all, despite the claims being spread over Twitter. Looks like some amateur security researchers forgot to patch their test VMs.
- celticninja 10y agoDo you have a source for that? Looks like MS have released a number of patches for these exploits and so have other software vendors so I'm not sure what your claim is based on.
- hexadecimated 10y agoThe exploits were released yesterday and the linked article says they have all been patched.
- sangnoir 10y agoAccording to ArsTechnica, the Shadow Brokers' exploits were patched (silently) back in March. This suggests that no fully patched system should be vulnerable, which doesn't jibe with what some security researchers were claiming.
- mrb 10y agoMS17-010 was a 0-day.
- hexadecimated 10y agoIt was patched last month, so how is it a zero day when these exploits were released yesterday?
- monocasa 10y agoIt would have been a 0day when the Shadow Brokers would have acquired it from the NSA.
- deleted 10y ago[deleted]
- grandol 10y agoYes, as usual, WikiLeaks and Julian are sensationalizing the heck out of something they've been sitting on for a while. How convenient.
- trendia 10y agoMucrosoft patched a lot of the vulnerabilities within the last several months. That doesn't mean that they weren't serious vulnerabilities (i.e. the scope of the exploit) or that they weren't actively used (since the exploits could have been used from the time they were found by hackers to the time they were patched). Also, I see a lot of green accounts in this thread...
- strictnein 10y agoI follow one of the people who was first to test these exploits out. They're not actually an amateur, but they did forget to patch their test VMs. Just like a lot of the other people who replicated the results.
- technion 10y agoThe thing to be fair about there is that you can install Windows 2012 R2 in a VM in about 15 minutes, but if you want to apply all updates, you could be sitting there for hours. I built and updated two servers on spinning rust last week and it took six separate reboot cycles and nine total hours. It probably isn't about "forgetting", as much as considering that there was indication patches were relevant and you wanted to start this research today. Edit: It's easy to call people "amateurs" in hindsight, and not necessarily fair.
- yuhong 10y agoBut the update rollups do make it easier these days.
- justinjlynn 10y ago> Customers still running prior versions of these products are encouraged to upgrade to a supported offering. That's a very polite way to say "fuck you, pay me".
- stordoff 10y agoWindows 7 released in 2009, and MS will keep issuing security patches until 2020. They also responded to this on Friday/Saturday of Easter weekend. There's not a whole lot you can blame MS for here, except for the bugs existing in the first place (which is all but inevitable given the size of the codebase and the amount of scrutiny under which various groups put it).
- Markoff 10y agothe problem is not really Windows, but hardware abandoned by manufacturers, my mother has perfectly good/sufficient computer for her needs running Win7, which can't be upgraded any further (wanted to upgrade from Vista to W10 or W8, to find the most recent I can get is W7) because of video drivers not supported anymore and there is not really workaround, so it would require buying new video card, which in the end means I might as well just buy for her new Android tablet an get rid off PC or might as well, just install there Linux in the end
- bigbugbag 10y agoThe upgrade path from here is obvious enough: Linux.
- dsp1234 10y agobecause of video drivers not supported anymore and there is not really workaround, so it would require buying new video card A cheap 1GB video card can be had for $25.[0][1] And it is currently supported for the Windows 10 platform.[2] Which is not to say that Linux and/or an Android tablet wouldn't be the best solution, just that the purchase and installation of a new video card is maybe not as expensive as would seem. [0] - https://www.newegg.com/Product/Product.aspx?Item=N82E16814130880 https://www.newegg.com/Product/Product.aspx?Item=N82E1681413... [1] - https://www.newegg.com/Product/ProductList.aspx?Submit=ENE&N=100007709%204093&IsNodeId=1 https://www.newegg.com/Product/ProductList.aspx?Submit=ENE&N... [2] - http://www.nvidia.com/download/driverResults.aspx/112596/en-us http://www.nvidia.com/download/driverResults.aspx/112596/en-...
- pinpeliponni 10y agoI noticed Microsoft has been very careful not to mention NSA.
- stordoff 10y agoWhy would they? The immediate concern is whether or not the exploits are still a risk, not determining the origin. Any future use of them is likely to be groups other than NSA at this point anyway. If/when Microsoft do call out the NSA, I imagine it'll a) be filtered through their press/PR teams and b) be after they've had time to verify the source (it seem overwhelmingly likely to be NSA-originated, but I'd guess MS will do their own investigation and not just take it at face value).
- toyg 10y agoMS will never "call out" anybody, in particular nobody in the US government - one of the few entities on the planet who can make Redmond lives materially harder. MS and authorities have a long history of peaceful collaboration and there is no reason to believe this state of things will change anytime soon.
- hexadecimated 10y agoThe provenance of these exploits is irrelevant to whether or not their products have been patched, so why would they?
- jameskegel 10y agoI keep reading your response and it does not refute what OP is saying.
- deleted 10y ago[deleted]
- mike_hearn 10y agoLooking at their acknowledgements list it seems advisories always have acknowledgements even when it's Microsoft themselves who find the flaw. However, the MS17-010 patches didn't have any. If that's because they'd have to acknowledge the NSA, then it seems like more stuff is on the way: MS17-019 is also missing from the list. That's also patched in March and is "a vulnerability in Active Directory Federation Services (ADFS). The vulnerability could allow information disclosure if an attacker sends a specially crafted request to an ADFS server, allowing the attacker to read sensitive information about the target system."
- noja 10y agoin other words "Not all"
- nthcolumn 10y agoFor sure those vulns disclosed are not all so NSA must tell MS all now (whether MS knew all - eg. backdoors - in the first place is another thing).
- pluma 10y ago> Of the three remaining exploits [...] none reproduces on supported platforms, which means that customers running Windows 7 and more recent versions of Windows or Exchange 2010 and newer versions of Exchange are not at risk. So none of the exploits should be a problem if you're on somewhat recent versions of Windows and Exchange (as applicable). If you're still on Windows Vista, XP, 2000 or NT, you likely have bigger problems already.
- deleted 10y ago[deleted]
- nthcolumn 10y agoSo NSA knew 90 days ago and gave MS the heads up. They patched hurriedly eg. 14th March for EternalBlue - but didn't say anything to their customers re:patches must go ASAP (many large corporations have to phase them - i.e not at all at once on First Tuesday) so many companies are currently still vulnerable and probably won't hit them until next Tuesday after the Bank Holiday. What a mess.
- hexadecimated 10y agoOnce a patch is released, it's generally quite straightforward to compare before and after, reverse engineering it to find the vulnerability. So the general advice is always to patch as soon as possible.
- nickpsecurity 10y agoEven automatically... ;) http://bitblaze.cs.berkeley.edu/papers/apeg.pdf http://bitblaze.cs.berkeley.edu/papers/apeg.pdf
- fulafel 10y agoCorporations don't have to delay critical security patches, they just elect to do so based on some motives that compete with security.
- archvile 10y ago"Some motive" I think would equate to fear of breaking mission critical or legacy applications. In a high-stakes environment, I'd imagine functionality would win out initially over security, until everything has time to be tested properly.
- scurvy 10y agoI worked at MSN a while ago, and even we didn't patch everything immediately. It had to go through our team's QA first. We found a few bad installers and that reinforced the practice.
- 10y ago
- partycoder 10y agoOne thing is collaborating with law enforcement, another thing is collaborating on mass surveillance. Microsoft collaborated setting up mass surveillance (PRISM). One thing is a bug, another one is a backdoor. Are these good faith bugs or willful backdoors? Most likely they're bugs, but it is hard to know. If I was Microsoft and I wanted to willfully plant a backdoor, I would take precautions to be able to get away with it if caught. Because security researchers can analyze them, and foreign governments have Windows source code, leaving intentional bugs as the only choice. Now, the reasons I am suspicious of Microsoft: - PRISM. Which is unequivocally mass surveillance. - The Flame malware was able to install itself via Windows Update: http://www.computerworld.com/article/2503916/malware-vulnerabilities/researchers-reveal-how-flame-fakes-windows-update.html http://www.computerworld.com/article/2503916/malware-vulnera... . The means by which the Flame authors achieved this are easier to explain if they received help from Microsoft. - When Windows NT SP5 was released, the build accidentally came with debugging symbols (i.e: variable names were visible in binaries). A researcher found a variable called "_NSAKEY" containing a key which could be used to forge signatures. https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY. Microsoft's explanation was that it wasn't related to the NSA, and that NSA in that context meant something else.
- hexadecimated 10y agoThis idea that Microsoft is deliberately introducing bugs into its software so nation states can exploit them is so absurd, it really is tinfoil hat conspiracy theory ludicrousness.
- kuschku 10y agoIt doesn't have to be known by Microsoft management. It's enough if the NSA has people working at MS on their payroll.
- hexadecimated 10y agoThat's just an insinuation of conspiracy with no evidence whatsoever behind it. The more believable alternative is that developers simply make mistakes now and then.
- 1ris 10y agoI just don't believe shadowbrokers just burned all their 0days. I assume they only release the cheapest exploits and either sell or keep the rest. E.g. russia now has several NSA exploits.
- amq 10y agoThose '0days' are not worth much after they were patched by MS in March.
- nthcolumn 10y agoYes, saving the best 'til last you'd think or keeping some insurance (lol they are already dead). But then NSA should know what 0days TSB have left though right? Do MS? Also - you are assuming TSB have sold some to russia (and that russia would want them)? What Snowden helpfiles do we not have matching warez for? Do the two non-reproduceables require another undisclosed component?
- 1ris 10y agoI just don't believe shadowbrokers just burned all their 0days. I assume they only release the cheapest exploits and either sell or keep the rest. E.g. russia now has several NSA exploits.
- kikigaki 10y agoso they are now patched, shadowbrokers have found plenty of new vulns since then. loads of linux vulns too, makes up a big part of the internet, which makes it potentially even more scary.