4 ms·

So NSA knew 90 days ago and gave MS the heads up. They patched hurriedly eg. 14th March for EternalBlue - but didn't say anything to their customers re:patches

So NSA knew 90 days ago and gave MS the heads up. They patched hurriedly eg. 14th March for EternalBlue - but didn't say anything to their customers re:patches must go ASAP (many large corporations have to phase them - i.e not at all at once on First Tuesday) so many companies are currently still vulnerable and probably won't hit them until next Tuesday after the Bank Holiday. What a mess.

hexadecimated 10y ago
Once a patch is released, it's generally quite straightforward to compare before and after, reverse engineering it to find the vulnerability. So the general advice is always to patch as soon as possible.
- nickpsecurity 10y ago
  Even automatically... ;) http://bitblaze.cs.berkeley.edu/papers/apeg.pdf http://bitblaze.cs.berkeley.edu/papers/apeg.pdf
fulafel 10y ago
Corporations don't have to delay critical security patches, they just elect to do so based on some motives that compete with security.
- archvile 10y ago
  "Some motive" I think would equate to fear of breaking mission critical or legacy applications. In a high-stakes environment, I'd imagine functionality would win out initially over security, until everything has time to be tested properly.
- scurvy 10y ago
  I worked at MSN a while ago, and even we didn't patch everything immediately. It had to go through our team's QA first. We found a few bad installers and that reinforced the practice.
hannob 10y ago
> So NSA knew 90 days ago and gave MS the heads up. Where do you get that conclusion from? I don't read any such claim from this advisory. MS seems at least for now to stay silent how they got info about those exploits. There are various ways this could've happened. NSA could've warned them. Shadowbrokers could've warned them. Someone else with inside knowledge could've given them anonymous tips. From the current available information we don't know that.
- strictnein 10y ago
  The Shadowbrokers were trying to sell these exploits. There's screenshots from ~90 days ago with these all listed for sale with slightly modified names. This probably explains why MS skipped February's patch day. They were extremely busy fixing all of these and wanted to do them all at once.
- nthcolumn 10y ago
  No you're right I have no idea. For all I know these vulns could have been crafted by MS themselves as convenient backdoors at the behest of the NSA et al with tested patches on ice for the eventuality that they had to go away some day.
yuhong 10y ago
Which also reminds me of the skipped Feb patches. I quickly figured out that Veeam reported their bug only a week before Patch Tuesday. (see https://forums.veeam.com/veeam-backup-replication-f2/after-the-refs-4k-horror-story-new-problem-t40720-45.html https://forums.veeam.com/veeam-backup-replication-f2/after-t...) This is a good example of how MS's build process works. According to https://blogs.technet.microsoft.com/filecab/2017/01/30/windows-server-2016-data-deduplication-users-please-install-kb3216755/ https://blogs.technet.microsoft.com/filecab/2017/01/30/windo... they did go so far as to assign a KB number to the fixed patches, but there was a "build issue" according to Mary Jo Foley. I wonder what the dates would be if it was actually released.

hexadecimated 10y ago

Once a patch is released, it's generally quite straightforward to compare before and after, reverse engineering it to find the vulnerability. So the general advice is always to patch as soon as possible.

nickpsecurity 10y ago
Even automatically... ;) http://bitblaze.cs.berkeley.edu/papers/apeg.pdf http://bitblaze.cs.berkeley.edu/papers/apeg.pdf

fulafel 10y ago

Corporations don't have to delay critical security patches, they just elect to do so based on some motives that compete with security.

archvile 10y ago
"Some motive" I think would equate to fear of breaking mission critical or legacy applications. In a high-stakes environment, I'd imagine functionality would win out initially over security, until everything has time to be tested properly.
scurvy 10y ago
I worked at MSN a while ago, and even we didn't patch everything immediately. It had to go through our team's QA first. We found a few bad installers and that reinforced the practice.

hannob 10y ago

> So NSA knew 90 days ago and gave MS the heads up. Where do you get that conclusion from? I don't read any such claim from this advisory. MS seems at least for now to stay silent how they got info about those exploits. There are various ways this could've happened. NSA could've warned them. Shadowbrokers could've warned them. Someone else with inside knowledge could've given them anonymous tips. From the current available information we don't know that.

strictnein 10y ago
The Shadowbrokers were trying to sell these exploits. There's screenshots from ~90 days ago with these all listed for sale with slightly modified names. This probably explains why MS skipped February's patch day. They were extremely busy fixing all of these and wanted to do them all at once.
nthcolumn 10y ago
No you're right I have no idea. For all I know these vulns could have been crafted by MS themselves as convenient backdoors at the behest of the NSA et al with tested patches on ice for the eventuality that they had to go away some day.

yuhong 10y ago

Which also reminds me of the skipped Feb patches. I quickly figured out that Veeam reported their bug only a week before Patch Tuesday. (see https://forums.veeam.com/veeam-backup-replication-f2/after-the-refs-4k-horror-story-new-problem-t40720-45.html https://forums.veeam.com/veeam-backup-replication-f2/after-t...) This is a good example of how MS's build process works. According to https://blogs.technet.microsoft.com/filecab/2017/01/30/windows-server-2016-data-deduplication-users-please-install-kb3216755/ https://blogs.technet.microsoft.com/filecab/2017/01/30/windo... they did go so far as to assign a KB number to the fixed patches, but there was a "build issue" according to Mary Jo Foley. I wonder what the dates would be if it was actually released.