5 ms·

Nice to see that these weren't zero day exploits after all, despite the claims being spread over Twitter. Looks like some amateur security researchers forgot t

Nice to see that these weren't zero day exploits after all, despite the claims being spread over Twitter. Looks like some amateur security researchers forgot to patch their test VMs.

celticninja 9y ago
Do you have a source for that? Looks like MS have released a number of patches for these exploits and so have other software vendors so I'm not sure what your claim is based on.
- hexadecimated 9y ago
  The exploits were released yesterday and the linked article says they have all been patched.
- sangnoir 9y ago
  According to ArsTechnica, the Shadow Brokers' exploits were patched (silently) back in March. This suggests that no fully patched system should be vulnerable, which doesn't jibe with what some security researchers were claiming.
mrb 9y ago
MS17-010 was a 0-day.
- hexadecimated 9y ago
  It was patched last month, so how is it a zero day when these exploits were released yesterday?
  - monocasa 9y ago
    It would have been a 0day when the Shadow Brokers would have acquired it from the NSA.
    - deleted 9y ago
      [deleted]
grandol 9y ago
Yes, as usual, WikiLeaks and Julian are sensationalizing the heck out of something they've been sitting on for a while. How convenient.
- trendia 9y ago
  Mucrosoft patched a lot of the vulnerabilities within the last several months. That doesn't mean that they weren't serious vulnerabilities (i.e. the scope of the exploit) or that they weren't actively used (since the exploits could have been used from the time they were found by hackers to the time they were patched). Also, I see a lot of green accounts in this thread...
strictnein 9y ago
I follow one of the people who was first to test these exploits out. They're not actually an amateur, but they did forget to patch their test VMs. Just like a lot of the other people who replicated the results.
- technion 9y ago
  The thing to be fair about there is that you can install Windows 2012 R2 in a VM in about 15 minutes, but if you want to apply all updates, you could be sitting there for hours. I built and updated two servers on spinning rust last week and it took six separate reboot cycles and nine total hours. It probably isn't about "forgetting", as much as considering that there was indication patches were relevant and you wanted to start this research today. Edit: It's easy to call people "amateurs" in hindsight, and not necessarily fair.
  - yuhong 9y ago
    But the update rollups do make it easier these days.

Nice to see that these weren't zero day exploits after all, despite the claims being spread over Twitter. Looks like some amateur security researchers forgot to patch their test VMs.

celticninja 9y ago

Do you have a source for that? Looks like MS have released a number of patches for these exploits and so have other software vendors so I'm not sure what your claim is based on.

hexadecimated 9y ago
The exploits were released yesterday and the linked article says they have all been patched.
sangnoir 9y ago
According to ArsTechnica, the Shadow Brokers' exploits were patched (silently) back in March. This suggests that no fully patched system should be vulnerable, which doesn't jibe with what some security researchers were claiming.

mrb 9y ago

MS17-010 was a 0-day.

hexadecimated 9y ago
It was patched last month, so how is it a zero day when these exploits were released yesterday?
- monocasa 9y ago
  It would have been a 0day when the Shadow Brokers would have acquired it from the NSA.
  - deleted 9y ago
    [deleted]

grandol 9y ago

Yes, as usual, WikiLeaks and Julian are sensationalizing the heck out of something they've been sitting on for a while. How convenient.

trendia 9y ago
Mucrosoft patched a lot of the vulnerabilities within the last several months. That doesn't mean that they weren't serious vulnerabilities (i.e. the scope of the exploit) or that they weren't actively used (since the exploits could have been used from the time they were found by hackers to the time they were patched). Also, I see a lot of green accounts in this thread...

strictnein 9y ago

I follow one of the people who was first to test these exploits out. They're not actually an amateur, but they did forget to patch their test VMs. Just like a lot of the other people who replicated the results.

technion 9y ago
The thing to be fair about there is that you can install Windows 2012 R2 in a VM in about 15 minutes, but if you want to apply all updates, you could be sitting there for hours. I built and updated two servers on spinning rust last week and it took six separate reboot cycles and nine total hours. It probably isn't about "forgetting", as much as considering that there was indication patches were relevant and you wanted to start this research today. Edit: It's easy to call people "amateurs" in hindsight, and not necessarily fair.
- yuhong 9y ago
  But the update rollups do make it easier these days.