4 ms·
You stopped before the next sentence which completely changes the context: > In cases where the system has not been previously compromised and implanted with
by justinsaccount 9y ago
You stopped before the next sentence which completely changes the context:
> In cases where the system has not been previously compromised and implanted with DOUBLEPULSAR, the malware will use ETERNALBLUE for the initial exploitation of the SMB vulnerability. This is the cause of the worm-like activity that has been widely observed across the internet.
This is not really any different from Blaster from 2003.
- nikanj 9y agoWas Blaster using a hole that had been patched months ago?
- throwaway91111 9y agoMonths? No. Weeks? Yes.
- justinsaccount 9y agoAbout a month, yes In that case, it was supposedly because of the patch: > According to court papers, the original Blaster was created after security researchers from the Chinese group Xfocus reverse engineered the original Microsoft patch that allowed for execution of the attack The patch was ms03-026: Buffer Overrun In RPC Interface Could Allow Code Execution Published: July 16, 2003 (could, hah) > The worm was first noticed and started spreading on August 11, 2003 It was a huge problem at college campuses well into September. Students would arrive with their brand new laptops running XP and get hit with the worm 30 seconds after connecting to the network. Really the main difference is blaster was just an annoyance and mostly just broke random things like the DHCP service, but was easily fixed.
- deleted 9y ago[deleted]